Lemongrass Global Applicant Privacy Notice

Published: 3 May 2026

1 Harmonized Core Notice (Applicants)

1.1 Introduction, Scope, and Who We Are

This Privacy Notice (“Notice” or “Core Notice”) is provided to all job applicants (“applicants,” “you,” or “your”) of Lemongrass (the “Company”). It explains how we collect, use, share, and protect your Personal Information during our recruitment process.

This Notice is supplemented by jurisdiction-specific addenda (“Addenda”) for certain states and countries. You must read the Addendum applicable to the location of the role in which you are applying.

Data Controller: For the purposes of data protection law (where applicable), your “Data Controller” (the entity legally responsible for your Personal Information) is the Lemongrass legal entity to which you are applying. For certain global recruitment processes, this local entity may be a “Joint Controller” with one or more of our other legal entities, collectively known as the Lemongrass group of companies and all subsidiary to Lemongrass Holdings Inc (a US entity). Our Human Resources (HR) department is responsible for the content and administration of this Notice, and you may contact them at HR@lemongrasscloud.com.

Data Protection Officer: We have appointed a Global Data Protection Officer (DPO) and, where required by law, local DPOs, Information Officers, or representatives to oversee compliance with this Notice. If you have any questions relating to the data protection laws, please contact the DPO at DPO@lemongrasscloud.com.

1.2 The Personal Information We Collect

We collect and process various categories of Personal Information about you as part of the application and recruitment process. This includes:

• Identifiers: Such as your full legal name, alias, postal address, email addresses, phone numbers, signatures, and government-issued identifiers (e.g., Social Security Number, ID Number, BSN, Passport number, visa details, or driver’s license number, where permitted by law).
• Professional & Recruitment Information: Such as your CV or resume, cover letter, work history, educational details, qualifications, references, information collected during interviews (including notes), and results of any pre-employment assessments.
• Financial Information: Such as your bank account details (for interview expense reimbursement).
• Electronic & Usage Data: Such as information from your use of our application portal. This may include login credentials, IP addresses, and device identifiers.
• Sensitive Personal Information: See Section 4 below for details on this specific category.

1.3 How and Why We Use Your Personal Information (Purposes and Legal Bases)

We only process your Personal Information for specific, explicit, and legitimate recruitment-related purposes. For applicants in jurisdictions like the UK, Germany, and the Netherlands, the law requires us to state our “legal basis” for each processing activity.

Our primary legal bases are:

• To Take Steps Prior to Entering a Contract with you (e.g., processing that which is necessary to evaluate your application and, if successful, preparing an offer of employment or services).
• To comply with a Legal Obligation (e.g., verifying your legal right to work).
• For our Legitimate Interests (e.g., processing for business needs related to recruitment e.g., assessing suitability and managing our applicant pool), provided they do not override your fundamental rights.

Purpose of Processing	Legal Basis (in GDPR jurisdictions)
Managing your application, including assessing your skills, qualifications, and suitability for the role.	Legitimate Interest (to assess candidates); Necessary to take steps prior to entering a contract.
Conducting interviews and assessments.	Legitimate Interest (to assess candidates); Necessary to take steps prior to entering a contract.
Conducting background checks (e.g., criminal, credit), where legally permitted and relevant to the role.	Legitimate Interest (to verify suitability); Legal Obligation (where required for certain roles).
Communicating with you about the recruitment process.	Legitimate Interest (to manage recruitment).
Verifying your identity and legal right to work in the country of application.	Legal Obligation; Necessary to take steps prior to entering a contract.
Reimbursing you for any agreed-upon interview expenses.	Necessary to take steps prior to entering a contract.
Defending legal claims (e.g., in case of a discrimination claim).	Legitimate Interest (to defend our legal rights).
If you are successful, managing your onboarding and creating your personnel record.	Necessary to take steps prior to entering a contract.

1.4 Processing Sensitive Personal Information

In limited circumstances, and only when permitted by law, we may need to process “Sensitive Personal Information” during recruitment. This includes:

• Information about your health or disability (e.g., to provide reasonable accommodations for your interview or assessment).
• Information about your race or ethnic origin (e.g., for equal opportunity and diversity monitoring, where required by law).
• Information about your trade union membership (e.g., for managing dues deductions or collective bargaining agreements).
• Information about criminal convictions and offenses (e.g., for background checks, where legally permitted and necessary for your role).

