Privacy notice — version v1
How we handle your data when you apply
Who is responsible (the controller)
Lightcone Research (the research group recruiting for these roles) is the data controller for all recruitment data. Privacy contact: privacy@lightconeresearch.org — a named member of our founding team answers personally.
What we collect, why, and on what legal basis
Your application (name, contact details, CV, your answers) is processed to evaluate you for the role you applied to — Art. 6(1)(b) GDPR, steps prior to a contract taken at your request. Providing this data is required to be considered for the role.
Roles based at UC Berkeley are applied for directly on the UC Berkeley careers site, under the University of California’s own privacy terms — we collect no data for those applications.
How long we keep your data
Your application is kept until the roles you applied to are filled, or at most 2 years after our last contact with you (CNIL recommendation) — whichever comes first — then deleted automatically.
Deletion is genuine: database rows, uploaded files, and calendar entries are destroyed. Deleted data can persist in encrypted platform backups for up to ~35 days before aging out; backups are never restored except for disaster recovery, and any restore is followed by replaying deletions.
Who processes your data (recipients)
Your data is seen only by our hiring team. Four processors host or transmit it under Art. 28 agreements:
| Processor | Role | Region | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU | DPA; SCCs |
| Vercel | Web hosting | EU functions; global edge | DPA; DPF + SCCs |
| Brevo | Email delivery | France / EU | DPA; EU provider — no third-country transfer |
| Google Workspace | Calendar invitations, video calls | EU data-region policy | DPA; DPF + SCCs |
DPA: data processing agreement — the contract (Art. 28 GDPR) that obliges the processor to handle your data only on our instructions. DPF: EU–U.S. Data Privacy Framework — a European Commission adequacy decision covering certified U.S. companies (Art. 45). SCCs: Standard Contractual Clauses — European Commission-approved contract terms that lawfully cover a transfer outside the EU (Art. 46).
Your rights
Write to privacy@lightconeresearch.org to exercise any of these — we respond within one month:
- Access (Art. 15) — a full copy of your data;
- Rectification (Art. 16) — correct anything inaccurate;
- Erasure (Art. 17) — deletion without undue delay;
- Portability (Art. 20) — a machine-readable export;
- Restriction (Art. 18) — we pause processing while a request is handled;
- Complaint — you may lodge a complaint with the CNIL (cnil.fr) at any time.
Cookies
These pages set no advertising or tracking cookies — which is why there is no cookie banner. One functional cookie (lang) stores your language choice if you use the EN/FR toggle; preference cookies of this kind are exempt from consent (CNIL).