Recruitment and Selection Plataform Privacy Notice for Candidates

Gupy is deeply committed to privacy and the protection of your personal data. To this end, we present this Privacy Notice, which contains all the necessary information about when and for what purposes Gupy processes your personal data. It also outlines your rights when you use Gupy Recruitment and Selection as a candidate in selection processes.

YYour data is always collected in accordance with this Privacy Notice and in compliance with relevant data protection laws, especially the General Data Protection Law.


Talent Pool: a location where information about candidate individuals who have previously applied for positions with the Client Company and/or have been invited by the Client Company to join their respective Talent Pool is stored.

Controller: a natural or legal person, public or private, responsible for decisions regarding the processing of personal data. In Gupy Recruitment and Selection, both the Company and Gupy primarily act as Controllers in relation to Candidate Data.

Data: Personal data and/or sensitive data;

Personal data: information related to an identified or identifiable natural person;

Sensitive personal data: Personal data about racial or ethnic origin, religious beliefs, political opinions, membership in a union or religious, philosophical, or political organization, data related to health or sexual life, and genetic or biometric data when linked to a natural person;

Client Company: a company that hires the services offered by Gupy, especially those related to Gupy Recruitment and Selection;

Data Protection Officer (DPO): a person appointed by the controller and operator to act as a communication channel between the data processing agent, data subjects, and the National Data Protection Authority (ANPD);

Gupy: GUPY TECHNOLOGY IN RECRUITMENT LTDA, registered under CNPJ No. 23.514.668/0001-52, headquartered at Avenida Paulista, 1079, Bela Vista, in the city of São Paulo, State of São Paulo, ZIP Code 01.311-200. Manager of Gupy Recruitment and Selection;

Gupy Recruitment and Selection: refers to the Gupy Recruitment and Selection Platform, a tool used by Client Companies to manage their selection processes;

LGPD: General Data Protection Law - Law No. 13,709, of August 14, 2018;

Operator: a natural or legal person, public or private, who processes personal data on behalf of the controller;

Candidates: individuals who apply and are interested in occupying a specific position through selection processes for Client Company positions;

Selection Process: a set of techniques that assist in choosing the most suitable candidates for a particular job vacancy. Through it, it is possible to identify skills and competencies and determine which profiles are most compatible with the position and the company's culture

Who are we?

Gupy is the owner of Gupy Recruitment and Selection and acts as a Controller when processing your personal data.

Who is the Data Protection Officer (DPO)?

Name: Renata Benjamin

What data is collected? For what purposes? 

Gupy processes your data to allow you to participate in selection processes conducted by Client Companies using Gupy Recruitment and Selection and to integrate the talent pools of such companies.

We never collect unnecessary personal data and will not process your information in any way other than specified in this notice.

We take your privacy very seriously and will never sell your data.



Identification Data:
  • Full name and/or social name,
  • email,
  • country of origin,
  • CPF (Brazilian individual taxpayer registry),
  • phone number,
  • date of birth
  • gender
Gupy uses this data to register you on the platform, authenticate your identity, contact you, and ensure that you meet the minimum age requirement to use our services. If you wish, you can provide the link to your LinkedIn and Facebook profiles.

These data may also be used to:
i) Address issues related to the use of Gupy Recruitment and Selection, such as, but not limited to, access problems and irregularities in your account;
ii) Invite you to participate in surveys related to the usability of Gupy Recruitment and Selection and satisfaction surveys on Selection Processes, suggestions for improvement, and development of new products;
iii) Send communications for marketing or advertising purposes according to your interests, in cases where consent is not required;
iv) Share your resume with Gupy's Client Companies, with your consent when requested.

This data may also be used by the Client Company to:
i) Invite candidates previously registered in their Selection Processes, whether ongoing or not, to participate in other open positions that match their profile and skills, always considering the candidate's benefit and interest in being hired;
ii) Contact you regarding the progress of your Selection Process, to inform you about new vacancies that may be of interest;
iii) Enable you to contact our support or the Client Company to address doubts about the process;
iv) Allow Client Companies to contact you directly by email or WhatsApp;
v) Enable you to participate in an internal recruitment process
Provided by the data subject during registration on the Gupy Recruitment and Selection platform..
Professional Data:
Resume data such as academic background, history, professional experience, and professional interests. 
We use this data for you to build your resume and enable the Client Company to recruit and select candidates based on the criteria defined for the positions. Provided by the data subject during the application for a job.
Data for Selection Process:
Responses to additional questions inserted by the Client Company, interview videos, and test results.

The Client Company uses this data according to the criteria internally established for the recruitment and selection process.