We only process this highly sensitive data when we have a specific and lawful justification, such as:

• To comply with our employment and social security law obligations (e.g., providing reasonable adjustments for a disability).
• Where it is necessary for reasons of substantial public interest (e.g., equal opportunity monitoring).
• Where required by local law (e.g., in South Africa or Turkey), with your explicit, granular consent.

1.5 Use of Automated Decision-Making (ADM)

Data protection laws in some jurisdictions may give you the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects on you.

We may use automated tools (e.g., in our Applicant Tracking System) to help filter applications based on objective, pre-defined criteria (e.g., required qualifications). However, Lemongrass does not use fully automated decision-making for any significant recruitment decisions (e.g., rejecting an application or making an offer). All final, significant decisions involve meaningful human intervention.

Note for German and Dutch Applicants: In Germany and the Netherlands, the implementation of any such applicant management systems is subject to the co-determination rights of the applicable Works Council (Betriebsrat / Onderningsraad). Please see the Jurisdictional Addenda.

1.6 Sharing Your Personal Information

Access to your Personal Information is restricted internally on a “need-to-know” basis to personnel in HR, IT, Finance, and the hiring team of the role in which you are applying.

We may also share your Personal Information with the following categories of external third parties:

• Other Lemongrass Group Companies: For global HR recruitment administration (e.g., if your interviewer is in another country).
• Third-Party Service Providers: Vendors who process data on our behalf, such as providers for our Applicant Tracking System, pre-employment assessment services, and background check services.
• Legal and Regulatory Bodies: Government agencies, tax authorities, social security administrations, and law enforcement, where required to do so by law.

1.7 International Data Transfers

As a global company, your Personal Information will be transferred, stored, and processed in countries outside of your home jurisdiction, including at our headquarters in the United States and in other countries where our group companies or service providers are located.

We have implemented a comprehensive Intra-Group Data Transfer Agreement (IGDTA) which incorporates Standard Contractual Clauses (SCCs) (or equivalent model contracts) approved by local regulators (e.g., in the EU/UK, South Africa, and Turkey). This agreement ensures that any transfer of your data between Lemongrass legal entities is protected to a high, consistent standard. We use similar safeguards for transfers to third-party service providers.

1.8 Data Retention

We will only retain your Personal Information for as long as is necessary to fulfill the purposes for which we collected it.

• If your application is successful, the Personal Information collected during the recruitment process will be transferred to your personnel file and will be retained in accordance with our Employee & Contractor Privacy Notice (which will be provided to you upon onboarding).
• If your application is unsuccessful, we will retain your data for a limited period after the recruitment process has concluded. This is necessary to comply with our legal obligations (e.g., to defend against any potential legal claims, such as for discrimination). For example, in Germany, applicant data is generally held for a maximum of six (6) months following a rejection decision.

1.9 Your Data Protection Rights

Subject to the laws in your jurisdiction, you may have the following rights regarding your Personal Information:

• Right to Access: The right to request copies of the Personal Information we hold about you.
• Right to Rectification: The right to request that we correct any information you believe is inaccurate.
• Right to Erasure (Right to be Forgotten): The right to request that we erase your Personal Information, under certain conditions.
• Right to Restrict Processing: The right to request that we limit the use of your Personal Information, under certain conditions.
• Right to Object: The right to object to our processing of your data, particularly where we rely on “Legitimate Interest.”
• Right to Data Portability: The right to request that we transfer the data we have collected about you to another organization, or directly to you, under certain conditions.

These rights are not absolute and may be subject to legal limitations. Specific rights applicable to your jurisdiction are detailed in the Jurisdictional Addenda.

1.10 Contact and Complaints

To exercise any of your rights, or if you have any questions or concerns, please first contact the HR team at HR@lemongrasscloud.com. If you have questions or concerns about the data protection laws, please contact our Global DPO at DPO@lemongrasscloud.com.

You also have the right to lodge a complaint with your local Data Protection Authority (also known as a “Supervisory Authority” or “Information Regulator”).

2 Mandatory Jurisdictional Addenda (Applicants)

2.1 ADDENDUM FOR AUSTRALIAN APPLICANTS

This Addendum applies to all job applicants in Australia and supplements the Lemongrass Core Applicant Privacy Notice.

The Australian Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (APPs) apply to the collection and handling of your Personal Information as a job applicant. (Note: A legal provision known as the “employee records exemption” does not apply to you as an applicant).

