Recrutei Privacy
and Security Policy

01. What personal data is collected

So that users can be identified on our platform, the mandatory collection of some data such as email and full name is required. Other data is optional and is collected only if the user/visitor wishes to provide it, such as a profile picture.

Personal data that may be collected from users/visitors:

• Identification data: full name, phone, email, CPF (Brazilian taxpayer ID), date of birth, address and social networks.
• Technical data: Access information, such as date, time, location and IP address, data about the device used and cookies.
• Third-party service connection data: basic identification and authentication data from third-party services.
• Biometric data: profile picture, specific sensitive information such as whether or not you have a disability.
• Other data: Data eventually provided in forms, email exchanges, chats and comments.
• Aggregated data: information about your professional history, such as companies where you have worked, positions, roles, length of experience and also all the information present in the resume file that you may upload at the time of your application.

Occasionally, to improve your browsing experience and/or job application experience, we may collect and analyze your common browsing data such as the city from which you are accessing, the type of device from which you are accessing, time spent on platform applications, login and logout records, click characteristics and monitoring of executed actions.

By using our services, you agree to the collection and processing of your personal data to enable the use of these services. All such data will be stored securely in different databases, located both in the eastern region of the United States (us-east-1) and in the southeast region of Brazil (sa-east-1), both on Amazon Web Services (RDS), which is a secure and reliable platform. We never share your personal data with third parties other than those mentioned in these terms, unless required by law or court order. According to the Brazilian General Data Protection Law (LGPD), you have the right to access, correct or delete your personal data at any time. Feel free to contact us if you have any questions about our privacy policy or the processing of your personal data.

What types of communication you may receive via email or phone

By applying to job openings and/or the talent pool, you allow Recrutei and recruiters, managers or company representatives to contact you through the channels you provided, such as email, phone or WhatsApp.

This communication may be about:

• communication about the job opening you applied to;
• offers of new openings and selection processes;
• satisfaction surveys;
• institutional communications from the company;
• requests to update registration data;
• content related to the job market, employability, preparation for selection processes;
• updates of this privacy policy;
• information about the company, its work environment and its opportunities;

02. Cookies

Recrutei's websites and applications use Cookies, which are small text files sent by the website to the user's browser when the user visits the site.

The use of cookies is necessary to store your access preferences and ensure an efficient and consistent experience for Recrutei's visitors and users, both in single visits (session cookies) and in repeated visits (persistent cookies).

PURPOSES OF COOKIE USE

Cookies can be used for different purposes. Some cookies are necessary to personalize the user experience, while others are for technical reasons.

Cookies can be used for marketing purposes, to serve advertisements to users or visitors based on their preferences, but also to provide statistics that help Recrutei understand the behavior of page visitors, allowing us to develop content that is increasingly interesting and targeted to our audience.

TYPES OF COOKIES

These are the types of cookies used on Recrutei's websites:

• Essential: Cookies strictly necessary for the operation of basic site functions.
• Functional: Used to store information about the use of specific tools.
• Statistical: Record data about visitor interactions on our sites, such as how many times a given page was accessed, number of users, access location, and other statistical information.
• Advertising: Used to display advertising content relevant to visitors and users.
• Third-party / Embedded content: Cookies from third-party services, such as social networks and video platforms, which through share buttons or embedded content may track your online activity, with Recrutei having no control over or rights to the data collected by these cookies.

03. When we collect data

Browsing data and personal data may be collected, depending on the context, in the situations below:

• At the moment the site is accessed, we collect browsing data (cookies) in order to ensure the best possible experience for the user or visitor.
  This data is generally related to pages visited, IP address, browsing software, keywords used, source web address, file transfers or shares and others that may be stored or retained.
• At the moment the user or visitor signs up for job openings or other services provided by Recrutei, the user provides Recrutei with basic identification information already described above.
• When the visitor/user uses third-party services to authenticate and access our sites, or to interact with publications on our systems, we may receive from these services the basic identification information about the user. The use of this data, in this situation, is authorized by users in advance with the third-party company used.

