Recruitment Data Protection Notice

International and national laws and regulations, including those applicable within the European Union (“EU”) such as the General Data Protection Regulation (“GDPR”), provide various restrictions on the collection, use and processing of personal data. This Data Protection Notice (the “Notice”) is intended to inform candidates who apply for a job to work for Lean Scale DMCC or any Clients that Lean Scale DMCC  supports for Talent Acquisition, on the processing of their personal data during the recruitment process and explain the type of information company process, why company are processing it and how that processing may affect candidate.

Please find below answers to key questions candidate might have about how the Company will use Candidate Data during our recruitment process:

Who is the controller of the processing of candidates' personal data?

Controller of the processing of personal data according to the recruitment process is:


Lean Scale DMCC


Unit No: RET-R6-040, Detached Retail R6, Plot No: JLT-PH2-RET-R6, Jumeirah Lakes Towers, Dubai, United Arab 


Tel: +971 50 525 785


Lean Scale DMCC will be referred to as “Company” in this document. The individuals who apply for the positions will be referred to  "Candidate" in this document 


If candidates have any questions regarding personal data and its processing, for example whether the information company request from candidate is mandatory and the implications of not providing it, please contact the company. Company can be reached at the following email address:

What information does the Company collect directly from the Candidate?

During the recruitment process the following data will be directly collected and processed:

  • Identification data (such as candidates name, date and place of birth, nationality, ID information, driving license information),
  • Contact information (such as candidates address, telephone number, country of residence, email, or other contact information),
  • Job application data (such as candidates resume or CV, cover letter,  language skills, previous work experience, education, additional qualification, or other information regarding candidates professional qualification and experience, transcripts/diplomas, details of candidates right to work in the concerned country, desired salary, job preferences, and any other information candidate provide company in support of candidates application),
  • Information processed in relation to video-calls and/or phone-screenings and/or face-to-face interviews (if needed) the candidate may have with company,
  • Names and contact details of referees and knowledge of a person among our staff or management (relative or contact person). Prior to providing personal data of any data subjects, candidates must inform them about the content of this note and ensure that they do not object to the processing of their personal data by the Company.

The provision of these data is mandatory for the decision about the establishment of an employment relationship with candidates. If the data are not provided, it is possible that the company will not be able to offer a candidate an employment relationship.

What information does the Company collect from other sources?

Candidate Data that the Company will collect from other sources might include:

  • Legally and legitimately processed information relating to candidate from recruitment agencies,
  • Information about candidates professional performance or conduct which is obtained from candidates leads.
  • Publicly available professional profiles on websites or social media (e.g. LinkedIn, Glassdoor, Indeed.

Why does the Company have Candidate's personal data?

The Company needs to process candidates Personal Data in order to:

  • Administer the recruitment process,
  • Assess candidates suitability to the offered employment opportunity,
  • Assess candidate's skills, qualifications and experience with respect to the Company’s career opportunity,
  • Set up interviews, conduct the interviews online or offline, get references from candidates previous employers and leads,
  • Contact candidate or others on candidates behalf,
  • Secure physical and system security,
  • Ensure financial planning and budgeting,
  • Provide information to third parties in connection with transactions that company contemplate or carry out,        
  • Monitor diversity and equal opportunities,        
  • Manage disputes and legal proceedings,
  • Respond to candidates enquiries and requests,
  • Comply with applicable laws, regulations and legal processes,


Please note that should the candidate be successful, and the company offers the candidate a job, a new data privacy notice will be issued for the term of the candidate's employment.

On what legal basis does the Company collect and use Candidate's personal data?