• APP 1 (Openness): This Notice serves as our APP Privacy Policy. Our Privacy Officer’s contact is DPO@lemongrasscloud.com.
• APP 5 (Notice of Collection): We collect your Personal Information (e.g., resume, references) to assess your suitability for engagement. If you do not provide this information, we will be unable to process your application. We collect this information directly from you and from third parties (e.g., recruiters, your listed references).
• Overseas Disclosures (APP 1.4(f)): As stated in Section 7 of the Core Notice, your Personal Information is likely to be disclosed to overseas recipients within the Lemongrass group or to our service providers, located in countries such as the United States, United Kingdom and India.
• Complaints: You may lodge a complaint about a breach of the APPs with our Privacy Officer. If you are not satisfied, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

2.2 ADDENDUM FOR US (CALIFORNIA) APPLICANTS

This Addendum supplements the Core Notice and provides information required under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). This serves as your “Notice at Collection.”

1 Notice at Collection: We collect the categories of Personal Information (PI) and Sensitive Personal Information (SPI) listed in Sections 2 and 4 of the Core Notice. As defined by the CCPA, these categories include:

CCPA Personal Information Categories that We Collect:

• Identifiers (e.g., real name, alias, SSN, postal address, email).
• Personal Information (Cal. Civ. Code § 1798.80(e)) (e.g., name, signature, SSN, phone number, financial information).
• Characteristics of Protected Classifications (e.g., race, national origin, citizenship, religion, gender, disability, age, sexual orientation, veteran or military status).
• Internet or Other Electronic Network Activity Information (e.g., from your use of our application portal).
• Audio, Electronic and Visual Information (e.g., recordings of meetings (e.g., Zoom/Teams) where you are present, and your profile photograph on Company systems.
• Professional or Employment-Related Information (e.g., CV, resume and work history).
• Sensitive Personal Information (including SSN, driver’s license, passport number; financial account details; race/ethnic origin; health information; trade union membership).

CCPA Categories of Sensitive Personal Information that We Collect:

• Government Identifiers (e.g., SSN, drivers’ license number, passport number)
• Racial or ethnic origin
• Health information (including job restrictions and workplace illness or injury information)

2 Retention Periods

• In general, we retain applicant records (which may include identifiers, characteristics of protected classifications, professional or employment-related information, and categories of sensitive personal information such as government identifiers, account access credentials, racial or ethnic origin, union membership) for at least four (4) years. However, records may be retained for a longer period of time if necessary to comply with our legal, accounting, or reporting obligations (e.g., tax, payroll, and employment law requirements), if records are needed to respond to or defend against any legal claims or disputes; and/or in order to fulfill any requests for references.
• With respect to the sensory data that we collect (voice mails), it is not possible to state how long the Company will retain voice mails. All voice mails left for our employees will be retained according to the same duration rules as applicant records.

In addition to the uses of personal information noted in the Core Notice, we may use the personal information we collect for the following purposes:

• Meeting the Company’s operational objectives in providing services to its customers.
• Undertaking activities to verify or maintain the quality or safety of a service that is owned, manufactured, manufactured for, or controlled by the Company and to improve, upgrade, or enhance the service that is owned manufactured, manufactured for, or controlled by the Company.
• Evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer in which PI held by Company is among the assets transferred.
• Exercising legal rights or defending against claims.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

In the employment context, we do not sell your personal information to third parties, and we do not share your personal information with third parties for cross-context behavioural advertising purposes.

3 Sources of Personal Information

We obtain the categories of personal information and sensitive personal information listed above from the following categories of sources:

• Directly from you. For example, from forms and applications you complete, communications you send, work you perform, documents and other material you store on Company computer devices or electronic storage locations, and/or your other interactions with our Company.
• Indirectly from you. For example, from observing your actions on system logs that monitor employee access to the Company’s physical locations (via a badge or keycard) or to the Company’s computer systems.
• From recruiters and others who refer job candidates to us for hiring purposes.
• From persons you identify as references and from other persons you identify as emergency contacts or family members.
• From consumer reports, credit histories, and/or background checks that are conducted in connection with our recruitment and hiring process.
• From people who interview or otherwise evaluate you in connection with our hiring process.
• From your supervisors and co-workers in connection with evaluating you as an employee or independent contractor.
• From our service providers (such as staffing partners, HR management providers, drug testing providers, payroll providers, insurance companies, internet service providers, data analytics providers, and operating systems platforms)
• From customers or business contacts of the Company who have interacted with you in the course of your employment with the Company.
• From email communications or other messaging with Company employees.
• From documents and electronic records stored by Company employees on the Company’s computer systems, servers, or cloud storage locations.

