Privacy Notice for Recruitment (GAN)
Last updated: September 22nd, 2026
The service for handling recruitments and simplifying the hiring process (the "Service") is powered by Teamtailor AB (Registration Number 556936-6668, Address Östgötagatan 16, 116 21, Stockholm, Sweden) on behalf of GAN brand operating by different affiliated companies within a group of companies of GAN Limited and its related companies across various countries. The specific entity responsible for managing your Personal Data depends on the country of recruitment and may be either GAN Software Services BG Ltd. (Registration Number 204164230, address 9 Lyuba Velichkova STR, Sofia 1407, Floor 6, Bulgaria) or GAN Nevada, Inc. (Registration Number NV20131342782, address 955 Grier Drive, Suite C, Las Vegas, Nevada 89119, the United States) (jointly or separately further referred to as “GAN”, “we”, “us”). It is important that you, as an individual using the Service, feel safe with, and are informed about, how we handle your Personal Data during the recruitment process. Striving to maintain the highest possible standard regarding the protection of Personal Data we process and protect your Personal Data in accordance with applicable legislation and this Privacy Notice (“Privacy Notice”). By using the Service or otherwise providing information to us during recruitment at GAN, you acknowledge and agree to the data practices described in this Privacy Notice.
If you are a California resident, please see the section below titled “Your Privacy Rights and Choices. California Residents” for our Notice at Collection and additional information provided pursuant to California law.
Please read the following carefully to understand our views and practices regarding your Personal Data and how we will treat it.
1. Who are we?
1.1. GAN acts as the “Controller” of your Personal Data or “Business” in accordance with applicable data protection legislation for the purposes described in this Privacy Notice, meaning that we determine the purposes and means of processing your Personal Data. Teamtailor AB provides and hosts the recruitment platform on our behalf acts as our data processor, processing Personal Data only in accordance with our instructions and applicable laws.
2. Who does this Privacy Notice apply to?
2.1. This Privacy Notice applies at every stage of recruitment process, including when:
2.1.1. individuals applying for employment with GAN;
2.1.2. individuals who connect with us through our careers site to receive information about current or future employment opportunities;
2.1.3. individuals whose professional profiles we identify through publicly available sources for recruitment purposes;
2.1.4. individuals referred to us by employees or recruitment partners;
2.1.5. individuals acting as references for candidates; and
2.1.6. visitors to our careers site where Personal Data are collected through the operation of the website.
3. What Personal Data about you may be collected and processed ?
3.1. For purposes of this Privacy Notice, “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household.
3.2. We are responsible for the processing of the Personal Data that you directly contribute to the Service, or for the Personal Data that we or our business service providers may indirectly in other ways collect within the recruitment process with us. “Processing” refers to any action or set of actions we perform on your Personal Data, encompasses a broad range of operations, which could be performed manually or automatically and include collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, erasure or destruction.
3.3. We may collect the following categories of Personal Data about you in the course of business and through your recruitment at GAN, which includes, but is not limited to:
3.3.1. Data which you have provided to us in your candidate application form via Service: your first name and last name, your place of residence (country, city), email address and phone number, data about the position being applied for, are you at least 21 years old, country (countries) citizenship/residence permit you own, if you are not currently living in the city and/or country (if applicable and required for the vacancy) are you open to relocating, your monthly gross salary expectation, when could you start working with us, how did you hear about the opportunity, details of your referral, what motivates you to join us, link to apply with your LinkedIn profile, other additional questions as may be applicable for particular position (like, list tools and technologies you have used in a professional capacity, indicating your level proficiency with each).
3.3.2. Any additional data which you may have provided to us or to recruitment agencies in your application documents (curriculum vitae (CV), cover letter and any additional documents). The scope of such data depends fully upon you and may include, but is not limited to: date of birth, photo, work experience and employment history, job titles, qualifications, suitability and competence, academic records, educational background, language(s) and other skills, your contact details,
3.3.3. Any additional data which you may have provided otherwise within the recruitment process). The scope of such data may depend from the position you apply for or may be necessary for preparation of your employment contract with successful candidates, and may include, but is not limited to: document verifying your identity, or confirming your eligibility for vacancy, right to work stay in the country (like, visa, immigration status, residence permit, work permits), background checks, national identification number, emergency contacts, signature, race, ethnic origin, marital status, family composition, disability, Social Security Number, driver’s license, passport, state identification card, mandatory (pre) occupational medical examination (if applicable), welfare or retirement benefits related information. Such data shall not be processed by TeamTailor AB and will be requested separately via a dedicated communication solution.