For the execution of the selection process, the Client Company may:
(i) request additional information deemed necessary for the process through additional questions, which may be configured by the Client Company as eliminatory;
(ii) request the recording of a video interview (to learn more about this stage, consult the Platform's Terms of Use);
(iii) request that you answer tests, selected by the Client Company considering the specifics of the position you intend to apply for, such as profile tests and knowledge tests - These tests may be provided by Gupy or by partner companies, in which case, they are responsible for the analysis and result, which are only made available and stored by Gupy;

Information provided through additional questions is collected and processed at the sole discretion and responsibility of the recruiting company.

Attention! It is possible to reuse test scores, as well as reuse videos.

When the Client Company is a financial institution or insurer, according to legal norms and regulations of the Central Bank of Brazil and SUSEP - Superintendence of Private Insurance, your data may be, subject to the internal policies of the Client Company, collected by such companies for a possible analysis related to illicit practices such as money laundering and terrorism (Circular No. 3978 of BACEN and Circular No. 612/2020 of SUSEP).

Provided by the data subject during the job application or during the stages of the selection process..

Navigation Data: Information about your device, internet application access records (such as IP, date and time), platform usage time, access duration, clicks, and searched terms. We use this data to monitor the operation of Gupy Recruitment and Selection, conduct analyses for improvements, operationalize new products and services, and fulfill legal and administrative obligations.  Automatically collected through cookies and other similar technologies, during the use of Gupy Recruitment and Selection. To learn more, consult our Cookie Notice.
Sensitive Data:
Health data (whether you are a person with a disability) and diversity data (gender identity, sexual orientation, color or race, and the most suitable treatment pronoun for you).
We use this data to:
(i) enable diverse and inclusive hiring by Client Companies. If you declare yourself as a person with a disability, Client Companies may request a medical certificate to validate this information and ensure that Selection Processes for people with disabilities are fair and that inappropriate applications are quickly identified. However, this submission is not mandatory and will be done with your consent, which can also be revoked at any time;
(ii) implement affirmative actions by Client Companies to promote the hiring and inclusion of people from diversity groups in the job market.

Important: The filling of health and diversity data is not mandatory, and usage will only be done with your consent, which can be revoked at any time.
Provided by the data subject on the Platform, with consent..

Client Companies interested in your profile may also use some of your personal data to invite you, via email, to register on Gupy Recruitment and Selection and apply for one of its vacancies. They may also input potential Candidate data into the Talent Pool—provided it is collected in accordance with applicable laws.

Attention! Gupy Recruitment and Selection is FREE for candidates, and we do not charge any fees for your participation in selection processes or hiring. Therefore, do not make any payments related to selection processes for opportunities received through communication channels and social networks. To learn more about preventing job scams and frauds, read the article and check the FAQ for frequently asked questions by clicking here.

Gupy does not accept resumes from candidates for participation in the selection processes of our clients through means other than Gupy Recruitment and Selection. Therefore, resume files received via email or other communication channels will be deleted as soon as possible.

We do not tolerate discrimination! 

At Gupy, candidates are not unlawfully discriminated against in any way, regardless of the personal data collected. However, hiring decisions are made by the Client Company.

What is the legal basis for the use of personal data? 

Depending on the purpose, Gupy may process your data based on legitimate interest or consent. For any purpose where your consent must be collected under the law, data processing will depend on your free and unequivocal expression.

In specific situations, we may base data processing on the execution of a contract, compliance with legal and regulatory obligations, and the regular exercise of rights

Treatment of data for adolescents? 

Gupy processes personal data of individuals aged 14 and above, considered adolescents by law, for participation in selection processes for youth apprentice positions. Such data is treated exclusively in the interest of the adolescent and after their own submission.

In this treatment, the need for comprehensive protection required by the Statute of the Child and Adolescent and the Constitution will always be considered, with the aim of promoting the physical, social, moral, and psychological development of the adolescent provided by the apprenticeship contract.

What are your rights regarding the privacy of your data?

At Gupy, your rights are taken seriously! Your main rights under the LGPD are:

(i) Confirmation of the existence of treatment by Gupy;
(ii) Access: request access to your data and obtain detailed information on how Gupy processes this data, including sharing, purpose, form, and duration of treatment;
(iii) Correction of incomplete, incorrect, or outdated data: you can correct them directly in your profile or resume;
(iv) Portability: you can request a copy of your data in an easy-to-read format to facilitate migration to another service provider;
(v) Deletion of data: if your data becomes unnecessary, excessive, or the processing is not in accordance with the law, you can request its deletion;
(vi) Information about sharing: you have the right to know who we share your data with;
(vii) Withdrawal of consent: at any time, you can withdraw the consent given to us through the Platform;
(viii) Review of fully automated decisions or profile definitions: you can request a review of decisions that affect your interests, provided that such decisions have been made based on fully automated processing of your data, as well as details about the criteria used. You can also ask for a review of profile definitions, when applicable;
(ix) Opposition to treatment or account deletion: you have the right to object to data processing when not based on your consent and if Gupy is not complying with legal obligations. In this case, you can request the deletion of your account, which may take up to 10 calendar days, during which you cannot create a new account to prevent fraud. Some data may be kept to fulfill Gupy's legal or regulatory obligations and to defend our rights in any judicial demands;
(x) Petition: it is your right to file a complaint with the National Data Protection Authority.

