Job Applicant Privacy Notice
This Privacy Notice describes how Lemonsoft Oyj processes the personal data of job applicants. When applying for a position at Lemonsoft, you may apply for a specific vacancy or submit an open application. The information you provide in your application and during the
recruitment process forms a personal data register maintained by Lemonsoft.
1. Controller
Lemonsoft Oyj
Business ID: 2017863-1
Vaasanpuistikko 20 A
FI-65100 Vaasa
Finland
2. Contact Person for Privacy Matters
Lemonsoft Oyj
Data Protection Officer
Jaakko Suninen
Keskikatu 11 B
FI-45100 Kouvola
Finland
jaakko.suninen@lemonsoft.fi
3. Name of the Register
Job Applicant Register
4. Purpose and Legal Basis for Processing
The purpose of the register is to manage and maintain job applications. Personal data contained in the register is processed for the purposes of:
• managing recruitment processes;
• arranging interviews;
• communicating with applicants; and
• assessing applicants for employment opportunities.
The legal basis for processing personal data is the Controller's legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR).
Lemonsoft has carried out a Legitimate Interest Assessment (LIA) and concluded that its legitimate interest provides a lawful basis for the processing of applicants' personal data.
5. Processors
Personal data is processed by Lemonsoft's HR personnel and other employees involved in recruitment. Lemonsoft also uses Teamtailor, an external recruitment platform, to manage recruitment processes. Teamtailor acts as a Processor on behalf of Lemonsoft. Artificial
intelligence features within Teamtailor are used to generate summaries during the recruitment
process.
Teamtailor's Privacy Notice is available at:
Privacy Notice | Teamtailor
6. Categories of Personal Data
Only personal data that is necessary for assessing an applicant's suitability for the position applied for is collected during the recruitment process.
If an applicant submits an open application, additional information voluntarily provided by the
applicant may also be processed.
The register may contain the following personal data:
Mandatory information
• first and last name
• telephone number
• email address
• curriculum vitae (CV)
Optional information
• date of birth
• home address, postal code and city
• photograph
• education, language skills, work experience and other professional qualifications
• driving licence and access to a vehicle
• references
• applicant preferences
• salary expectations
• other information voluntarily provided by the applicant
• aptitude assessments and other recruitment evaluations
7. Retention Period of Personal Data
Personal data relating to job applicants is retained for a maximum of one (1) year after the recruitment process has ended. Outdated or unnecessary personal data is securely deleted. Personal data processed on the basis of the Controller's legitimate interest may be deleted upon the applicant's request after the recruitment process has concluded and once all rights
and obligations of both the applicant and the Controller have been fulfilled. Prior to deletion, the data may be marked as archived or inactive. Where personal data has been anonymised so that it can no longer be linked to an identifiable individual, it is no longer subject to deletion requirements.
8. Sources of Personal Data
Personal data is collected primarily from the job application submitted by the applicant, as well as from educational certificates, employment certificates, other supporting documentation, and information provided by the applicant during interviews. Personal data
may also be received through recruitment agencies or the Finnish Employment Services (TE Services), provided that the information was originally supplied by the applicant.
9. Regular Disclosure of Personal Data
Personal data may be disclosed to companies within the Lemonsoft Group for the purposes described in Section 4 of this Privacy Notice and, where necessary, to other personnel registers maintained within the Group. Personal data will not be disclosed to third parties for
marketing purposes or for any other purposes unless disclosure is required by applicable law or by a competent authority. Any disclosure of personal data is carried out in accordance with applicable data protection legislation.
10. Transfers of Personal Data Outside the EU/EEA
Lemonsoft Oyj does not transfer personal data outside the European Union (EU) or the European Economic Area (EEA).
11. Principles of Data Protection
Lemonsoft respects the confidentiality of personal data. Personal data is classified and processed as Confidential.
Lemonsoft maintains an information security management system certified in accordance with ISO/IEC 27001, ensuring that appropriate technical and organisational measures are in
place to protect personal data.
12. Profiling
Personal data is used to create a competence profile of the applicant in order to assess suitability for the recruitment process.
13. Right to Object to Processing
Where personal data is processed on the basis of the Controller's legitimate interest, the data subject has the right to object, on grounds relating to his or her particular situation, to the processing of personal data, including profiling. Any objection should be submitted in accordance with the contact details provided in Section 15 of this Privacy Notice.
When submitting an objection, the data subject should specify the particular circumstances on which the objection is based. The Controller may refuse to comply with the request, where
permitted by applicable law.
Personal data contained in the Job Applicant Register is not used for direct marketing.
14. Data Subject Rights
14.1 Right of Access
The data subject has the right to obtain confirmation as to whether personal data concerning them is being processed and, where that is the case, to access the personal data held in the Job Applicant Register.
Requests for access should be submitted in accordance with the contact details provided in Section 15 of this Privacy Notice.
The right of access may be restricted where permitted by applicable law. As a general rule, exercising the right of access once per calendar year is free of charge.
14.2 Right to Rectification, Erasure and Restriction of Processing
The data subject has the right to request the rectification of inaccurate personal data, the erasure of personal data, or the restriction of processing.
Requests should be submitted in accordance with the contact details provided in Section 15 of this Privacy Notice.
The data subject also has the right to request that the Controller restrict the processing of personal data, for example while a request for rectification or erasure is being considered.
14.3 Right to Data Portability
Where personal data has been provided by the data subject and is processed on the basis of the data subject's consent or for the performance of a contract, the data subject has the right to receive such personal data in a structured, commonly used and machine-readable format
and, where technically feasible, to transmit that data to another controller.
14.4 Right to Lodge a Complaint with a Supervisory Authority
The data subject has the right to lodge a complaint with the competent supervisory authority if they believe that the processing of their personal data does not comply with applicable data
protection legislation.
14.5 Other Rights
Where the processing of personal data is based on the data subject's consent, the data subject has the right to withdraw that consent at any time by contacting the Controller in accordance with Section 15 of this Privacy Notice.
15. Contact Details
For all questions relating to the processing of personal data or the exercise of data subject rights, the data subject should contact the person identified in Section 2 of this Privacy Notice.
Where necessary, the Controller or the contact person may request additional information in writing to clarify the request and may verify the identity of the requester before taking further
action.
16. Changes to this Privacy Notice
This Privacy Notice may be updated from time to time if the purposes or methods of
processing personal data change or if changes in applicable legislation otherwise require an update.
Data subjects are encouraged to review this Privacy Notice periodically to remain informed about how their personal data is processed.
17. Revision History
10 February 2026
• Section 4: Added the legal basis for the processing of personal data.
• Section 5: Added a new section describing the processors of personal data.
• Section 6: Added a distinction between mandatory and optional categories of personal
data.
• Section 11: Simplified the description of the technical and organisational security
measures and added a reference to Lemonsoft's information security management
system certified in accordance with ISO/IEC 27001.