04. Legal bases and purposes table

Legal Basis	Data	Purpose
Data subject's consent	Optional identification data and biometric data	Connect your data to the company's talent pool, in order to increase the chances of being called
	Third-party service connection data	Authenticate access for use of Recrutei systems. Allow data from users who interact with content published on our sites.
	- Name - Email - Other optional data	Sending of emails containing informational communications and advertising material related to the services, events and courses offered by Recrutei.
Legitimate interest	Contact information collected in forms	Sending of emails containing informational communications and advertising material related to the services, events and courses offered by Recrutei.
	Usage information	Understand the use of our sites and services by users to promote improvements.
Compliance with legal obligation	Technical data	Mandatory collection data, pursuant to Law 12.965/2014 (Brazilian Internet Civil Rights Framework), will only be provided to third parties under express authorization from the user or under judicial demand.

Why do we collect the personal data mentioned above?

Our main objective with the collection and use of data is to ensure the proper use of our systems and services, always aiming to improve the user experience.

• Operationalize your participation in the selection process
• Connect your data to the interested company's talent pool to increase your chances of being called
• So that companies can engage with you, given the needs to advance in the selection process
• To answer your questions regarding job openings
• So that Recrutei can provide support at the client's request or at your request, improving your experience in selection processes
• So that companies can analyze the compatibility of your profile and professional experience with the job openings offered

05. Data sharing

To enable our online services, technology and business partners are necessary to help keep the platform running properly, from your job application to support. Therefore, they may receive your personal data, strictly for the purpose for which you provided them:

• Mailgun: Email delivery.
• Amazon Web Services: Secure cloud storage of your data.
• WhatsApp: Recognition of your number for connection with recruiters and managers.
• Google Sheets (online spreadsheet): Integration of your data so that the recruiter can connect with other tools for managing their recruitment.
• Hotjar: Usage monitoring tool with the aim of improving the usability of the candidate environment as well as diagnosing eventual errors on the platform and correcting them.
• Google Analytics: Mapping of application sources, page accesses and general usage behavior. Used for the improvement of the experience of recruiters and candidates on the Recrutei platform.

06. Data retention period

If you do not request deletion, your data will be stored for 2 (two) years, by default. By applying to the job opening and/or talent pool you declare your full understanding and acceptance of each of the items of collection and processing of your personal data.

07. Data deletion

You may request the deletion of your account, except for basic essential data that will be retained for purposes of inspection by competent authorities.

Requests for deletions and clarification of questions about data processing can be made by email privacidade@recrutei.com.br. The process may take up to 72 business hours.

In which cases your data will not be used

Your data may not be sold, transferred or provided to companies disconnected from your legitimate interest in the job market for the purpose of selling products or services or other objectives unrelated to your legitimate interest in providing them.

What you can request regarding your data:

• Full access to the data provided, through your login and password.
• Data update: You may update it yourself whenever you wish, with your login and password.

08. Information security

All data of users (candidates and companies) is confidential and only people with the appropriate permission will have access to it. Any use of this data is in accordance with our privacy policy. Our servers are located in different places, ensuring greater security, redundancy and availability, and can only be accessed by authorized people. All information, especially of a sensitive nature, will whenever possible be encrypted or anonymized, if it does not make the use by Recrutei-operated systems unfeasible. At any time the user may request a copy of their data stored in our systems.

09. Liability

Except for cases of willful misconduct or fault by Recrutei, Recrutei exempts itself from any liability for any damages and/or losses arising from failures, viruses or intrusions.

We consider the privacy of our users extremely important and will take all necessary measures to protect it. However, we cannot fully guarantee that all information and data about these users will be free from unauthorized access, especially if there is improper sharing of access credentials by the user. Therefore, the user is responsible for keeping their access credentials in a safe place, and sharing them with third parties is prohibited. The user undertakes to immediately notify Recrutei, through institutional and secure means, about any unauthorized or improper use of their account.

Data Protection Officer

At Recrutei, you have a dedicated professional to take care of your data and handle the processing of your personal information.

