Personal data is any information about an identifiable living person. You may come across documents that talk about “data subjects”: this is a term used in data protection law to describe persons. A person is identifiable when:

It is reasonably likely that Lemon Exclusive Ltd could identify the individual by other reasonable means. For example, a customer reference number, where customer service can associate this with a name or address.

Online identifiers – such as cookie ID and device ID – are also covered by the law, as well as decisions made about and subjective opinions about individuals.

Sensitive personal data is any information about health, religion, sexual life or orientation, racial or ethnic origin, political opinions, trade union membership, genetic data or biometric data that uniquely identifies a person (such as fingerprints or facial recognition). Information about criminal convictions or alleged criminal activity is governed by very similar laws, so where this Policy relates to sensitive personal data, it also covers data relating to criminal offences.

Personal data may be collected in various ways, for example: from recruitment agents, correspondence with employees or clients, social media advertising, B2B contracts.

What are the obligations of Lemon Exclusive LTD?

Lemon Exclusive Ltd must comply with the General Data Protection Regulation (“GDPR”) and laws such as the Data Protection Act of 2018 and Organic Law 3/2018 of December 5 on Personal Data Protection and Guarantee of Digital Rights. Lemon Exclusive Ltd’s obligations under these laws are set out in this Policy.

What are my responsibilities?

All employees and, where applicable, contractors of Lemon Exclusive Ltd must comply with this
Data Protection Policy and any additional policies implemented by Lemon Exclusive Ltd. Failure
to comply with this Policy may result in disciplinary action. The appendices to this Policy
contain additional notes.

Basic data protection principles

Lemon Exclusive Ltd adheres to the following data protection principles when processing
personal data:

Legality, Equality and Transparency

Informing people how Lemon Exclusive Ltd will use their personal data

1. 1

   Individuals must understand how their personal information will be collected and used.
   When creating a new product or activity that will involve personal data, Lemon Exclusive
   Ltd takes into account how these people will be informed.

2. 2

   Where Lemon Exclusive Ltd collects personal information directly from individuals, it
   will provide notice at the time of such collection.

3. 3

   Where Lemon Exclusive Ltd collects personal data from another source, it will inform you
   within a reasonable time, but no later than one month after Lemon Exclusive Ltd obtains
   the data. If Lemon Exclusive Ltd intends to communicate with an individual or disclose
   data to a third party, this information is provided no later than the time of such
   communication or disclosure.

4. 4

   The Privacy Notice contains the information listed in Annex

5. 5

   Lemon Exclusive Ltd ensures that privacy notices are: concise, understandable, using
   clear and simple language appropriate to the recipients; easily accessible; and provided
   in writing (which may include electronic means) unless the person requests the
   information orally.

6. 6

   If the purposes for processing your personal data change, Lemon Exclusive Ltd will
   provide a further privacy notice before new processing begins.

Justification for any processing

1. 1

   Lemon Exclusive Ltd only processes personal data where it can meet one of the legal
   grounds for processing. Belong to them:

• The person has consented to the processing;

• Processing is necessary for the performance of a contract with a person or to
  take steps at the request of a person before concluding a contract;

• Processing is necessary to comply with a legal obligation to which Lemon
  Exclusive Ltd is subject; or

2. 2

   The annexes provide guidance on the appropriate basis for each area of ​​Lemon Exclusive
   Ltd’s business.

3. 3

   Lemon Exclusive Ltd does not process any sensitive personal data. The relevant bases for
   each area of ​​Lemon Exclusive Ltd’s business are listed in the Appendices.

Purpose Limitation

1. 1

   Lemon Exclusive Ltd processes personal data only for purposes that are lawful and which
   have been provided to the individual under the Transparency principle and in the
   Processing Activities Register.

2. 2

   Lemon Exclusive Ltd cannot process personal data for an incompatible purpose – if you
   wish to do so, please contact us at info@diamondstatepi.com .

Data Minimization and Accuracy

1. 1

   Lemon Exclusive Ltd ensures that personal data is adequate and relevant to the purposes
   for which it is processed and limited to what is necessary for the purpose of
   processing. Lemon Exclusive Ltd does not collect more personal information than is
   necessary simply because it may prove useful later.

2. 2

   Lemon Exclusive Ltd also ensures that personal information is accurate and updated as
   necessary; takes all reasonable steps to correct or delete inaccurate personal data.

Storage Limitation

1. 1

   Lemon Exclusive Ltd determines how long it must process personal data for a specific
   purpose and stores personal data only for this period. After the end of this period,
   Lemon Exclusive Ltd deletes the personal data or ensures that the data does not allow
   for the identification of persons.

2. 2

   Unless otherwise required by law, Lemon Exclusive Ltd stores collected data for no longer
   than 6 years.

Integrity and Confidentiality

1. 1

   Lemon Exclusive Ltd secures all personal data processed and protects it against
   “unauthorized or unlawful processing and accidental loss, destruction or damage”. It
   does this by implementing various security measures such as knowledge base
   authentication (for example, password protection), antivirus protection, and SSL
   certification; and by implementing the measures it imposes on its data processors.

2. 2

   Lemon Exclusive Ltd also implements a data breach response program to record, remediate
   and report any data breaches in accordance with the law.

Responsibility

1. 1

   Privacy by Design and Default: Lemon Exclusive Ltd is able to demonstrate its compliance
   with this Policy and applicable data protection law. Lemon Exclusive Ltd ensures that
   privacy issues have been considered from an early stage in the implementation of
   services and procedures (privacy by design) and that only the minimum amounts of
   personal data necessary are processed by default (privacy by default).