How to request service for a right?

To exercise any of your rights listed above, open a request by clicking on the link:

Gupy Data Subject Portal

Attention! In this channel, we do not handle support requests for the Platform

Who do we share the collected data with? 

Gupy shares your data with:

(i) Client Companies when you apply for a Selection Process (these companies, as Controllers, may share your data with HR consultants); If the company conducts Selection Processes or shares data outside of Gupy Recruitment and Selection, it will be entirely responsible for independent uses;
(ii) Companies belonging to the Gupy economic group in cases of merger, acquisition, or sale, when there is a purpose for doing so. In this case, the purpose will be informed in the respective privacy notice;
(iii) With authorities/government agencies, in cases of judicial measures or processes, investigations, etc;
(iv) With Gupy Admissão to facilitate your hiring process when the Client Company uses this service (consult the Gupy Admissão Privacy Notice);
(v) With job boards for job posting and partners through integrations that can be used independently by the Client Company or through Gupy;
(vi) With suppliers and service providers (and only if strictly necessary), called Operators by legislation, whom we hire to help us carry out our activities, namely:

Supplier Service Provided Location
Amazon Web Services Cloud data storage and processing Virginia, EUA
Primeira Escolha Supply of tests Brasil
MailGun Email sending  San Antonio, Texas, EUA
Zendesk Support channel  Oregon, EUA

Such providers have been carefully selected, have strict confidentiality agreements, and obligations related to the protection of your data. They may only process it for the purposes of providing the service contracted by Gupy. 

Other specific legal demands may lead to the sharing of personal data, including for the eventual defense of our rights and interests in any conflicts or to comply with determinations from competent authorities.

Client Companies, as Data Controllers, may share your information with their partners and other Operators hired by them, depending on the characteristics and strategies of their selection processes and personnel management. In this case, for more information on the processing of your data, you should consult the respective privacy notices.

International transfer of personal data 

Gupy may transfer your personal data outside of Brazil, specifically to the United States or countries in the European Union if the Client Company or Operators have servers in those countries. 

We observe all guidelines established by current legislation and adopt the best security and privacy practices to ensure the integrity, confidentiality, availability, and privacy of your personal data throughout the procedure. Our relationships with such companies are governed by contracts that include obligations for data protection and information security appropriate to the nature of the personal data processing we perform and compatible with the requirements of Brazilian legislation.

Information security measures 

We care a lot about the privacy and protection of your personal data. Therefore, we adopt technical, administrative, and organizational security measures and best practices to protect our systems and databases, using the best technologies available in the market—including the use of antivirus, data encryption, anonymization of personal data, access control, the use of firewalls, and the implementation of information security policies, software solution architecture with intrusion prevention, and the use of HTTPS, institutional measures (Privacy and Data Protection Governance Program), employee training and awareness, protection against unauthorized access, among others. 

However, despite our efforts, considering the nature and architecture of the internet (which includes elements that are not under our control), it is impossible to guarantee that malicious actors will not be able to access or misuse personal data, as it is an inherent risk of using computerized systems.

Where and for how long will we keep your data?

Your data is stored in the cloud by the company Amazon Web Services, whose server is located in the state of Virginia, United States. 

We store your personal data only for the time necessary to achieve the purposes for which they were collected.

Given that, when applying for a Selection Process, you become part of the Talent Pool of the Client Company, your personal data will be retained there even after the completion of the Selection Process. If you wish to leave a Talent Pool or stop sharing your information with specific companies, you can change the privacy settings in your profile. At any time, you can also request the deletion of your Gupy account, and your data will be removed. 
Important! The processing of personal data is an essential condition for you to participate in the Selection Processes for which you have applied. If you request the deletion of your account, you will immediately lose access to our Platform services and will be prevented, for security reasons, from registering again for a period of 10 days. This measure is necessary to prevent fraud in selection and recruitment processes, as well as to prevent the duplication of a candidate's registration. 

Even after the account deletion request, some information may be retained for compliance with legal or regulatory obligations or to safeguard Gupy's or third parties' rights, including considering any judicial disputes.

Also, consult the Privacy Portal, where you will find information for easy reference on how data is used by Gupy..


This Privacy Notice may be updated at any time, and such changes will be published on our services and can be checked whenever you want. Therefore, we recommend visiting this page periodically to be aware of modifications. If relevant changes requiring new authorizations from you are made, you will be notified through Gupy Recruitment and Selection..

Previous versions

12/07/2023 - Current version
12/07/2022 - Privacy Notice - 3rd version
08/19/2021 - Privacy Notice - 2nd version 
07/14/2020 - Privacy Notice - 1st version