3.3.4. Data generated during the recruitment process, such as interview video or audio recordings and transcripts, assignments, tests, interview notes and summaries, answers to questions asked through the recruiting, data related to personal and suitability assessments, and data related to the progress of the recruitment process and selection, information on whether your application can be used in other our recruitments.
3.3.5. Data obtained from social networks, state registers and other publicly accessible sources, including but not limited to LinkedIn accounts.
3.3.6. Data provided to us by your referees (if applicable), vendors for reference checks, previous employers, and screening, or recruitment agencies (if applicable).
3.3.7. Usage information relating to your use of the Service, including IP address, browser type, operating system, device identifiers, pages visited and session information.
3.3.8. Data generated through candidate communications, including emails, messages submitted through the Service and communications relating to interview scheduling.
3.3.9. Data and documents which you have provided to us when subscribing through our careers site to receive information about current or future employment opportunities.
3.4. Please, bear in mind that:
3.4.1. if your identity has been removed from the data it will become anonymous data and that will not be your Personal Data;
3.4.2. we collect and process only your Personal Data that is relevant for the recruitment process and to the extent it is necessary;
3.4.3. your Personal Data that is processed with the purpose of aggregated analysis or market research is always made unidentifiable and it cannot be used to identify you, and thus such data is not considered as Personal Data.
3.5. It is important that you provide us with up-to-date and accurate Personal Data in order to enable us to process your application. We may need to reject an application on the basis that insufficient, irrelevant, or false information has been provided to completely assess the application.
3.6. We may supplement the data that you provide to us with information that we receive or obtain from other sources, such as our staff or personnel; vendors and service providers; professional advisers, partners, and agents of GAN; third parties with whom we interact; and publicly available sources.
3.7. Sensitive Personal Data
3.7.1. When you apply for a role with us, we only request the Personal Data that is necessary to assess your application. We do not ask you, and you are not required, to include in your CV, cover letter, or any supporting document any information that, depending on the jurisdiction and applicable legislation, may determined as sensitive personally identifiable information or belonging to special categories of data, including, but not limited to: racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, health information, including disability status, data concerning sex life or sexual orientation, government identifiers, financial information or credentials allowing access to an account, precise geolocation, contents of mail, email, and text messages (together “Sensitive Personal Data”).
3.7.2. Please, mind that if you choose to include Sensitive Personal Data in your CV, cover letter, or any other document you submit, and provide it to us, such documents including Sensitive Personal Data shall be immediately deleted from our records and we will contact you and request to remove such Sensitive Personal Data from your documents and re-submit your application within Service. Such measures are necessary to ensure that we do not Process your Sensitive Personal Data which is not required for review at the stage of submitting an application via Service. Deletion occurs at the file level, no separate deletion, redaction, or review process is applied to individual data elements, including any Sensitive Personal Data, prior to the scheduled deletion.
3.7.3. However, if you were selected among the preferred candidates for the position you applied for, before making the offer, we will be doing the background check and verification, which will require you to provide us with some of your Sensitive Personal Data or to perform the eligibility verification process. After successful background checks and verification, we will continue with the offer. Please, note that the scope of requested Sensitive Personal Data varies across the jurisdictions and job position. For instance, we may request demographics personal data, including gender, racial or ethnic origin, which is required for government reporting, and/or background checks to make sure that we employ persons who have not been convicted of any crimes, and are trustworthy and responsible, and/or mandatory (pre) occupational medical examination.
