In the following document, we would like to inform you about the processing of your data as part of the application process in accordance with Articles 13, 14, and 21 of the General Data Protection Regulation (GDPR).

1 Controller and Contact
If you apply for a vacant position at lemon.markets GmbH ("LMH") or lemon.markets brokerage GmbH ("LMB"), the controller for the processing of personal data pursuant to Art. 4 No. 7 GDPR is lemon.markets GmbH ("LMH"). LMH has its registered office at Kottbusser Damm 79, 10967 Berlin, Germany. 

If you have any questions about data protection, please contact our Data Protection Officer at the e-mail address datenschutz@lemon.markets or at the above provided postal address. The content of your communication will not be processed exclusively by our Data Protection Officer. If you would like to communicate exclusively with our Data Protection Officer, please first contact us directly via the e-mail address provided.

2 Data Processing and Sources
We process personal data that we receive from you as part of the recruitment process. This data comes from the files and documents you send us (contact details, cover letter, passport photo, CV, references).

3 Purpose and Legal Basis
We process your data for the following purposes:

• Recruiting process (for advertised positions as well as for unsolicited applications);
• Verification of data and information;
• Reliability check;
• Defense against claims for damages and recourse;
• Proof of proper data processing;

All personal data from your application will be collected and processed in order for us to select the most suitable applicant for the advertised position. As you initiate the personal data transfer yourself, you determine the personal data provided to us. During the recruitment process, the application is also forwarded to employees of the respective department and notes are taken to support the selection and assessment of applicants.

The legal basis for this is Section 26(1) BDSG (new version) in conjunction with Art. 6(1)(b), Art. 88 GDPR.

If the relevant consent has been obtained, we will also process your personal data in order to include you in our talent pool. The legal basis here is Section 26 (2) BDSG (new version) in conjunction with Art. 6 (1) (a), Art. 88 GDPR.

In the event that an employment relationship is established between you and us, we may further process the personal data transmitted. The processing is then carried out to implement or terminate the employment relationship.

The legal basis is § 26 BDSG n.F. in conjunction with Art. 6 para. 1 lit. b), Art. 88 GDPR.

LMH will only process special categories of personal data if you have provided it to us so that we can consider your application in its present form or if there is a legal obligation to do so. This information will not be taken into account during the recruitment process unless there is a legal obligation to do so. The legal basis is Art. 9 para. 2 lit. b), e) GDPR.

If necessary, personal data will be processed and stored for the defense, exercise of claims, and defense against recourse claims. The legal basis is the legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. To exercise your right to object in accordance with Art. 21 GDPR, you can contact us via email.

3.1 Data Processing
3.1.1 Application Process
Relevant personal data that we process may include, in particular, master data (name, address, telephone number, e-mail address), a CV, proof of qualifications (e.g. certificates, assessments, certificates of enrollment for working students and other proof of training), the existence of a work permit (including nationality), references, identification documents, contents of job interviews, internal notes on job interviews, a certificate of good conduct, a cover letter, the date of entry, your Linkedin profile and, if applicable, your feedback on our application process.

3.2.1 Employee Screenings and Criminal Record Certificate
LMH requires all employees to have a police clearance certificate and may carry out a check against international sanctions lists. In addition, LMH conducts employee screenings as required by applicable laws or regulations, depending on the position. These checks only apply to employees in strategically relevant positions with access rights to certain personal data. These background checks are usually carried out after you have signed an employment contract. The legal basis is Art. 6 para. 1 lit. c GDPR.

4 Recipients of Personal Data
4.1 LMB /LMH
LMH also carries out the recruitment process for LMB. If you apply for a vacant position at LMB, your personal data will be passed on to LMH by LMB. LMB is a wholly-owned subsidiary of LMH. The transfer of personal data allows LMB employees (e.g. your manager/lead) to review your application and carry out the recruitment process.

4.2 Recruiting tool 
LMH uses the services of Ashby, Inc, (49 Geary Street, Suite 411, San Francisco, CA, 94108, United States), ("Ashby") to process your application. We have concluded an order processing contract with Ashby in accordance with Art. 28 para. 3 GDPR. 

You can find further information at:

https://www.ashbyhq.com/resources/gdpr#data-processing-agreement.

4.3 Google Calendar
LMH uses the services of Google Cloud EMEA Ltd (70 Sir John Rogerson's Quay, Dublin 2, Dublin, Ireland) ("Google") to arrange online meetings with you. We have concluded an order processing contract with Google in accordance with Art. 28 para. 3 GDPR. 

You can find further information at:

https://cloud.google.com/terms/data-processing-addendum.

5 Data Retention and Deletion
Talent Pool
The personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if determined by European or national legislators in EU regulations, laws, or other provisions. Blocking or deletion also takes place when a storage period prescribed by the relevant standards expires, unless there is a need for further storage of the personal data for the conclusion of a contract, fulfillment of a contract, or a documentation obligation.

We do not store application data for longer than a maximum of 6 months after rejection. Personal data may be stored beyond this period on the basis of consent or for the purpose of defending against claims. In the event of consent, your personal data will be stored in our talent pool for 6 months as part of the application process.

6 Transfer to a Third Country or an International Organization
When LMH transfers personal data to entities outside the European Economic Area, LMH has implemented one or more of the following transfer mechanisms, in addition to the safeguards set up in the respective impact assessment for international data transfers, if applicable:

• An adequacy decision of the European Commission pursuant to Art. 45 (1) GDPR;
• Standard data protection clauses, as adopted by the European Commission pursuant to Art. 46 para. 2 lit.c GDPR. 

Further information on this is available upon request via: datenschutz@lemon.markets

7 Your Data Protection Rights
In the following, we would also like to inform you about your rights under the GDPR.

• Right to information in accordance with Art. 15 GDPR
  You can request information from the controller about the processing of your personal data.
• Rectification of the data
  You have the right to rectify personal data following Art. 16 GDPR if the personal data concerning you is incorrect or incomplete.
• Right to erasure
  You have the right of erasure if the requirements of Art. 17 GDPR are met and there are no reasons that make processing necessary.
• Right to restriction
  You have the right to restrict processing in accordance with the requirements of Art. 18 GDPR, provided that the processing does not serve to assert, exercise, or defend legal claims.
• Right to data portability
  Under the conditions of Art. 20 GDPR, you have the right to data portability.
• Right to object
  You have the right to object in accordance with Art. 21 GDPR, unless there are demonstrably compelling legitimate grounds for the processing or the processing serves the establishment, exercise, or defense of legal claims.
  You also have the option of lodging a complaint with the above-mentioned Data Protection Officer or the Supervisory Authority. In accordance with Art. 77 GDPR, you have the right to lodge a complaint with the competent supervisory authority.
  

8 Automated Individual Decision Making
Our decision-making in the application process is not based on automated processing in accordance with Article 22 GDPR. 

9 Profiling
Your personal data will not be used for profiling. Profiling is any form of automated processing of personal data consisting of the use of personal data to analyze or predict certain personal aspects.

10 Technical and Organizational Measures
We use technical and organizational measures to protect the personal data you provide against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. In the event of the collection and processing of your personal data, the information is transmitted in encrypted form to prevent misuse of the personal data by third parties.

11 Updates and Changes
We will update this document from time to time to ensure compliance with current legal requirements and current events (e.g. when new service providers are used by us). We recommend that you check this document regularly for possible changes.