LGPD Notice for Candidates (Aviso de Privacidade, Lei 13.709/2018)

This notice applies to personal data of job CANDIDATES (data subjects / titulares) collected and processed through the Employmee platform during a hiring process.

It does NOT cover:

• How the Hiring Company processes your data outside the Employmee platform (for example, in its own systems, emails, or other tools). That is governed by the Hiring Company's own privacy practices as controller.
• Personal data of recruiters and other staff of the Hiring Company who use Employmee to manage hiring.

Applying does not require you to create an account. You access the application through a unique, tokenized link provided by the Hiring Company.

• CONTROLLER (controlador): the Hiring Company that invited you to apply and that runs the hiring process. It decides the purposes of processing, the role you are assessed for, and the final hiring decision. The Hiring Company is your primary point of contact for most rights requests.

• PROCESSOR (operador): Employmee ([legal entity name], [address]). Employmee processes your data only to deliver the screening service to the Hiring Company, following its instructions and this notice. Employmee does not use your CV or interview content to make hiring decisions and does not sell your personal data.

If you are unsure which company is the controller for your application, contact Employmee using the details at the end of this notice and we will help you identify and reach the right party.

Depending on how far you go in the process, the data processed through Employmee may include:

• Identification and contact data: your full name and email address.
• CV / résumé: the document file you upload (PDF or DOCX, up to 10MB) and the text extracted from it (which may include work history, education, skills, and any other information you chose to include in your CV).
• AI-generated profile and assessment: a structured profile and an evidence-cited, per-criterion assessment derived from your CV and interview.
• Interview data: your answers in the AI-assisted text interview; if you use the voice interview, audio is converted to/from text for the conversation.
• Process and integrity data: application status, timestamps, consent records (including the policy version you accepted and when), and limited interview-integrity signals.
• Technical data: data needed to deliver and secure the service, such as the application link token and basic request information, including a captcha check (Cloudflare Turnstile) to prevent abuse.

Please do not include sensitive personal data (such as health, racial or ethnic origin, religious or political beliefs, or biometric data) in your CV or answers unless it is genuinely relevant and you intend to share it.

Your data is processed for these purposes, under the following LGPD legal bases:

• To run your application, screening, and AI-assisted interview, and to generate the assessment for the role you applied to, based on your CONSENT (art. 7, I), which you give at the start of the application to a versioned data and AI policy.

• To support the legitimate hiring activity of the Hiring Company (for example, the recruiter reviewing the assessment, recording a decision rationale, and managing the selection process), based on the LEGITIMATE INTEREST of the controller (art. 7, IX), balanced against your rights and limited to what is necessary for the hiring process.

• To keep an append-only audit trail, enforce data-retention limits, respond to rights requests, and protect the security and integrity of the service, based on COMPLIANCE WITH LEGAL/REGULATORY OBLIGATIONS and the legitimate interests in security and accountability (art. 7, II and IX).

Where processing relies on consent, you may withdraw it at any time (see your rights below). Withdrawing consent may mean your application can no longer continue to be assessed.

Under LGPD art. 18, and at no cost, you have the right to request:

• Confirmation that your data is being processed.
• Access to your personal data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in non-compliance with the LGPD.
• Portability of your data to another service or product provider, upon an express request and subject to commercial and industrial secrets.
• Deletion of personal data processed with your consent (subject to the legal retention exceptions in art. 16).
• Information about the public and private entities with which your data has been shared.
• Information about the possibility of NOT providing consent and the consequences of refusing it.
• Withdrawal of your consent at any time, and revocation of consent for the AI-assisted processing.

In addition, where a decision is taken solely on the basis of automated processing that affects your interests, LGPD art. 20 gives you the right to request a review. As explained below, decisions at Employmee are NOT taken solely by automated means (a human recruiter decides), and you can still ask for human review.

The AI (Claude, by Anthropic) reads your CV and interview answers and produces a structured, evidence-cited assessment that scores you against the role's criteria. This output is a recommendation/assessment only.

The FINAL hiring decision is made by a HUMAN recruiter at the Hiring Company, who reviews the assessment and must record a written rationale. The AI does not approve or reject candidates on its own.

Under LGPD art. 20, you may request a review of decisions that affect you and ask for human review of the assessment, and you may request information about the criteria and logic used (to the extent this does not violate trade secrets). Because the Hiring Company is the controller, requests for review of a decision are decided by it; Employmee will route your request to the relevant Hiring Company and support it with the underlying records.

You can submit a request in either of two ways:

• Directly to the Hiring Company (the controller) that invited you to apply. It is responsible for most decisions about your data, including review of hiring decisions.
• To Employmee, using the contact details at the end of this notice. As processor, Employmee will action requests on the controller's instructions and will route to the Hiring Company any request that, by law, the controller must decide.

We may need to confirm your identity before acting on a request, to protect your data. We will respond within the timeframes required by the LGPD and, where a request cannot be fully met (for example, because of a legal retention obligation), we will explain why.

You also have the right to lodge a complaint with Brazil's National Data Protection Authority (ANPD).

Your data is made available to the Hiring Company that invited you, so its recruiters can review your application and assessment.

To operate the platform, Employmee uses the following sub-processors (operating under data-processing terms and only to provide the service):

• Vercel: hosting of the web application.
• Railway: application/API, background workers, PostgreSQL database, and Redis.
• Cloudflare R2: storage of your uploaded CV file.
• Cloudflare Turnstile: captcha to prevent abuse on the application form.
• Clerk: authentication for the Hiring Company's staff (recruiters).
• Anthropic (Claude): AI processing of CV and interview to generate the assessment.
• OpenAI: voice synthesis/transcription (TTS) for the optional voice interview.
• Resend: transactional email.

Employmee does not sell your personal data and does not share it for unrelated purposes.

Some of the sub-processors listed above may process or store data outside Brazil (for example, in the United States or other regions). When personal data is transferred internationally, such transfers are carried out in accordance with Chapter V of the LGPD, relying on appropriate safeguards, such as contractual clauses with data-protection commitments, the sub-processor's adequacy/compliance frameworks, or another transfer mechanism permitted by the LGPD and the ANPD. You may contact us for more information about the safeguards applied to a specific transfer.

Your personal data is retained only for as long as needed for the hiring process and the limited legal/accountability purposes described above. By default, candidate personal data is retained for [retention period, default 180 days] from your application, after which an automated routine erases it.

The platform supports erasure: when data is erased (because the retention period expired, or following a valid request), Employmee:

• removes your identifying data (name and email) from the candidate record;
• deletes your CV file from storage (Cloudflare R2);
• redacts the personal data contained in the AI-generated profile, the assessment report, and the interview transcript.

Erasure is irreversible. For integrity and legal accountability, a minimal, non-identifying record may be kept in the append-only audit trail (showing, for example, that an erasure occurred and when) and certain non-identifying provenance of records may be preserved, as permitted by LGPD art. 16.

Employmee applies technical and organizational measures to protect your data, including access controls and tenant isolation so that each Hiring Company can only see its own candidates, encrypted storage of CV files, staff authentication, and an append-only audit trail of key actions. No system can guarantee absolute security, but we work to protect your data against unauthorized access, loss, or misuse.

We may update this notice from time to time. The consent you give is versioned, so each consent record reflects exactly the policy text and version you accepted. When we make material changes, we will update the "Last updated" date and, where required, seek your consent again.