4 Disclosures of Personal Information

We may disclose your PI to a third party for a business purpose. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the PI confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, with respect to Identifiers and Protected Classification Characteristics, we have disclosed PI for a business purpose to the following categories of third parties: provision of payroll and benefits services, government agencies, employee survey services, event notifications and other notices by email or mail, gifts and shipping services, computer forensics services, production in connection with legal proceedings or in response to a subpoena. None of the other PI categories that we collect have been disclosed to a third party in the last twelve (12) months.

5 Your California Privacy Rights: You have the following rights:

Right to Know and Data Portability: You have the right to request details about the PI we have collected. You may exercise your right to know twice in any 12-month period. Once we receive your request and confirm your identity, we will disclose to you:

• Categories of personal information collected about you.
• Categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties to which that personal information was disclosed. If we sold or disclosed your personal information for a business purpose, two separate lists disclosing (a) sales, identifying the PI categories that each category of recipient purchased; and (b) disclosures for a business purpose, identifying the PI categories that each category of recipient obtained.
• The specific pieces of PI that we collected about you (also called a data portability request). When your right to know submission includes a data portability request, a copy of your personal information subject to any permitted redactions.

Right to Request Deletion: You have the right to request the deletion of your PI, subject to exceptions. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the personal information, provide something that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another person to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with employee expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Right to Request Correction: You have the right to request the correction of inaccurate PI. Once we receive your request and confirm your identity, we will use commercially reasonable efforts to correct the inaccurate personal information as directed by you, pursuant to the requirements of the CCPA.

Right to Non-Discrimination: You have the right not to be retaliated against for exercising your rights.

Right to Opt-Out of Sale/Sharing: Lemongrass does not “sell” or “share” the Personal Information of its personnel.

6 Sensitive Personal Information (SPI) Use and Disclosure Purposes: We may use or disclose SPI for the following statutorily approved reasons (Permitted SPI Purposes):

• Performing actions that are necessary for our employment relationship and that an average employee in an employment relationship with us would reasonably expect (including for all of the purposes listed above).
• Lemongrass does not use or disclose your SPI for purposes other than those specified in the CPRA regulations (Cal. Code Regs. tit. 11, § 7027(m) (the Permitted SPI Purposes).

7 Exercising Your Rights

To exercise the right to know (including data portability) or to request deletion or correction, delete, please submit a verifiable request to HR@lemongrasscloud.com or call 800-975-9906.

Please describe your request with sufficient detail so we can properly understand, evaluate, and respond to it. You or your authorized agent may only submit a request to know or for data portability twice in a 12-month period.

8 Verification Process and Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know or to request deletion or correction related to your personal information. If your minor child is our employee, you may also make a verifiable request on their behalf. We may request specific information from you or your authorized representative to confirm your or their identity before we can process your right to know or to request deletion or correction.

9 Responding to Your Requests

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the ten-day timeframe, please contact us at the contact information provided below.

We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. Our substantive response will tell you whether or not we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.

Any disclosures we provide will cover information for the 12-month period preceding the request’s receipt date. We will consider requests to provide a longer disclosure period that do not extend past January 1, 2022, unless providing the longer timeframe would be impossible or involves disproportionate effort.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

10 Privacy Policy Changes

We reserve the right to update the applicant privacy policy at any time. If we make any material changes to the policy, we will update the policy’s effective date and post the updated policy on our intranet/website or provide you with the updated policy.

Contact Information and Accessibility
If you have any questions about this Notice, need to access this Notice in an alternative format due to having a disability, or wish to exercise your right to know or to request deletion or correction, please contact HR at HR@lemongrasscloud.com or call 800-975-9906.
Effective Date of Notice: 5/1/2026

This Addendum supplements the Core Notice and provides information required by the Protection of Personal Information Act, 4 of 2013 (POPIA).

1. Information Officer: In accordance with POPIA, Lemongrass Consulting (Pty) Ltd has appointed and registered an Information Officer. The Information Officer can be contacted at:
   
   • Name/Title: Russell Opland, Global Data Protection Officer
   • Email: DPO@lemongrasscloud.com
2. Processing of Special Personal Information (SPI): POPIA generally prohibits the processing of SPI (which includes race, trade union membership, health, or criminal behaviour) unless a specific exception applies. We will only process your SPI if:
   
   • It is necessary to establish a right or obligation in law (e.g., processing race for Employment Equity Act reporting, or health data for sick pay obligations).
   • We have obtained your explicit consent (for any processing not required by law).
3. Your Rights: In addition to the rights in the Core Notice, you have the right to submit a complaint to the Information Regulator of South Africa and institute civil proceedings regarding alleged interference.

