Gupy Institutional Privacy Notice

ChatGPT Image 23 de jun. de 2026, 15_47_41

We at Gupy are strongly committed to protecting privacy and personal data. That is why we are providing this Privacy Notice, which explains how we process and protect your personal data and ensure it remains secure when you use websites with the gupy.io domain.

If you have questions about how we process your data on our Recruitment and Selection, Onboarding, Corporate Training, or Workplace Culture and Engagement platforms, please refer to the specific Privacy Notices available on our Privacy Portal.

If you are not familiar with any of the terms mentioned in this notice, we recommend consulting our Privacy Glossary by clicking here.

Who We Are and Our Role in Data Processing

GUPY RECRUITMENT TECHNOLOGY
CNPJ No. 23.514.668/0001-52

Gupy is the owner and operator of all websites with the gupy.iodomain and acts as the data controller when processing your personal data in these environments, in accordance with applicable law.

When you use our websites—whether to access content, request contact, download materials, take courses, or register for events—we may collect and process your personal data to facilitate these interactions and fulfill the purposes described in this Privacy Notice.

By accepting this Notice, you acknowledge that you are aware of how your personal data is processed by Gupy. When processing depends on consent, it will be requested in a specific and prominent manner, as applicable.

How We Handle Your Personal Data

We may collect different categories of personal data, depending on how you use our websites. This data is processed to serve your interests and provide you with relevant HR content and experiences.

In some cases, for operational purposes, we may request this data, and it is up to you to decide whether or not to provide it.

There are several ways in which Gupy may process your personal data when you visit our websites. See the table below for the categories of data, how they are collected, and specific details:

Data Category	Method of Collection and Purpose
Personal data entered by the user on the website	Resulting from your interest in (1) downloading materials prepared by Gupy, (2) request a demo of our platform, (3) take a course offered by Gupy, (4) register for an event hosted by Gupy, (5) submit your feedback on an event, or (6) request to receive our newsletter;
Data necessary for the ordinary use of the website	This data is collected automatically through cookies and other similar technologies while Users browse our website. The data collected in this way may include information about the User’s device, geolocation data, web application access logs (such as IP address, date, and time), time spent on the platform, session duration, clicks, and search terms. If you’d like to know how we use cookies, please see our Cookie Notice;
Marketing and Newsletter Distribution	We may prepare materials for publication on the Gupy website or those of partner companies. Occasionally, to download these materials, we may request certain information; send newsletters and communications when users sign up via specific forms; send information about courses and events; and invite users to participate in surveys.
Events Sponsored by Gupy	If you register for an event sponsored by Gupy, we will collect your data to facilitate your participation.
Personal data provided by the data subject during events organized by Gupy or at our booth at events in which we are participating	As a result of your interest in requesting a demo of our platform or participating in our activations. To personalize the offline interaction experience (events); to contact you after a requested demo.
Data collected during sales and customer service interactions	Data collected during sales and customer service interactions: When interacting with our sales or customer success teams during online meetings and phone calls, we may record and transcribe these conversations. Before any recording: (i) you will be informed at the beginning of the call and may decline without affecting the service; (ii) recordings will be accessed only by authorized professionals; and (iii) they will be deleted in accordance with the timeframe set forth in the Internal Data Retention and Disposal Policy.
Personalizing the Experience	Personalize your online and offline interactions—whether through our blog, via email, or at events.
Participation in Surveys	I invite you to participate in surveys conducted by Gupy.
Go UP Community	Enable participation in the Go UP Community by expressing your interest.

What is the legal basis for processing the collected data?

Gupy processes your personal data for the purposes described in this Privacy Notice based on the legal grounds set forth in applicable law.

In general, processing may occur based on the performance of a contract or pre-contractual measures to which you are a party, Gupy’s legitimate interests, your consent, compliance with legal or regulatory obligations, as well as for the regular exercise of rights in judicial, administrative, or arbitration proceedings.

When processing depends on your consent, it will be requested freely, in an informed manner, and unequivocally. In cases where we use legitimate interest as the legal basis, we will take measures to ensure that processing is carried out transparently, proportionately, and in accordance with your fundamental rights and freedoms.

