Recruitment and Selection Plataform Privacy Notice for Candidates

Gupy has a strong commitment to privacy and the protection of your personal data.

Therefore, we present this Privacy Notice, which has all the necessary information about when and for what purposes Gupy  treats your personal data in  addition to informing you of your rights when you use the Recruitment and Selection Platform as a candidate in selection processes.

Your data is always collected in accordance with this Privacy Notice and in compliance with the relevant data protection laws, especially the Brazilian General Data Protection Law ("LGPD").

Who are we?

CNPJ nº 23.514.668/0001-52

Gupy is the holder of the Recruitment and Selection Platform entitled Gupy and is the controller when processing your personal data. 

Who is the Data Protection Officer (DPO)?

Name: Renata Benjamin

What data is collected?  

Gupy handles your data to allow you to participate in the selection process(es) performed by companies that use our platform and integrate your talent bank(s).

We never collect unnecessary personal data from you and we will not treat your information in any way other than as specified in this Notice.

Registration Data: To create an account on the platform, we require full name, email, country of origin, CPF and phone number. If you prefer, you can also import some of your login data directly from social networks such as Linkedin and Facebook. This option only occurs if you so choose, and all data collected this way is displayed at the time of selection, according to the information recognized in the specific fields.

Resume Data: To build your resume, you will need to enter your educational background, professional history, date of birth, gender, and whether or not you are a person with a disability. If you wish, you can also insert your photo and provide a link to your LinkedIn and Facebook profile.

The information that you are a person with a disability, because it is considered sensitive by the legislation, will be treated only with your consent, which can be withdrawn at any time (as explained below in the item "What are your rights?").

If you declare yourself as a person with a disability, recruiting companies may request a medical report to validate this information and ensure that selection processes for people with disabilities are fair and that inappropriate applications are quickly identified. This submission, however, is not mandatory and will be done with your consent, which can also be revoked at any time. 

Diversity Data: If you wish, you can complement your profile with data on your gender identity, sexual orientation, color or race and the treatment pronoun that is most appropriate for you. This data, which is not mandatory, will be treated only and only with your consent and will not be used as criteria for elimination from the selection processes. Such information has the purpose of allowing recruiting companies to take affirmative action for the hiring and inclusion of people from diversity groups in the labor market.

Data for Selection Process: to carry out the selection process, the recruiting company may request (i) complementary information that it deems necessary for the process; (ii) the recording of a video (to learn more about this step, consult the Platform's Terms of Use); and (iii) that you respond to tests, selected by the recruiting company considering the particularities of the vacancy for which you intend to apply, such as, for example, tests of behavioral factors, integrity, knowledge in Portuguese, English and logical reasoning tests -- such tests are performed by partner companies, responsible for the results, and are only made available and stored by Gupy. The Data for Selection Process is under the responsibility of the recruiting company.

Navigation data: We collect data about your platform navigation, which may involve information about your device, internet application access records (such as IP, date and time), platform usage time, access duration, clicks and search terms.

Data for identity confirmation: If you contact us through our support channel to make changes to your registration, change your password, recover your account, request information about selection processes in which you have registered, among others, it will be necessary for you to confirm your identity by sending us a photo of your ID document (RG, CPF, birth certificate, passport, CTPS or other official ID document). The copy of your document will be deleted from our database as soon as your service is completed, or within 72 hours at the latest.


How is data collected? 

The data can be collected in the following ways:

  • Personal data entered by you in the Platform: such data are entered by you in the Platform. You are the only one responsible for providing them, by means of manual typing and your own submission.
  • Resume Data: you can attach your resume file to automatically fill in the data in it.
  • Navegation data resulting from the ordinary use of the site: we may collect such data automatically through cookies and other similar technologies when using the Platform. For more information, please see our Cookie Notice.

Companies interested in your profile may also use some of your personal data to invite you, via e-mail, to register on the Gupy Platform and in one of your positions.


Regarding data processing from children and teenagers 

Gupy processes personal data of individuals aged 14 and above, considered teenagers by law, for their participation in selective processes for young apprentice vacancies. Such data is handled solely for the interest of the adolescent and after their own submission.

In this process, the necessity for full protection, as required by the Brazilian Child and Adolescent Statute and the Constitution, will always be considered, with the objective of promoting the physical, social, moral, and psychological development of the adolescent, as provided by the learning contract.

What do we use the collected personal data for? What is the legal basis? 

We take your privacy very seriously and will never sell your data.

