Privacy Notice - Platform
How Plooral processes personal data of candidates, clients, partners, and visitors on the Platform.
With a clear vision of efficient recruitment processes, training, and consulting, Plooral recognizes the importance of protecting the personal information of all data subjects involved in our operations, whether individual users, clients, partners, employees, or third parties. In this regard, we strive to achieve an adequate privacy culture, delivering excellence in our services while respecting the right to privacy.
Through this Privacy Notice, Plooral Tecnologia S.A. ("Plooral") clarifies how it processes personal data in the company, guided by the principles of transparency, legitimacy, and other fundamental principles of Law 13,709/2018 (Brazilian General Data Protection Law, the LGPD).
What personal data do we collect?
Plooral processes personal data from different data subjects, each with specific purposes and supported by a legal basis under the LGPD, as detailed below:
a) Candidates (Platform users)
| Data collected | Purpose | Legal basis (LGPD) |
|---|---|---|
| Name, email, phone | Creating and maintaining a Platform account, allowing access to recruitment and training features | Art. 7, V |
| Date of birth / age | Checking job requirements | Art. 7, V |
| Résumé, professional and academic history | Assessing qualifications for available jobs | Art. 7, V |
| Address / city | Checking geographic location compatible with the job | Art. 7, V |
| Test and assessment results | Behavioral and technical profile analysis, as configured by the hiring company | Art. 7, V |
| Name, email | Sending communications about opportunities, training content, and Platform updates relevant to the candidate | Art. 7, IX |
| Browsing and interaction data with the Platform, IP address | Improving the user experience, developing new features, accessibility, and content; information security, audit, and fraud prevention | Art. 7, II / Art. 7, IX |
| Photo | Optional candidate identification. The photo is processed only when voluntarily provided by the data subject and/or under instruction from the controller company. | Art. 7, I / Art. 7, V |
| Application and profile data | Developing, improving, and enhancing Platform features (data used in aggregated or anonymized form whenever technically feasible). | Art. 7, IX |
Important: Processing of candidate data carried out by hiring companies and their representatives is the responsibility of those companies, as independent controllers. Plooral ensures the security and operation of Platform features, but is not responsible for the content, accuracy, lawfulness, or extent of the data managed by companies when using the Platform.
Talent pool: Candidate data may be stored for future hiring processes of the contracting company, under that company's instructions as controller (Art. 7, V).
b) Clients (hiring companies: representatives and administrative users)
| Data collected | Purpose | Legal basis (LGPD) |
|---|---|---|
| Name, email, phone, job title | Preparing quotes, Platform demonstrations, and conducting commercial discussions | Art. 7, V |
| Registration and contract data | Contract management and retention for the regular exercise of rights in a potential judicial or administrative proceeding | Art. 7, V / Art. 7, VI |
| Name, corporate email, phone, role | Registration and management of administrative users on the Platform, including access permissions | Art. 7, V |
| Corporate email, access credentials | Information security and audit | Art. 7, II / Art. 7, V |
| Name, corporate email | Sending operational notifications about the Platform, updates, and support | Art. 7, V |
| Name, email, phone, ticket content | Handling support tickets and resolving technical issues. Plooral acts as controller regarding identification of the requester and management of the service in order to perform the contract | Art. 7, V |
| Usage and interaction data with the Platform | Operating, providing, and maintaining the Platform, including development of improvements, new features, and information security | Art. 7, V / Art. 7, IX |
| Name, email | Sending communications about Plooral products, services, and updates (newsletter) | Art. 7, IX |
c) Partners and suppliers
| Data collected | Purpose | Legal basis (LGPD) |
|---|---|---|
| Name, phone, email, professional information, qualification data | Formalizing and managing contracts and partnerships, conducting discussions, and providing clarifications | Art. 7, V |
| Name, email | Sending institutional communications and updates relevant to the partnership | Art. 7, IX |
d) Visitors (websites and digital channels)
| Data collected | Purpose | Legal basis (LGPD) |
|---|---|---|
| Browsing data (cookies, IP address, pages visited, device) | Studying how visitors interact with digital channels, improving search relevance, accessibility, and content | Art. 7, IX |
| Name, email, job title, phone | Contact requests, Platform demonstrations, or receiving content | Art. 7, V |
| Name, email | Sending institutional communications and updates relevant to the partnership | Art. 7, IX |
How long is data stored?
Plooral will store personal data for as long as needed to fulfill the legitimate and specified purposes of this Notice, and may store data beyond the contractual relationship to comply with legal obligations and/or protect rights. In any case, we are committed to the confidentiality and security of the information we hold.
Access records to websites and platforms will be stored for at least 6 months, in accordance with the Brazilian Internet Civil Framework (Marco Civil da Internet).