4. When and how do we collect your Personal Data?
4.1. We collect your Personal Data directly from you when you:
4.1.1. make an application through the Service or otherwise, adding personal data about yourself either personally or by using a third-party source such as LinkedIn;
4.1.2. use the Service to connect with our staff, adding your Personal Data either personally or by using a third-party source such as LinkedIn;
4.1.3. provide Personal Data in the chat or via email to us, or to our service providers contacting you on our behalf, including via email, SMS or via other communication and messaging platforms/channels and such data is of relevance to the application procedure;
4.1.4. during testing, offsite and/or online (video) interviews for your evaluation on suitability for vacancy made by our recruitment team and hiring managers;
4.1.5. after you are identified as the preferred candidate for a specific role, during reference checks, verification and screening where relevant to the role;
4.1.6. provide additional personal data upon being selected for the role as may be necessary to prepare your employment contract;
4.1.7. provide any data and documents when connecting through our careers site to receive information about current or future employment opportunities.
4.2. We may collect your Personal Data indirectly:
4.2.1. from third parties, such as recruitment agencies, compliance and risk management platforms, your current or former employer, government agencies and background check providers, job boards, Linkedin and through other public sources; this is referred to as “Sourcing” and can be manually performed by our employees or automatically in the Service;
4.2.2. when our existing employee(s) make recommendations about you as a potential applicant and provide us your Personal Data for the recruitment purposes; in the cases where this is made, you are considered as the applicant of Services in the context of this Privacy Notice and you will be informed about the processing.
4.3. We also automatically collect specific technical details during your visits to our careers site. This includes your IP address, browser type and version, operating system, and device details, alongside session data and pages visited. Such data collection is essential for the operation, security, and enhancement of our recruitment Service.
4.4. During the recruitment process, we may also generate Personal Data relating to your application, including interview notes, assessments, communications, recruitment status updates and other records created throughout the recruitment process.
4.5. Where artificial intelligence (“AI”) assisted functionality is enabled, your Personal Data provided directly during any stage of the recruitment process may be processed by such AI-driven solution(s) to assist our recruiters with tasks such as summarising applications, generating interview questions, assisting in communications and supporting candidate evaluations. Please, note that neither of the tools independently selects, ranks, or rejects candidates, every decision to progress or reject an application is made by a human member of our recruitment team.
5. What is the purpose and legal basis for the processing of your personal data?
5.1. We process your Personal Data for the following purposes and on the following legal bases:
5.1.1. Managing and administering the recruitment process, assessing your suitability for current employment opportunities, communicating with you throughout the recruitment process (including personally, via LinkedIn, email, communication and messaging platforms/channels directly or via our service providers) and, where applicable, contacting your referees, conducting interviews and assignments, performing interview recording or taking notes, and preparation of employment contract with successful candidates.
Legal basis: Taking steps at your request prior to entering into an employment contract and, where applicable, our legitimate interests in identifying, assessing and recruiting suitable candidates.
5.1.2. Considering your application with all documents provided by you for future employment opportunities where you have agreed to remain in our talent pool.
Legal basis: Your consent, where required by applicable law.
5.1.3. Conducting background checks, verification and mandatory (pre)-occupation health checks, where required or permitted by applicable law and where necessary for the position applied for.
Legal basis: Compliance with a legal obligation or other applicable legal basis under applicable law permitting the processing of personal data, subject to the safeguards required by such law.
5.1.4. Maintaining, securing, operating and improving the Service and recruitment process, including analysing the performance of our careers site, detecting, investigating and preventing misuse, fraud or other illegal activities.
Legal basis: Legitimate interests where applicable, or legal obligation in ensuring security of recruitment platform and process.
5.1.5. Using third party service providers and AI assisted functionality to support recruitment activities, including involving recruitment agencies, use of Teamtailor AB Platform, summarising applications, assisting with interview preparation, drafting and performing recruitment communications, translating, improving the efficiency and consistency of recruitment processes.
Legal basis: Your consent, or our legitimate interests where applicable in operating an efficient, consistent and secure recruitment process.
5.1.6. Establishing, exercising or defending legal claims, disputes, responding to requests from competent authorities and complying with applicable legal and regulatory obligations, as part of our affiliates’ regular reporting activities, to protect our rights and property, in response to employer accountability and discrimination audits, in connection with an actual or potential merger, sale of company assets, financing, or acquisition of all or part of our business to another company.
Legal basis: Compliance with legal obligations, or our legitimate interests where applicable in protecting our legal rights and interests.