Your Registration Data will be used, based on the legitimate interest to allow you to create a Gupy account. 

Your Registration Data and Resume Data will be used by the recruiting company to:

(i) Allow you to participate in selection processes of the recruiting companies as well as to integrate the talent bank of these companies;

(ii) To allow the recruiting companies to invite candidates previously enrolled in their selection processes, whether these processes are still in progress or not, to participate in the selection processes of other open positions that match your profile and skills, always thinking of the benefit of the candidate and of your interest in being hired;

Your name, e-mail and telephone number may may be used based by recruiting companies in the following situations:

(i) To contact you, due to the progress of your selection process, to inform you of new vacancies that may be of interest to you and for you to contact our support or the recruiting company for questions regarding the process; and

(ii) Allow the recruiting companies to contact you directly by e-mail or whatsapp.

In addition, we will use your
name, e-mail and/or phone number, when it is necessary to contact you based on our legitimate interest to:
(i) Address issues regarding your use of the Platform, such as, but not limited to, access issues and irregularities in your account;

(ii) Invite you to participate in surveys related to platform usability, suggestions for improvement and new product development;

(iii) Send relevant communications about employment opportunities from recruiting companies;

Health Data and Diversity Data are collected only for the purpose of bringing together candidates from diversity groups and companies that wish to hire them and is legally based on your consent, which may be revoked at any time.

When the recruiting company is a financial institution or an insurance company, according to legal rules and regulations of the Central Bank of Brazil and Susep - Superintendence of Private Insurance, your data may be consulted for a possible analysis related to illicit practices such as money laundering and terrorism (BACEN Circular 3978 and SUSEP Circular 612/2020).

Navegation Data are used for:

(i) to guarantee you an experience adequate to your profile and to analyze flaws and errors in our operations by checking our services, aiming at improving our service and our interactions with you;

(ii) operationalize new products and services, monitor the operation of the platform, ensure its security, understand your preferences, and make improvements; and

(iii) comply with legal obligations to keep records of connections and access established by the Internet Civil Framework and legal and administrative obligations in cases of fraud or court order.

In specific situations, we may base data processing on the compliance with legal and regulatory obligations and the regular exercise of rights. For any purpose where your consent must be collected in accordance with the law, the processing of data depends on your free and unambiguous manifestation.

In specific situations, we may base data processing on the compliance with legal and regulatory obligations and the regular exercise of rights. For any purpose where your consent must be collected in accordance with the law, the processing of data depends on your free and unambiguous manifestation. 

We do not tolerate discrimination!

At Gupy, candidates are not unlawfully discriminated against in any way, regardless of the personal data that the platform collects or uses about them. Final hiring decisions, however, are made by the recruiting company.

What are your rights?

At Gupy, your rights are taken seriously! Your main rights under Brazilian General Data Protection Law (“LGPD”) are:

  1. Confirmation of data tratament: consult if Gupy has your data;
  2. Right of acess: you can request access to your data, as well as to obtain details of the treatment performed by Gupy, such as information about sharing, purpose, form and duration of the treatment;
  3. Right of rectification: if you realize that your data are incomplete, inaccurate, or outdated, you can correct them directly in your profile or when registering for the selection process;
  4. Right to data portability: you can request a copy of your data to facilitate migration to another provider. We will provide you with a document containing your data in a commonly readable format for you to use when filling out the portability form;
  5. Right to erasure: if your data becomes unnecessary, excessive or the processing is not in accordance with the law, you can request its deletion;
  6. Sharing Information: you have the right to request information about the sharing of your data; 
  7. Withdraw your consent: at  any time you may request the revocation of the consent you have provided to us. There are two ways to revoke your consent: (i) change your answer to "I prefer not to answer" when you are asked for Health and Diversity Data; (ii) similarly, you can stop informing us if you are PCD; (iii) for medical report document, you can delete the file from your account. Your consent will always be optional.
  8. Right to review automated individual decision-making, including profiling: you can request a review of decisions affecting your interests, provided that such decisions are based on 100% automated processing of your data, as well as details of the criteria used. You can also request a review of profile definitions, where one exists.
  9. Right to object to the treatment or request deletion of your account: you have the right to object to the data processing, where it is not based on your consent and where Gupy is not fulfilling legal obligations. In this case, you can request the deletion of your account. Please note that this process takes up to 10 calendar days, during which time you will not be able to create a new account, in order to prevent fraud. In addition, some data may be kept to comply with Gupy's legal or regulatory obligations and to defend our rights in any legal claims;
  10. Right of petition:: you have the right to lodge a complaint regarding the use of your data with the National Data Protection Authority;

How to request the fulfillment of a right? 