Data used to send content of interest related to Plooral - email marketing - will be used until you object to the processing. You can unsubscribe through the link at the end of our emails or send us a request.
Information security measures
Privacy is a constant concern at Plooral. With the goal of delivering a complete and efficient platform to the market, we adopt best practices to prevent incidents involving the data entrusted to us.
We ensure that data is processed with confidentiality, security, and integrity, within the limits of our responsibilities. Our team is also trained to handle personal data ethically and securely, including by signing confidentiality commitments.
Data processed between individuals and companies that are Platform users is their sole responsibility. We will apply the technical measures needed to keep the virtual environment secure, but we cannot be held responsible for the user's own decisions.
Will data be shared with third parties?
Plooral will share your data with third parties in the following situations:
- Corporate succession, such as mergers, acquisitions, and incorporations, maintaining the purposes and minimum conditions of security and legitimacy.
- Engagement of third-party data processing services (processors), such as data hosting, processing systems (cloud computing, artificial intelligence for process efficiency), information technology consulting, advertising and marketing services, credit billing (financial) services, and legal advisory services.
- In order to expand networking and our services, we may share personal data with business partners, especially when you voluntarily provide information in projects and/or programs with our partners.
These third parties will have no direct interest in the information and will always act under Plooral's guidance. Plooral will require them to adopt the care needed to ensure the same level of protection for your data.
Plooral may be required to share personal data with competent authorities - judicial, administrative, or law enforcement - to comply with legal obligations. We will only share information after proper validation of the order.
International data transfers
Some direct and indirect data processors, such as data hosting services, may be located outside Brazil. We ensure compliance with the legal requirements of personal data protection rules, in particular by requiring third parties to accept the Information Security and Personal Data Protection Terms.
| Provider | Country | Purpose | Transfer mechanism | Safeguards implemented |
|---|---|---|---|---|
| Google Cloud | United States | Cloud infrastructure | Art. 33, I of the LGPD | ANPD standard contractual clauses: https://cloud.google.com/sccs/br-c2p?hl=pt-br |
| Amazon Web Services (AWS) | United States | Cloud infrastructure | Art. 33, II, "d" of the LGPD | 1. Data Processing Agreement (DPA): https://aws.amazon.com/service-terms/ 2. Certifications: ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3 Type II, CSA STAR Level 2, PCI DSS Level 1. https://aws.amazon.com/pt/compliance/programs/ and https://aws.amazon.com/pt/compliance/iso-certified/ |
| Microsoft Azure | United States | Cloud infrastructure | Art. 33, II, "d" of the LGPD | 1. Data Processing Agreement (DPA): https://www.microsoft.com/licensing/docs/view/microsoft-products-and-services-data-protection-addendum-dpa?lang=24 2. Certifications: ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3 Type II, CSA STAR Level 2, PCI DSS Level 1. https://docs.microsoft.com/en-us/azure/compliance/ |
Cookies
Cookies are small files installed in your browser so we can better understand your preferences and improve our services. Plooral uses necessary, functional, analytical, and performance cookies.
You can manage your preferences for certain cookies and/or disable them at any time through your browser. In those cases, some website and platform features may not operate fully.
To manage your cookie preferences, access the cookie notice in the lower-left corner of our website right after you open it.
Data subject rights
The Brazilian General Data Protection Law provides several guarantees to data subjects. Some of those rights are listed below:
- Right to confirmation that data is being processed;
- Right to access information about the processing;
- Right to rectification of your data;
- Right to data portability, if and when applicable;
- Right to object to the use of data for a previously authorized purpose;
- Right to deletion of data, except for data that must be kept to comply with a legal duty or to exercise the right of defense in a judicial and/or administrative proceeding.
How Plooral handles deletion requests: Plooral acts as a processor of personal data, performing technical processing under the instructions of the hiring companies (controllers). Each hiring process is an independent processing activity, and the controller company decides on deletion, blocking, or anonymization of the data used in that process.
When a data subject requests deletion of personal data, Plooral will handle the request in a unified way, closing the account and stopping active processing under its responsibility, keeping only the minimum records required by law for as long as needed to comply with legal and contractual obligations and/or to protect rights.
If there are applications in progress, full deletion of the data will be assessed together with the controller companies involved, observing the applicable legal bases and the balance between the data subject's rights and the parties' contractual obligations.
Data shared in previous applications remains under the responsibility of the respective controller companies, as authorized by the data subject at the time of the application. To exercise rights regarding that data, the data subject should contact the companies listed in the Applications panel of their account before the account is closed.
Plooral will only technically delete application data upon formal authorization from the controller company, keeping a traceable record of every step of the process.
Contact
If you still have questions or need clarification about privacy and data protection, contact our data protection officer at dpo@plooral.com.
Data protection officer: Ramon Hoshino
dpo@plooral.comLast updated: March 10, 2026.