This Information Text (“Aydınlatma Metni”) is provided by Lemongrass as the “Data Controller,” in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (KVKK).

1. Purposes and Legal Bases: Your Personal Data (including Identity, Contact, Financial, and Professional data) is processed for the purposes in Section 3 of the Core Notice. The legal bases under KVKK Article 5 are:

• It is explicitly provided for by the laws (e.g., Turkish Labor Law, Social Security Law).
• It is necessary for the performance of a contract (i.e., to process your application).
• It is necessary for compliance with our legal obligations.

2. Processing of Sensitive Personal Data: Under KVKK Article 6, your “Sensitive Personal Data” (e.g., health, union membership) is only processed if:

• You have provided your explicit consent.
• For data other than health, it is explicitly provided for by law.
• For health data, it is processed by persons under an obligation of confidentiality (e.g., occupational health doctor) for public health or occupational medicine purposes.

3. International Data Transfers: Your Personal Information will be transferred abroad (e.g., to the US). In line with 2024 updates to KVKK Article 9, we rely on appropriate safeguards (such as our IGDTA and Standard Contractual Clauses) for these transfers.

4. Your Rights: You have specific rights under KVKK Article 11, including the right to learn if your data is processed, request correction, and request deletion.

2.5 ADDENDUM FOR INDIAN APPLICANTS (DPDP Act, 2023)

This Addendum supplements the Core Notice and is provided by Lemongrass Product Development India Private Limited (the “Data Fiduciary”) in accordance with Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act). This Act applies to your digital Personal Data.

• Legal Basis for Processing: We process your Personal Data for the purposes described in Section 3. Under the DPDP Act, our primary legal basis for this processing is for “certain legitimate uses” under Section 7, specifically for the purposes of your recruitment with us. Where we require consent for any other purpose, we will provide a specific notice.
• Information Provided: This Notice informs you of the data processed, the purposes, and how to exercise your rights or make a complaint to the Data Protection Board of India.
• Your Rights and Duties: You have the right to access, correct, or erase your data. You also have a duty not to provide false or misleading information or register frivolous grievances.
• Complaints: You have the right to lodge a complaint with the Data Protection Board of India.
• Language: This Notice is available in English. You have the right to request this Notice in any of the 22 languages specified in the Eighth Schedule of the Constitution of India.

For Malaysian Applicants (PDPA 2010):

• This Notice is provided in accordance with Section 7 of the Personal Data Protection Act 2010 (“Notice and Choice Principle”).
• Language: This Notice is issued in both English and Bahasa Malaysia. In the event of any conflict, the English version shall prevail.

For Filipino Applicants (DPA 2012):

• This Notice is provided in accordance with the Data Privacy Act of 2012 (DPA).
• We process your Personal Information based on the DPA principles of transparency, legitimate purpose, and proportionality.
• Data Protection Officer: You may direct any inquiries to our Global DPO at DPO@lemongrasscloud.com. As we do not meet the specific criteria for mandatory registration, our DPO is not registered with the National Privacy Commission (NPC).

2.7 ADDENDUM FOR GERMAN & DUTCH APPLICANTS

Germany (BDSG): The processing of your Personal Data is governed by the EU GDPR and the German Federal Data Protection Act (BDSG), particularly Section 26 BDSG (Employee Data Protection).

Netherlands (UAVG): The processing of your Personal Data is governed by the EU GDPR and the Dutch GDPR Implementation Act (Uitvoeringswet AVG or UAVG).

Critical Role of the Works Council (Betriebsrat / Onderningsraad):

• In Germany and the Netherlands, the implementation and use of technical facilities or HR systems, particularly any systems suitable for monitoring employee behavior or performance, are subject to the mandatory co-determination rights of the applicable Works Council.
• Therefore, for any such processing described in the Core Notice (e.g., in Section 5 “Use of Automated Decision-Making (ADM)”), the legal basis for our processing is not only our Legitimate Interest under GDPR, but also our compliance with the relevant Works Agreement (Betriebsvereinbarung / Ondernemingsovereenkomst) that has been concluded with your Works Council.