2. 2

   Data Protection Impact Assessment: In certain cases – high risk processing – Lemon
   Exclusive Ltd may be required to carry out a Data Protection Impact Assessment (DPIA).
   DPIA is an audit carried out in a specific area of ​​an organization’s operations to
   identify and minimize the risk of non-compliance.

3. 3

   Register of Processing Activities: Lemon Exclusive Ltd is required to maintain a formal
   register of its processing activities.

Personal Rights

Lemon Exclusive Ltd quickly deals with requests from people wishing to exercise their data
protection rights. If you receive a request from an individual, please forward it to Mr. Jakub
Zwoliński at info@diamondstatepi.com .

People have the following rights:

1. 1

   Access: obtaining (i) confirmation as to whether Lemon Exclusive Ltd processes
   their personal data; (ii) a copy of the personal data (in a commonly used electronic
   form, if the application is submitted electronically); and (iii) providing additional
   explanations.

2. 2

   Data Protection Impact Assessment: In certain cases – high risk processing –
   Lemon
   Exclusive Ltd may be required to carry out a Data Protection Impact Assessment (DPIA).
   DPIA is an audit carried out in a specific area of ​​an organization’s operations to
   identify and minimize the risk of non-compliance.

3. 3

   Rectification: requesting the correction of incorrect personal data.

4. 4

   Disclaimer: objection to: (i) processing for direct marketing purposes; (ii)
   profiling based on direct marketing; and/or (iii) processing based on the legitimate
   interests of Lemon Exclusive Ltd.

5. 5

   Deletion (so-called “right to be forgotten”): request the deletion of personal
   data in certain situations, for example when: (i) the processing is based on consent and
   consent is later withdrawn; or (ii) the person has effectively exercised the right to
   object and wishes to have the data deleted.

6. 6

   Restriction: Request that personal data be “restricted” (i.e. blocked/paused)
   while resolving complaints (for example regarding accuracy) or where the processing is
   unlawful but the individual objects to deletion.

Individuals also have the right not to be subject to decisions based solely on
automated processing of personal data that have legal or similarly significant effects, unless
the making of such decisions is permitted by law. There are limited exceptions to this law.

Sharing Personal Data With Third Parties And International Transfers

1. 1

   Data processors are other organizations that process personal data on behalf of the
   controller. Lemon Exclusive Ltd may appoint processors to assist in the processing of
   personal data. Lemon Exclusive Ltd obtains leads from advertising campaigns on Meta Ads
   and Google Ads platforms.

2. 2

   When appointing any data processor to collect, store or use personal data on behalf of
   Lemon Exclusive Ltd, Lemon Exclusive Ltd must:

• Before entering into a contract: Make sure that the data processor provides
  satisfactory guarantees regarding its data protection practices; and

• After conclusion of the contract: Sign the data processor to certain data processing
  conditions; and

• Post-contractual: Confirm regularly that pre-contractual guarantees regarding data
  protection practices remain valid.

3. 3

   Where Lemon Exclusive Ltd transfers personal data to data processors or data controllers
   that are located outside the EEA (which includes data processors accessing personal data
   from outside the EEA, e.g. for the provision of IT support services), it uses a data
   transfer mechanism unless the country this has been deemed appropriate by the European
   Commission.

Training

Lemon Exclusive Ltd provides training on this Policy and other data protection policies,
procedures and responsibilities to all employees and contractors upon joining Lemon Exclusive
Ltd and annually thereafter.

Audits And Monitoring

Lemon Exclusive Ltd conducts audits of compliance with this Policy and other data protection
policies; and will implement appropriate corrective actions to correct any non-compliances. If
you feel that this Policy is not being followed in any way at Lemon Exclusive Ltd, please report
it to our email address info@diamondstatepi.com .

Policy Updates

Lemon Exclusive Ltd is responsible for communicating changes to this Policy and will also provide
a brief explanation of the reasons for any reported changes to this Policy.

Publication And Final Provisions

Lemon Exclusive Ltd will post this Policy and any other changes on its website at
https://diamondstatepi.com/policies/privacy-policy .

Effective Date: 23/01/2024

Contact: Any questions or concerns regarding this Policy may be raised by contacting:
info@diamondstatepi.com . You should also contact us if you believe you need an exception to a
policy in this Policy.

Attachment 1

Information that must be provided to individuals when their personal data is directly
collected:

• Identity and contact details of Lemon Exclusive Ltd and the Data Protection Officer of
  Lemon Exclusive Ltd;

• Purposes and legal basis for processing;

• Legitimate interests of Lemon Exclusive Ltd, where applicable;

• Recipients or categories of recipients of personal data;

• Any international data transfers, including the location of any recipients and the
  methods used to ensure that these transfers are adequately protected (and how to obtain
  details of these methods);

• Data retention periods;

• Their rights under data protection law;

• Process available for people wishing to withdraw any consent;

• Is the person obliged to provide personal data and possible consequences of not providing
  this data; and

• The existence of automated decision-making, including profiling, and the logic of this
  proce

Information that must be provided to individuals when collecting their personal
information from another source:

• All information listed in point 1 of this Annex 1;

• Categories of personal data obtained from the third party; and

• Sources of personal data – the information must be as precise as possible (e.g. specify
  whether the source is private or public; and the type of organization/industry/sector).

Annex 2

Basics of personal data processing

The human resources department of Lemon Exclusive Ltd may collect and process personal data where
it is necessary for the following purposes:

Transparency

Lemon Exclusive Ltd has prepared privacy information for candidates and employees.