5.2. If we rely on legitimate interests as the legal basis for processing, where it is applicable and permitted as per legal framework, we have carried out a balancing assessment and concluded that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
5.3. We may use non-personal information (which is non-identifiable information that, when taken alone, cannot be used to identify or contact you). As such, we are not aware of the identity of the user from which the non-personal information was collected. For example, statistics of internet traffic or the geological location for the use of the Service. We use such information for different purposes, such as improving the Service, performing web analytics, maintaining the security of the Service and producing aggregated statistical information. We may gather such information either independently or through the assistance of our third-party service providers.
5.4. We do not make recruitment decisions based solely on automated processing. Artificial intelligence assisted functionality is used only to support recruiters in carrying out recruitment activities. All decisions regarding candidates are made or reviewed by appropriately authorised personnel.
5.5. We may collect and use information about you that you have made or is publicly available through social media, websites or other publicly accessible sources as part of our recruitment activities, including for identifying potential candidates, assessing their professional qualification or experience, and further contacting you regarding our employment opportunities.
5.6.Where we rely on your consent as the legal basis for processing, you may withdraw your consent at any time via our Data&Privacy board or by contacting us at privacy@gan.com. Withdrawal of consent will not affect the lawfulness of processing carried out before the consent was withdrawn.
6. Disclosures
6.1. We may share your Personal Data for the purposes set out earlier with the following parties:
6.1.1. Staff of our Human Resource department involved with respect to a particular job role you have applied for or requested to include you in our talent pool, subscribed to current and future vacancies;
6.1.2. our parent or subsidiary companies;
6.1.3. any potential acquirer, successor, or assignee as part of any proposed merger, acquisition, sale of assets, or similar transaction in which information is required to be transferred to one or more third parties as part of such transaction;
6.1.4. our service providers acting as independent controllers, or as processors or sub-processors on our behalf, including, but not limited to recruitment agencies, LinkedIn, providers of recruitment platforms, AI-driven recruitment functionalities service providers, information sourcing companies, communication and messaging platforms/channels, employment verification and background check providers, email, chat or messaging providers, file sharing, data storage, or hosting providers, recruitment assessments, analytics, technical support and other services necessary for the recruitment process;
6.1.5. governmental or semi-governmental authorities, legal advisors, or other third parties as permitted or required by law, or as per your consent.
6.2. These service providers may be located outside of the country where you reside. Our service providers must implement appropriate security measures to protect your Personal Data consistent with our policies, applicable regulations, and information security obligations applicable to us. We do not permit third parties or service providers who process your Personal Data on our behalf to use your Personal Data for their own purposes. We only permit them to process your Personal Data for specified purposes in accordance with our instructions.
7. Your Privacy Rights and Choices. California Residents
7.1. You have certain rights with respect to Personal Data depending on the applicable data protection laws where you live, including any exemptions or exceptions. Please note that some of these rights may be limited where we have a legal obligation to continue processing the Personal Data, or where data may be exempt from disclosure due to reasons of legal professional privilege or professional secrecy requirements. However, generally, you have the right to request:
7.1.1. Access to your Personal Data, and, where technically feasible, to request a copy of your Personal Data and/or to obtain information about how we process or disclose your Personal Data.
7.1.2. Correct your Personal Data that is You inaccurate or incomplete.Although we may need to verify the accuracy of the new data you provide to us.
7.1.3. Delete your Personal Data where there is no good reason for us continuing to process it Please note that we may not be able to delete certain information depending on legal exceptions or obligations. Please see the “Data Security and Retention” section below for more information about why we may retain your Personal Data.
7.1.4. Object to Processing of your Personal Data where the legal ground of such processing is necessary for legitimate interests pursued by us or by a third party. We will then abide by your request unless we can demonstrate compelling legal grounds for the processing.
7.1.5. Restrict the Use and Disclosure of your Personal Data, including your Sensitive Personal Data.
7.1.6. Revoke your prior Consent to the processing of your Personal Data, including sharing your Personal Data with other parties (other than our service providers or other contractually restricted third parties). However, where processing is based on your consent, withdrawal of consent may affect our ability to carry out the specific processing activity for which consent was requested.