The DPO assists you, data subject, by clarifying doubts and ensuring that the rights of data subjects are addressed whenever requested. To contact Recrutei's DPO, please reach out to privacidade@recrutei.com.br

10. Security alerts and financial responsibilities

Important: Recrutei and its clients do not charge candidates anything

Recrutei and no authorized client company charges any type of payment from candidates at any stage of the selection process, including but not limited to:

• Application fees for selection processes
• Pre-employment exams
• Resume analysis fees
• Training or qualification costs
• Any other type of charge related to application or hiring

Fraud Alert

Cases have recently been identified of malicious individuals who have improperly used the Recrutei brand to create fake job openings and request payments from candidates, especially for supposed pre-employment exams.

If you receive any payment request during a selection process claiming to be from Recrutei or a client company, it is a fraud attempt.

How to proceed in case of suspected fraud

If you are contacted with a payment request on behalf of Recrutei or a client company:

1. DO NOT MAKE ANY PAYMENT
2. Immediately report to privacidade@recrutei.com.br
3. Provide all details of the fraudulent communication (screenshots, emails, phone numbers, etc.)
4. Report to the competent authorities, if necessary

Disclaimer of Liability

Recrutei is not responsible for damages, financial losses or losses of any nature arising from fraudulent actions by third parties who improperly use our brand, name or visual identity to apply scams or request improper payments from candidates.

Recrutei's responsibility is limited to services effectively provided through our official, duly authenticated channels. Any communication or request that does not originate from our official systems is not our responsibility.

Candidates must always verify the authenticity of communications and, in case of doubt, contact us through official channels before providing any personal information or making payments.

11. Third-party integrations

Recrutei offers optional integrations with third-party services to expand functionality across the ATS and the Talent portal. Some are intended for business clients (recruiters and managers), others for candidates. In all cases, the connection depends on explicit consent from the user who owns the third-party account and can be revoked at any time.

Available integrations

• Google Calendar (business clients) — display of the recruiter's calendar alongside interviews, and automatic creation of events and Google Meet links when interviews are scheduled through the ATS.
• Gmail (business clients) — communication with candidates from the recruiter's own Gmail address, with reading, sending and organization of threads related to selection processes directly through the ATS interface.
• Sign in with Google (candidates) — optional authentication on the Talent portal, using only basic profile data (name, email and picture). There is no access to Gmail, Calendar, Drive or other data from the candidate's Google account.
• AI providers (Google Gemini, OpenAI) — intelligent ATS features, as described below.
• Other technology partners (messaging, analytics, cloud storage, etc.) — listed in section 5 of this policy.

Compliance with Google's API Services User Data Policy (Limited Use)

The Google Calendar, Gmail and Sign in with Google integrations use official Google APIs and operate under the terms of the Google API Services User Data Policy. Recrutei fully adheres to the Limited Use requirements of that policy, including the rules applicable to restricted scopes:

Recrutei's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial Intelligence and data isolation

Recrutei uses third-party AI providers (Google Gemini and OpenAI) in features such as resume analysis and text and media processing. These services operate exclusively on data provided directly by the user to the ATS (resumes, profiles, opt-in transcripts). Data obtained through the Google Calendar, Gmail and Sign in with Google integrations is never sent to AI providers. The data flows are, by design, isolated.

Control and revocation

Recruiters and managers may disconnect the Google Calendar and Gmail integrations in the ATS integrations settings; candidates may unlink Sign in with Google in the profile area of the Talent portal. Permissions may also be revoked directly at myaccount.google.com/permissions. After revocation, Recrutei stops accessing Google APIs on behalf of the user and removes associated data as applicable. Questions and deletion requests: privacidade@recrutei.com.br.

12. Choice of forum

This document is governed by and shall be interpreted in accordance with the laws of the Federative Republic of Brazil. Any disputes arising from the understanding and/or execution of these terms shall be resolved in the judicial district of Uberlândia, Minas Gerais, to the exclusion of any other.

All topics herein apply and shall be interpreted in accordance with the Brazilian General Data Protection Law: Law No. 13.709/2018.