Privacy notice — version v3
How we handle your data when you apply
Who is responsible (the controller)
Lightcone Research (the research group recruiting for these roles) is the data controller for all recruitment data. Privacy contact: privacy@lightconeresearch.org — a named member of our founding team answers personally.
What we collect, why, and on what legal basis
Your application (name, contact details, CV, your answers) is processed to evaluate you for the role you applied to — Art. 6(1)(b) GDPR, steps prior to a contract taken at your request. Providing this data is required to be considered for the role.
Roles based at UC Berkeley are applied for directly on the UC Berkeley careers site, under the University of California’s own privacy terms — we collect no data for those applications.
How we evaluate (Labour Code L1221-8)
People review CVs and conduct interviews. No automated scoring, ranking, or screening of any kind exists in our recruiting system; no decision about your application is ever made by an algorithm. Knockout questions on the form (e.g. work authorization) only flag an application for a human, who personally makes and records every decision.
How long we keep your data
- Applications: until the roles you applied to are filled, or at most 2 years after our last contact with you (CNIL recommendation) — whichever comes first — then deleted automatically.
Deletion is genuine: database rows, uploaded files, and calendar entries are destroyed. Deleted data can persist in encrypted platform backups for up to ~35 days before aging out; backups are never restored except for disaster recovery, and any restore is followed by replaying deletions.
Who processes your data (recipients)
Your data is seen only by our hiring team. Four processors host or transmit it under Art. 28 agreements:
| Processor | Role | Region | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU | DPA; SCCs |
| Vercel | Web hosting | EU functions; global edge | DPA; DPF + SCCs |
| Brevo | Email delivery | France / EU | DPA; EU provider — no third-country transfer |
| Google Workspace | Calendar invitations, video calls, team sign-in | EU data-region policy | DPA; DPF + SCCs |
Your rights
Write to privacy@lightconeresearch.org to exercise any of these — we respond within one month:
- Access (Art. 15) — a full copy of your data;
- Rectification (Art. 16) — correct anything inaccurate;
- Erasure (Art. 17) — deletion without undue delay;
- Portability (Art. 20) — a machine-readable export;
- Restriction (Art. 18) — we pause processing while a request is handled;
- Complaint — you may lodge a complaint with the CNIL (cnil.fr) at any time.
Cookies
These pages set no advertising or tracking cookies — which is why there is no cookie banner. One functional cookie (lang) stores your language choice if you use the EN/FR toggle; preference cookies of this kind are exempt from consent (CNIL).