7.1.7. Submit an appeal at privacy@gan.com if you are not satisfied with the outcome of your request.
7.1.8. Non-Discrimination. In California, you have the right not to receive discriminatory treatment by us for exercising your rights and choices, this extends to your right not to be retaliated against for the exercise of your privacy rights.
7.1.9. Lodge a Complaint to the local supervisory authority regarding the processing of your Personal Data, if you consider that such processing of Personal Data infringes the legal framework of privacy and data protection laws. If you are in the European Economic Area, Please click here for a list of local data protection authorities in EEA countries.
7.2. Exercising Your Rights. If you would like to exercise any of these rights, please email us at privacy@gan.com .Where available, you may exercise certain privacy rights directly through your Teamtailor candidate profile or the Data&Privacy board available on our careers site. In order to protect your Personal Data, we may ask you to provide additional information to verify your identity. You may also submit a request to exercise your rights through an authorized agent, in which case your agent must present signed written permission to act on your behalf. You may be required to independently verify your identity with us and confirm that you have provided authorization to the agent.
7.3. California Residents
7.3.1. In the preceding 12 months, GAN has collected, used, and disclosed the categories of Personal Data in the below chart to our service providers for specific, limited business purposes, including the purposes listed in the “What is the purpose and legal basis for the processing of your personal data?” section of this Privacy Notice. We do not “sell” or “share” any Personal Data (Personal Information as defined by the CCPA), as indicated below.
7.3.2. Compliance with Section 7027(m). GAN does not use or disclose Sensitive Personal Data for purposes other than those specified in Section 7027(m) of the implementing regulations of the CCPA.
7.3.3. California “Shine the Light” Notice. California law requires us to inform California residents who have provided us with personal data that they may request information from us about our disclosures to third parties for their direct marketing purposes. We do not provide personal data to third parties for their direct marketing purposes.
Categories of Personal Data Collected
Purpose for Collection and Use
Shared or Sold?
Identifiers (name and contact details (for example, your email address, mailing address, phone number and social media handles)).
● Communicating with you
● To evaluate and process your application for employment
● For our business purposes as described in this Privacy Notice
Shared
Inferences (preferences, such as which employment opportunities you are interested in).
● Communicating with you
● For our business purposes as described in this Privacy Notice
N/A
Professional Information (such as your current or previous employer(s), job title, function, and the nature of your duties and responsibilities).
● To evaluate and process your application for employment
N/A
Protected Classification Characteristics (such as age, gender, religion, and disability information, which you may provide to us in connection with an application for employment).
● To evaluate and process your application for employment
N/A
Education information (such as your university transcripts and other information relevant to hiring qualifications).
● To evaluate and process your application for employment
N/A
8. Data Transfers
8.1. GAN brand operates by different affiliated companies within a group of companies in multiple jurisdictions. Your Personal Data may be transferred outside the United States of America or European Economic Area in other countries that may not be subject to data protection laws similar to those in the jurisdiction in which information is provided to or received by us.
8.2. It may be necessary to transfer Personal Data from your home jurisdiction to another country to obtain access to our applicants’ Personal Data to enable our recruitment process, and for other purposes as set out in this Privacy Notice.
8.3. If we transfer Personal Data from within your home jurisdiction to other countries, we implement adequate safeguards to appropriately protect such transfer of Personal Data, including:
8.3.1. ensuring that a valid data transfer agreement has been concluded incorporating the appropriate terms or as permitted under applicable data protection laws;
8.3.2. where applicable - ensuring that the recipient or importer of the Personal Data is located in a country that has an adequate level of data protection, or the European Commission's Standard Contractual Clauses, or participation in recognised international data transfer frameworks, such as the EU-US Data Privacy Framework; or
8.3.3. applying any other lawful transfer mechanism recognised under applicable data protection legislation.
8.4. We do not trade, share, transfer, or disclose any of your Personal Data, except as is otherwise provided in this Privacy Notice or as otherwise required by and in accordance with applicable law. We will only transfer your Personal Data to third parties that we have confidence in. We carefully choose partners to ensure that your Personal Data is processed in accordance with current privacy legislation.