Data Sharing

We engage service providers to assist us in carrying out our activities, and, given the nature of the services they provide, they may receive your personal information strictly for the purpose of providing the services for which they were engaged. These service providers have been carefully selected, are bound by strict confidentiality agreements and obligations regarding the protection of your data, and may process your data solely for the purpose of providing the service contracted by Gupy.

Occasionally, we make relevant content available for download to our users, prepared in partnership with other companies. The data you provide when downloading such content may be shared with these companies, which will be explicitly identified in our content.

Finally, for each sponsored event, the registration page identifies the sponsors by name and the purposes for which each wishes to use your data. Consent will be collected on a granular basis, allowing you to give selective consent without affecting your participation in the event.

Other specific legal requirements may lead to the sharing of personal data, including for the purpose of defending our rights and interests in any type of dispute or to comply with orders from competent authorities. In such cases, we limit the sharing to the minimum necessary to meet the legal requirement.

Transfer of Personal Data to Other Countries

Gupy may transfer your personal data outside of Brazil, specifically to the United States or countries in the European Union, if our cloud service providers and other tools essential to the provision of our services have their databases located in those countries. These companies, which act as Data Processors, are listed in the table below.

These transfers are carried out digitally and will continue as long as there is a purpose and a legal basis justifying them.

Our relationships with the companies listed below are governed by contracts that include data protection and information security obligations appropriate to the nature of the personal data processing we perform and compatible with the requirements of Brazilian law, including, where applicable, the standard clauses stipulated by the ANPD. In addition, Gupy evaluates the security, privacy, and confidentiality practices of its partners and suppliers before establishing any partnership and conducts International Transfer Impact Assessments to assess and monitor potential risks.

We comply with all guidelines established by current legislation and adopt best practices in security and privacy to ensure the integrity, confidentiality, availability, and privacy of your personal data throughout the entire process, including technical and organizational measures such as encryption, strict access controls, and vulnerability monitoring.

How Gupy Protects Your Personal Data

As mentioned in the previous section, we may share your information with companies located outside Brazil, which may require the transfer and/or processing of this data abroad.

We take the privacy and protection of your personal data very seriously, which is why we have implemented security measures that protect our systems and databases using the best technologies available on the market.

Among the security measures we have adopted are:

The use of antivirus software, data encryption, and the anonymization of personal data, access control based on the principle of least privilege, segregation of duties, the use of firewalls, and the implementation of internal information security policies; software solution architecture with intrusion prevention and the use of HTTPS; institutional measures (governance program and structure); monitoring of incident logs, protection against unauthorized access, WAF, annual external and semi-annual internal penetration tests, vulnerability assessments for each new feature, and the implementation of controls based on security policies.

However, despite our efforts, given the nature and architecture of the internet—which includes elements beyond our control—it is impossible to guarantee that malicious actors will not gain access to or misuse personal data, as this is an inherent risk associated with the use of computerized systems.

Where and for how long we will retain your data

Your data is stored on secure platforms used for customer relationship management and business processes, such as Salesforce and/or HubSpot, which operate in a cloud environment with appropriate security and data protection standards.

Gupy retains the personal data it collects only for as long as necessary to fulfill the purposes for which it was collected.

After the retention period ends, the data may be securely deleted or anonymized, except when its retention is necessary to comply with legal or regulatory obligations, or for Gupy to exercise its rights.

You may request the deletion of your personal data at any time, subject to the legal grounds that authorize its retention.

Your Rights as a Data Subject

You may exercise the rights provided for in the General Data Protection Law (LGPD), including: confirmation of the existence of data processing, access to data, correction of incomplete, inaccurate, or outdated data, anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law, portability, withdrawal of consent, objection to processing, as well as information regarding the sharing of your personal data.

To do so, click here and submit a request on the Gupy Data Subject Portal

The response time is up to 15 days, as provided by law.

If your requests are not addressed satisfactorily, you may file a complaint with the National Data Protection Authority (ANPD) through its official websiteat or www.gov.br/anpd

How to Stop Receiving Marketing Emails

At any time, you can manage your email preferences using the link in the footer of emails sent by Gupy. There, you can select the types of emails you would like to receive or opt out of.

If you fill out any form and re-express your interest in being contacted or receiving materials from Gupy, your email address will be added back to the list. Therefore, you’ll need to submit a new request to unsubscribe if you wish to do so.