This Privacy Policy explains how Jobzem collects, uses, stores, shares and protects personal data when you access or use our websites, applications, job search tools, accounts, resume and cover letter features, professional profiles, Talents page, Premium subscriptions and other features offered under the Jobzem brand.

This Policy should be read together with our Terms of Use and, where applicable, our Cookie Policy. Certain practices may vary depending on the country, applicable law, features used, technical configuration of the service and choices made by the user.

1. Scope and commitment to privacy

We seek to process personal data in a transparent, proportionate manner and in accordance with legitimate and disclosed purposes. We apply principles of necessity, data minimization, purpose limitation, security, accountability, privacy by design and, where appropriate, privacy by default.

This Policy covers data provided directly by users, data received from authentication services or other providers, data generated during use of the service, technical information and data necessary for security, fraud prevention, measurement, personalization, operation and improvement of the platform.

Where local laws grant additional rights or impose specific requirements concerning transparency, consent, objection, deletion, portability or control, we will apply those requirements to the extent legally applicable to the relevant processing activity.

2. Controller and parties responsible for processing

For processing activities where it determines the essential purposes and means, the entity responsible for operating Jobzem acts as the controller of personal data. The controller's full legal identity, business address and official contact channels should be made available in Jobzem's institutional information and/or contact page.

Before final publication of this Policy, Jobzem should complete this section with the legal name of the controller, its business address and a specific privacy contact channel, where applicable.

Providers that process data on our behalf — such as hosting, infrastructure, email, security, analytics, support or other service providers — may act as processors or service providers. In certain situations, some providers, such as authentication, advertising or payment providers, may also act as independent controllers for processing activities they determine themselves.

Where applicable law requires the appointment of a data protection officer (DPO), local representative or similar role, the relevant contact details will be made available in this Policy, on the contact page or in the applicable regional notice.

3. Data we collect

Depending on the features used, we may process the following categories of data:

• Registration and identification data: name, professional name, photograph, email address, account identifiers and other information necessary to create and manage access.
• Authentication data: protected credentials, tokens, session identifiers, login records and information necessary for account security. When a password is created directly with Jobzem, it should be stored using appropriate protection mechanisms and not in plain text.
• Data received from login providers: identifiers and basic information authorized by the user when using services such as Google or LinkedIn. Jobzem does not receive the password used with those services.
• Location data: country, region, city or approximate location, depending on how the information is obtained and the feature being used.
• Professional data: profession, job title, title, personal summary, skills, languages, services offered, experience, education and other information related to the user's professional background.
• Resume and cover letter data: information entered into CVs, resumes, cover letters, documents or professional fields created, imported, edited or stored on Jobzem.
• Contact data: telephone number and other information provided for account, resume, professional contact or support purposes. These data are not automatically public.
• Usage data: pages viewed, searches, search terms, filters, jobs opened, clicks, favorites, interactions, language, traffic source, date, time and events related to use of the service.
• Technical data: IP address, device type, browser, operating system, technical identifiers, cookies, session data and security logs.
• Subscription and transaction data: plan, amount, currency, billing and renewal dates, subscription status, payment status, customer, subscription, charge or transaction identifiers, as well as invoice and receipt references.
• Communication data: content and metadata of messages, professional proposals, support requests, reports and forms submitted through the platform.

Jobzem does not require a residential address as a condition for creating an account.

We also do not require special categories or sensitive personal data as a normal condition for using the core features. Avoid entering information concerning health, racial or ethnic origin, religion, political opinions, trade union membership, sex life, biometrics, genetic data or other sensitive categories in free-text fields or documents unless strictly necessary and legally appropriate.

4. Registration and authentication

Registration may be completed using email and password or, where available, through external providers such as Google and LinkedIn.

When you use third-party login, we receive only the information made available by the relevant provider in accordance with the permissions granted by the user and the configuration of the integration. This may include account identifier, name, email, photograph or other authorized basic information.

Jobzem does not receive or store the password used by the user with Google, LinkedIn or another external provider.

Revoking an integration with the external provider does not automatically delete data already lawfully retained by Jobzem to manage the account, comply with legal obligations, preserve security, prevent fraud or rely on another applicable legal basis.

5. Location

Jobzem may collect or associate location information with registration and the use of certain features. Depending on the technical implementation and user choice, this information may correspond to country, region, city or approximate location.