9. Data Security and Retention
9.1. We prioritize personal integrity and therefore work actively so that your Personal Data is processed with utmost care. We take the measures that can be reasonably expected to make sure that your Personal Data is processed safely and in accordance with this Privacy Notice and applicable legislation.
9.2. We are committed to safeguarding the Personal Data you provide to us. We take appropriate levels of security to protect your Personal Data from accidental or unlawful access, use, disclosure, alteration, loss, or destruction. We implement reasonable physical, technical, and organizational safeguards designed to protect your Personal Data against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, we limit access to Personal Data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access.
9.3. While no transmission of information over the internet can be guaranteed to be completely secure, we implement appropriate technical and organisational measures designed to protect Personal Data transmitted to and processed by us. We also encourage candidates not to provide unnecessary sensitive information through unsecured communication channels.
9.4. Except as otherwise permitted or required by applicable law or regulation, we will only retain your Personal Data for as long as necessary to fulfill the purposes for which we collected it, as required to satisfy any legal, accounting, or reporting requirements, or as necessary to resolve disputes. To determine the appropriate retention period for Personal Data, we consider our statutory obligations, the amount, nature, and sensitivity of the Personal Data, the purposes for which we process your Personal Data, and whether we can achieve those purposes through other means.
9.5. If you are offered and accept employment with us, the Personal Data we collected during the application and recruitment process will become part of your employment record, and we may use it in connection with your employment and applicable law..Unless a longer retention period is required or permitted by law or you have requested to remove your Personal Data earlier, or you have requested to extend the retention period for further 18 (eighteen) months, Personal Data relating to unsuccessful applicants will be retained by GAN Software Services BG Ltd. for 3 (three) years and by GAN Nevada, Inc. for 18 (eighteen) months following the conclusion of the relevant recruitment process.
9.6. Personal Data of individuals who connected with us through our careers site to receive information about current or future employment opportunities will be retained for 18 (eighteen) months, unless you have requested to remove your Personal Data earlier, or you have requested to extend the retention period for further 18 (eighteen) months.
9.7. We will contact you via email informing about the possibility to extend your permission for retention of your data upon expiration of 18 (eighteen) months retention period, and if you have not extended such permission within 1 (week) your personal data will be automatically deleted.
10. Services From Other Parties
10.1. Please note that this PrivacyNotice does not apply to the practices of third parties, including our workforce recruitment vendors, like Teamtailor, LinkedIn, recruitment agencies, job boards or other platforms. When you access a third party’s website or services through links on our website, information collected from you by others on those third-party websites, is governed by those entities’ privacy policies. GAN is not responsible for and does not control the security or privacy of your information when you visit those sites or use those services. We encourage you to read the privacy policy of every website you visit.
11. Children’s Information
11.1. We do not recruit or intend to employ or to collect Personal Data from anyone we know to be a child under the age of 16. If we learn that we have unknowingly collected or received Personal Data from a child under 16, we will delete such information from our records. If you believe that we might have any information from or about a child under 16, we ask that a parent or guardian contact us at privacy@gan.com.
12. Cookies
12.1. Our careers site uses cookies and similar technologies to operate the website, improve user experience, analyse website performance and maintain security. When you visit our Website for the first time, we seek your consent to use cookies, with the exception of those strictly necessary for the website’s operation. Further information regarding the cookies used, their purposes and how you can manage your preferences is available in our Cookie Policy.
You can at any time disable the use of cookies by changing the local settings in your devices or via our Data&Privacy board. Disabling cookies can affect your experience of the Service, for example disabling some functions in the Service.
13. Changes to this Privacy Notice
13.1. Please review the Effective Date at the top of this page to determine when this Privacy Notice was last revised.13.2. From time to time, we may modify this Privacy Notice. If we update this Privacy Notice, we will notify you by posting a new Privacy Notice on this page. If we make any material changes to this Privacy Notice, we will notify you as required by law, which may include by email to the email address you provided to us, if available. We encourage you periodically to check this page for updates.
14. Contact Us
14.1. If you have any questions about this Privacy Notice or need to access this Privacy Notice in an alternative format due to disability, or if you have any questions about our practices with respect to your Personal Data or would like to make an access or other request, please contact our Data Protection Officer (DPO) at privacy@gan.com .
Version 2.0.