The Company must have a legal basis to collect and process Candidate Data in compliance with applicable law. In most cases the law allows to process data on the basis of one of the following grounds:

  • The processing of candidates personal data is necessary in the context of the intention to enter into a contract with the candidate (Art. 6 paragraph 1 section b GDPR, sec. 26 paragraph 1 sub sec. 1 BDSG);
  • the processing of candidates personal is necessary to meet our legitimate interests (Art. 6 paragraph 1 section of GDPR). These legitimate interests are the following:
  1. Defense in litigation
  2. Assertion of legal claims
  3. Crime detection
  4. Monitoring of diversity and inclusiveness
  5. Maintaining system integrity
  6. Formation of a decision-making basis for the establishment of an employment relationship

Occasionally the Company will ask for the Candidate’s consent according to Art. 6 paragraph 1 section a GDPR for the purposes of processing Candidate Data. In any such case, the Company will notify the Candidate and the Candidate will be entitled to withdraw the Candidate's consent at any time. The Company will also notify the Candidate of any consequences which may arise in the event the Candidate does not give the consent upon our request. Should the Candidate’s wish to have any further information in relation to the consent the Company collects, please contact the Company.

How long will the Company keep the Candidate's Personal Data?

If the recruitment process is successful, the information collected during the recruitment process will become part of the Candidate's personnel file and be subject to the retention policy applicable for employee data. The Candidate will be further informed on this matter with the Company’s employee privacy notice.

The Company deletes all data related to the Candidate’s application in case the Candidate was not offered a subsequent employment within six months following an unsuccessful application. The underlying legal basis for this storage duration is justified by our legitimate interest (defending possible claims) according to Art. 6 paragraph 1 section of GDPR.

Given consent, the Company may retain Candidate's Personal Data to refer back to an earlier application. Unless otherwise required by applicable law, the Company shall retain Candidate’s Personal Data collected during the recruitment process for 2 years.

Who else will have access to the Candidate's Personal Data?

Candidate’s Personal Data will be processed and stored in access-controlled, centralized databases of Lean Scale DMCC in Dubai. The electronic databases are controlled only by authorized administrative human resources staff  and can be accessed only by authorized users.

Does the Company collect personal data of other people?

In addition to personal data, the Candidate may also provide the Company with information about Candidate’s referees. The Candidate shall communicate to such persons that the Candidate has provided their data to the Company for the same purposes for which the Candidate provided them in the manner set forth in this notice. The Candidate is entitled to share this notice with them.

What are the Candidate's rights?

Pursuant to Articles 15 and following of the GDPR the Candidate have the following rights:

a. Right to request access to Candidate’s Personal Data. It means that the Candidate is entitled to obtain a confirmation that Candidate’s data is being processed and the Candidate has admittance to Candidate’s Personal Data processed by the Company and other supplementary information. (Article 15 GDPR)

b. Right to request rectification of Candidate’s data. It means that the Candidate is entitled to have Candidate’s Personal Data corrected, completed if it is inaccurate or incomplete. (Article 16 GDPR)

c. Right to request erasure of Candidate’s data. It means that the Candidate is entitled to have Candidate’s Personal Data deleted in specific circumstances, if there is no lawful reason for continuing our processing. (Article 17 GDPR)

d. Right to object to  processing Candidate’s data. It means that in some cases, where the Company processes Candidate’s Personal Data based on legitimate interest or the public interest, the Candidate has the right to challenge the processing of data the Company carries out. (Article 21 GDPR)

e. Right to request the Company to restrict the processing. It means that the Candidate may request to ‘block’ or suppress processing of Candidate’s Personal Data. The Candidate’s valid request is leading to that the Company will be permitted to store Candidate’s Personal Data, but not further process it. (Article 18 GDPR)

f. Right to data portability. It allows the Candidate to obtain and reuse Candidate’s Personal Data for the Candidate’s own purposes across different services. The Candidate is entitled to move, copy or transfer personal data easily in a safe and secure way, without hindrance to usability. (Article 20 GDPR)


Where the Company uses Candidate’s Personal Data on the basis of the Candidate’s consent, the Candidate is entitled to withdraw that consent at any time subject to applicable law. Please note that the withdrawal of a given consent does not affect the lawfulness of processing before the consent was withdrawn.

Company relies on the Candidate to ensure that the Candidate's Personal Data is complete, accurate and current. Please inform the Company promptly of any changes to or inaccuracies of Candidate’s Personal Data by contacting the Company.

Status of this Notice

This Notice may be amended by the Company at any time. The Company will place updates on our intranet and, when appropriate, the Company will notify the Candidate of any changes by email prior to commencing processing.