Reqlut, contact email privacidad@reqlut.com, acts as the Data Controller of the personal data processed on the Platform and determines the purposes and essential means of the processing.
When a company accesses a candidate's data through a selection process, that company acts as an independent controller with respect to the information it collects and processes for its own recruitment purposes.
Depending on the category of data subject, the following may be processed, among others: identification and contact data; academic information; professional and employment information; CV; application history; results of technical or psychometric assessments; and browsing information associated with use of the Platform. For Company Users, the organization's identification data and the contact details of its representatives are processed.
Personal data will be processed exclusively to: promote employability and professional development; manage applications and selection processes; facilitate mentoring and networking; generate aggregated and anonymized institutional reports; administer employer company accounts; and improve the security and functionality of the Platform. Personal data will not be sold.
Processing is carried out with the prior, express and informed authorization of the data subject, obtained at the time of registration on the Platform through acceptance of the Terms and Conditions and of this Privacy Notice, or on any other legal basis recognized by the applicable legislation of the relevant country. The data subject may withdraw their authorization at any time, unless a legal or contractual duty prevents erasure.
Reqlut implements appropriate technical, administrative and organizational measures to guarantee the security, confidentiality and integrity of the information. To provide the service, Reqlut relies on sub-processors, in particular cloud infrastructure providers. Those sub-processors process the data solely on behalf of and under the instructions of the Data Controller, without acquiring autonomous powers over the personal data.
The data subject may exercise their rights of Access, Rectification, Cancellation/Erasure and Objection (and any additional rights recognized by local legislation, such as portability and restriction), as well as withdraw the authorization granted, in accordance with the procedure and time limits described in the Regulatory Annex of the relevant country. Access to personal data is free of charge.
Requests to exercise rights must be addressed to the contact channel indicated in Section 1 according to the category of data subject. Response times for inquiries and complaints are those established by each country's legislation and are detailed in the corresponding Regulatory Annex. Where it is not possible to handle the request within those time limits, the interested party will be informed of the reasons for the delay and of the date on which a response will be given.
For the proper provision of the technology service, personal data may be transmitted to and stored on technology infrastructure operated by Amazon Web Services (AWS), located in the United States of America (US-East region) and in the Federative Republic of Brazil (São Paulo region). Such international transmission is carried out within the applicable contractual framework and in accordance with the international transfer regime of each country's legislation, detailed in the corresponding Regulatory Annex, ensuring that processing is performed exclusively on behalf of and under the instructions of the Data Controller, under adequate standards of security, confidentiality and integrity. AWS acts as a sub-processor, without acquiring autonomous powers over the personal data.
Personal data will be retained while an active relationship with the Platform exists and for the term of the contract between the Institution and Reqlut. Once the contractual relationship ends, the data will be returned or deleted in accordance with the Data Controller's instructions and the applicable regulations, unless there is a legal duty to retain it.
Reqlut applies technical and organizational measures that are reasonable and proportionate to the risk, including access control, encryption in transit and at rest, activity logging and incident management procedures.
In the event of a security incident affecting personal data, Reqlut, in its capacity as Data Controller, will notify the competent supervisory authority in accordance with applicable legislation, within the legal time limits.
The competent authority for personal data protection is the one indicated in the Regulatory Annex of the relevant country. The data subject may turn to that authority whenever they consider their right to personal data protection has been infringed.
This Privacy Notice takes effect upon publication and may be updated when necessary to adapt it to regulatory or institutional changes. Any substantial modification will be communicated to data subjects in a timely manner.
Version: 2026-06
