GDPR

GDPR and Data Processing Notice

This GDPR and Data Processing Notice supplements the Privacy Policy for users in the European Economic Area, United Kingdom, Switzerland, and other jurisdictions with similar privacy rights.

Effective date: 25 May 2026

1. Controller and processor roles

For most account, billing, security, support, analytics, and product-operation data, Lemma CV acts as a controller because it determines why and how that information is processed.

For resume, CV, cover letter, job description, and application content that you submit for your own purposes, Lemma CV may act as a processor or service provider where applicable law treats you as the controller of that content. In other cases, Lemma CV may act as an independent controller for limited purposes such as security, support, abuse prevention, and service improvement.

2. Lawful bases for processing

  • Contract: to provide the Lemma CV service, accounts, subscriptions, document workflows, exports, support, and related functionality.
  • Legitimate interests: to secure, maintain, debug, improve, analyze, and protect the service; prevent abuse; and understand feature performance.
  • Consent: where required for optional cookies, marketing, or specific processing choices.
  • Legal obligation: where processing is needed for tax, accounting, compliance, regulatory, dispute, or law-enforcement obligations.

3. AI data processing and subprocessors

Lemma CV may use third-party AI providers and infrastructure subprocessors to process the information you submit. Depending on the feature, data may be sent to providers such as OpenAI / ChatGPT, Anthropic / Claude, DeepSeek, Google / Gemini, xAI / Grok, hosting providers, database providers, storage providers, analytics providers, monitoring providers, payment providers, and email providers.

AI providers may process prompts, resume/CV content, job descriptions, cover letter content, generated drafts, edits, metadata, logs, and technical information necessary to provide the feature. Do not submit special-category data or sensitive information unless it is necessary and you have a lawful basis to do so.

4. Special-category and sensitive data

Resume and CV content can reveal sensitive information, such as health status, union membership, political or religious affiliations, ethnicity, immigration history, age, disability, or other protected characteristics. Lemma CV does not require that information for ordinary use. If you include it, you are choosing to submit it for processing and should ensure it is necessary, lawful, accurate, and appropriate for the application material.

5. International transfers

Lemma CV and its providers may process personal data outside the EEA, UK, or Switzerland. Where required, transfers may rely on adequacy decisions, Standard Contractual Clauses, UK transfer mechanisms, contractual safeguards, or other lawful transfer bases.

6. Your GDPR rights

  • Access: request a copy of personal data processed about you.
  • Rectification: ask us to correct inaccurate or incomplete personal data.
  • Erasure: ask us to delete personal data, subject to legal, contractual, backup, security, and operational limits.
  • Restriction: ask us to limit certain processing in specific circumstances.
  • Objection: object to processing based on legitimate interests or direct marketing.
  • Portability: request a machine-readable copy of certain data where the right applies.
  • Withdrawal of consent: withdraw consent where processing is based on consent, without affecting earlier lawful processing.
  • Complaint: lodge a complaint with your local data protection authority.

7. Exercising your rights

To exercise privacy rights, contact Lemma CV through the support or contact channel provided in the app or website. We may ask for information needed to verify your identity and locate your account. We will respond within the timeframe required by applicable law unless an extension is permitted.

8. Data protection limits of AI outputs

AI outputs are generated from automated systems and may contain errors, unsupported claims, or inappropriate inferences. You are responsible for reviewing and correcting outputs before use. Do not rely on Lemma CV to identify every privacy, legal, employment, or discrimination risk in your application materials.