To exercise any of your rights provided in the item above, open a request by clicking on this link:
Gupy's Data Subject Portal


With whom do we share the collected data? 

Your data will be shared only with those who need to receive it in order to enable their participation in the selection process — that is, with the companies that are conducting such process. In addition to the recruiting company, which is also a personal data controller and will always receive your data, there may be involvement from HR or people management consultancies, either to open a selection process on behalf of the recruiting company or to manage a selection process opened by the recruiting company itself. These companies may communicate directly with you to conduct the selection process, invite you to apply for other positions, and discuss related topics.

As the data controller, the recruiting company may also use your data to (i) conduct recruitment processes outside the Gupy Platform and (ii) share your data with companies belonging to the same economic group. In doing so, the recruiting company shall remain fully responsible for the independent uses it makes of such data.".

They may also receive your personal information from service providers (referred to as processors as per the law) that we have hired to assist us in carrying out our activities, whatever they may be:

  • Amazon Web Services: Data processing and Cloud Storage
  • Primeira Escolha: test provider partner company
  • MailGun: sending emails
  • Zendesk: support
  • Infobip: integration for communication with candidates via corporate Whatsapp

Such providers have been carefully selected, have strict confidentiality agreements and obligations related to the protection of your data and may treat your data only and only for the purposes of providing the service contracted by Gupy.

Other specific legal demands may lead to the sharing of personal data, including for the eventual defense of our rights and interests in any kind of conflicts or for the fulfillment of determinations of competent authorities.


Information Security measures 

We are very concerned about the privacy and protection of your personal data, therefore, we have adopted technical and organizational security measures and best practices to protect our systems and databases, using the best technologies available in the market. 
Among the security measures we have adopted are: use of antivirus, data encryption, anonymization of personal data, access control, use of firewalls and implementation of internal information security policy, architecture of the software solution with intrusion prevention and use of HTTPS, institutional measures (Program and governance structure), protection against unauthorized access.

However, despite our efforts, considering the nature and architecture of the internet, which includes elements that are not under our control, it is impossible to guarantee that malicious agents will not gain access to or make improper use of personal data, as this is a risk inherent to the use of computerized systems.

Where is your data stored? 

Your data is stored in the cloud by Amazon Web Services, whose server is located in the state of Virginia, in the United States, which will require transfer and/or processing of this data outside Brazil.

Internacional transfer of personal data

Gupy may transfer your personal data outside Brazil, more specifically to the United States or European Union countries, in case the recruiting company or any of the operating companies have servers in those countries.

Gupy observes all the requirements established by the current legislation and adopts the best security and privacy practices to ensure the integrity and confidentiality of your personal data throughout the procedure. All our relations with such companies are governed by contracts that include data protection and information security obligations appropriate to the nature of the personal data treatment we perform and compatible with the requirements of the Brazilian legislation.


How long will we keep your data?

Gupy only stores your personal data for the time necessary to fulfill the purposes for which it was collected.

Since, when you apply for a selection process, you become part of the recruiter company's talent bank, your personal data will be kept even after the selection process is completed. At any time, you may request your exclusion, as indicated in the item above.

If you do not request deletion, but your account remains inactive for a period of one (1) year, we will ask you about your interest in keeping your data on the Platform.

Important! The treatment of personal data is an essential condition for you to participate in the selection processes for which you have applied. Should you request the deletion of your personal data, you will immediately lose access to the services of our Platform and will be prevented, for security reasons, from registering again for a period of 10 days. This measure is necessary to avoid fraud in the selection and recruitment processes, as well as to prevent the duplication of registrations of a candidate.

Even after the  request for account deletion, some of your data may be kept, in databases located outside the Gupy Platform and protected by appropriate security measures, for the purpose of complying with legal or regulatory obligations or to safeguard the rights of Gupy or third parties, including considering any judicial disputes in which the use of such data may be necessary.


This Privacy Policy may be updated at any time, and such changes will be published in our services and can be checked whenever you want. Therefore, we recommend that you periodically visit this page to learn about the changes. If relevant changes are made that require further authorization from you, you will be communicated through the platform.

Last updated on December 7th, 2022.

Previous versions


12/07/2022 - Current version
08/19/2021 - Privacy Notice - 2nd version 
07/14/2020 - Privacy Notice - 1st version