Below, we would like to inform you in accordance with Articles 13, 14, and 21 of the General Data Protection Regulation (GDPR) about how your data is processed during the application process.

1. Controller and Contact

If you apply for an open position at lemon.markets GmbH ("LMH") or lemon.markets brokerage GmbH ("LMB"), the controller for the processing of personal data under Article 4(7) GDPR is lemon.markets GmbH (LMH), located at Kottbusser Damm 79, 10967 Berlin, Germany.

If you have questions about data protection, you can contact datenschutz@lemon.markets.
Our data protection officer can also be reached at this email address or via the postal address above.
Please note that the content of your communication is not handled exclusively by the data protection officer.
If you wish to communicate directly and only with our data protection officer, please contact us first via the email address provided.

2. Data Processing and Sources

We process personal data that we receive from you in the course of the recruitment process.
This data originates from the documents you have provided (cover letter, passport photo, CV, certificates) and the video and voice recordings as part of application interviews.

3. Purpose and Legal Basis

We process your data for the following purposes:

• Recruitment process (for advertised positions or unsolicited applications);
• Verification of data and information;
• Reliability checks;
• Defense against claims for damages and recourse;
• Proof of proper data processing
• Enhancing assessment quality and consistency through video and voice recordings to efficiently handle high application volumes and ensure timely, consistent evaluations (with your consent).
  
  

All application data is collected and processed in order to select the most suitable applicant for the advertised position.
You determine which data we process, since you choose what to submit.

Your application may be shared with employees of the relevant department as part of the recruitment process, and notes may be created to support the selection and assessment of candidates.
The legal basis is Section 26(1) BDSG (Federal Data Protection Act) in conjunction with Article 6(1)(b) and Article 88 GDPR.

If you have provided consent, we also process your data to include you in our talent pool.
The legal basis is Section 26(2) BDSG in conjunction with Article 6(1)(a) and Article 88 GDPR.

If an employment relationship results, we may continue processing your data for employment purposes (to initiate, execute, or terminate the employment relationship).
The legal basis is Section 26 BDSG in conjunction with Article 6(1)(b) and Article 88 GDPR.

We process special categories of personal data (e.g. health, religious beliefs) only if you have voluntarily provided them so that we can consider your application in its present form, or if there is a legal obligation.
Such data will not be considered in the recruitment process unless required by law.
The legal basis is Article 9(2)(b), (e) GDPR.

Processing of video and voice recordings in the recruitment process is based solely on your consent under Article 6(1)(a) GDPR. Consent is collected and logged prior to any recording via our recruiting tool Ashby (processor under Article 28 GDPR).”

Where necessary, personal data may also be processed and retained to assert, exercise, or defend legal claims.
The legal basis is our legitimate interest under Article 6(1)(f) GDPR.
You may exercise your right to object under Article 21 GDPR by contacting us via email.

3.1 Data Processing

3.1.1 Application Process

The personal data we process may include:
basic data (name, address, phone number, email), CV, qualification certificates (e.g. diplomas, performance reviews, enrollment certificates for working students, other educational records), proof of work permit (including nationality), references, ID documents, interview content, internal interview notes, criminal record certificate, cover letter, desired start date, LinkedIn profile, and, if applicable, your feedback on our recruitment process.

3.2.1 Employment Screenings and Criminal Record Check

LMH requires a criminal record certificate from all employees and may conduct checks against international sanctions lists.
Depending on the role, LMH may also carry out employment screenings as required by applicable laws or regulations.
These checks apply only to employees in strategically relevant positions with access to certain data.
Background checks are generally carried out after you have signed your employment contract.
The legal basis is Article 6(1)(c) GDPR.

4. Recipients of Personal Data

4.1 LMB / LMH

LMH also manages the recruitment process for LMB.
If you apply for a position at LMB, your personal data will be shared with LMH.
LMB is a wholly owned subsidiary of LMH.
This allows LMB employees (e.g. your potential supervisor) to review your application and participate in the recruitment process.

4.2 Recruiting Tool

For handling applications, LMH uses the services of Ashby, Inc., 49 Geary Street, Suite 411, San Francisco, CA 94108, USA ("Ashby").
We have concluded a data processing agreement with Ashby in accordance with Article 28(3) GDPR. Where consent has been granted, video and voice recordings may be processed via Ashby.
More information: https://www.ashbyhq.com/resources/gdpr#data-processing-agreement.

4.3 Google Calendar

LMH uses Google Cloud EMEA Ltd., 70 Sir John Rogerson's Quay, Dublin 2, Ireland ("Google") to schedule online meetings with you.
We have also concluded a data processing agreement with Google in accordance with Article 28(3) GDPR.
More information: https://cloud.google.com/terms/data-processing-addendum

5. Data Retention and Deletion

Data will be deleted or blocked once the purpose for which it was stored no longer applies.
Storage may continue if required by EU or national law.
Data will also be deleted once the legally mandated retention period expires, unless further storage is necessary (e.g. for contract conclusion, fulfillment, or documentation obligations).

Video and voice recordings are retained only for as long as necessary for the recruitment process and will be deleted at the latest upon expiry of 2 weeks retention period or upon withdrawal of your consent.

Application data is stored for no longer than 6 months after rejection for the purpose of completing the recruitment process.
Further retention may occur with your consent or for the defense of legal claims.
If you have consented, your data will be kept in our talent pool for 6 months.

6. Transfer to Third Countries or International Organizations

Where LMH transfers data outside the European Economic Area, one or more of the following mechanisms are applied, along with any additional safeguards required by the respective transfer impact assessment:

• Adequacy decision of the European Commission (Article 45(1) GDPR), or
• Standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).

For further information, contact datenschutz@lemon.markets.

7. Your Data Protection Rights

You have the following rights under the GDPR:

• Right of access (Art. 15 GDPR): You can request information about how your data is processed.
• Right to rectification (Art. 16 GDPR): You can have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17 GDPR): You may request deletion of your data under certain conditions.
• Right to restriction of processing (Art. 18 GDPR): You may request processing to be limited under certain circumstances.
• Right to data portability (Art. 20 GDPR): You can request to receive your data in a structured, commonly used format.
• Right to object (Art. 21 GDPR): You may object to processing, unless compelling legitimate grounds override your interests.
• Right to withdraw consent (Art.7 GDPR): You may withdraw your consent at any time with effect for the future (Article 7(3) GDPR), for example by emailing datenschutz@lemon.markets. The lawfulness of processing carried out prior to withdrawal remains unaffected.

You also have the right to lodge a complaint with our data protection officer or with a supervisory authority (Art. 77 GDPR).

8. Automated Individual Decision-Making

Our decisions in the recruitment process are not based on automated processing as defined in Article 22 GDPR.

9. Profiling

Your data is not used for profiling.
Profiling means any automated processing of personal data to analyze or predict personal aspects.

10. Technical and Organizational Measures

We use technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access.

Video and voice recordings are transmitted and stored in encrypted form to protect against unauthorized access. When data is collected and processed, it is transmitted in encrypted form to prevent misuse by third parties.

11. Updates and Amendments

We will update this privacy notice regularly to ensure it reflects current legal requirements and actual practices (e.g. when new service providers are engaged).
We recommend reviewing this privacy notice periodically for any changes.