Location may be used to personalize searches and results, rank opportunities, present regional content, provide country-specific experiences, detect suspicious behavior and understand how the platform operates.

Collection of location information does not mean that a residential address is required. Technical or internal location information is not automatically published in the profile.

If a city or other professional location forms part of the public profile, its display will follow the user's visibility choices described in the next section.

6. Professional profile, CV and Talents page

6.1. Private account and resume data

Information stored in the account or used to create a resume is not automatically public. Users may enter experience, education, skills, profession, location, telephone number, presentation text and other information useful to their CV or profile.

The full resume file, when stored as an account feature, is not intended for automatic public publication unless a specific feature expressly states otherwise.

Email, telephone number and residential address are not intended for standard public display on the professional profile. Jobzem does not require a residential address during registration.

6.2. Public profile

Users may enable or disable public visibility of their professional profile. When the public profile is enabled, certain professional information may be displayed even to visitors who do not have a Jobzem account.

Depending on the information completed and the available settings, the public profile may display name, photograph, profession or title, city or professional location, "About me" section, experience, education, skills, languages, services offered and other professional information intended for display.

By enabling the public profile, the user requests that Jobzem make this information accessible for professional visibility, recruitment, networking and discovery by companies, recruiters, other users and visitors.

Even where certain data are public or have been made public by the data subject, we continue to process them in accordance with applicable law, disclosed purposes and data protection principles.

Users are responsible for avoiding the inclusion in public fields of information they do not wish to make accessible, such as email, telephone number, residential address, personal documents, financial information, confidential information or sensitive data.

6.3. Talents page and individual URL

Public profiles may appear on the "Talents" page, in Jobzem's internal searches and filters, and on an individual page with its own URL.

Depending on Jobzem's technical configuration and the operation of external search engines, public pages may be indexed by search engines or temporarily stored in caches. Jobzem does not fully control how quickly third parties update or remove previously indexed copies.

When a user disables the public profile, Jobzem will stop making it publicly available on the platform after the necessary technical processing. Deactivation does not guarantee immediate removal of copies previously indexed or stored by third parties.

Disabling the public profile does not mean deleting the account or automatically erasing all personal data. Deletion requests are handled in accordance with this Policy and applicable law.

7. Professional contacts and moderation

Jobzem may provide forms or tools that allow companies, recruiters or other interested parties to send professional proposals or messages to users with a public profile.

To provide this feature, we may process sender information such as name, company, email, subject, proposal category, message and other information submitted through the form, as well as information necessary to route the communication to the user.

Messages and proposals may be subject to automated or manual moderation, security, spam prevention, fraud prevention and abuse controls. This may involve analyzing the content and technical signals to identify suspicious behavior or violations of service rules.

We do not recommend sharing sensitive data, excessive documentation, banking information or credentials with senders whose identity and legitimacy have not been verified.

8. Subscriptions, payments and Stripe

Jobzem uses specialized payment providers, including Stripe, to process payments and technically manage payment methods used for Premium subscriptions.

Jobzem does not directly store complete sensitive card data, such as the full card number, CVV/CVC security code or equivalent credentials used to authorize a transaction.

These data are collected, processed and protected by Stripe or the responsible payment provider according to its own terms, privacy policies and security standards.

To manage subscriptions, confirm payments, process cancellations, prevent fraud, provide support and comply with legal obligations, Jobzem may receive or store transaction data such as:

• subscribed plan;
• amount and currency;
• billing, renewal and termination dates;
• payment and subscription status;
• customer, subscription, charge or transaction identifiers generated by Stripe;
• invoice, receipt or payment references;
• limited payment method information that the processor may make available for transaction identification, where applicable.

Stripe may act as a service provider or independent controller for certain processing activities it carries out directly. We recommend reviewing the privacy policy and terms of the payment processor used at checkout.

9. Purposes and legal bases

The applicable legal basis depends on the purpose, the user's country and the relevant law. Where the LGPD, GDPR or UK GDPR apply, we seek to link each processing activity to an appropriate legal basis.

Where we rely on legitimate interests, the interests pursued may include protecting accounts and users, preventing fraud, maintaining platform security, improving performance, preventing abuse and operating the service efficiently. We assess these interests against the rights and reasonable expectations of data subjects.

Not all processing depends on consent. Where consent is the legal basis used, it may be withdrawn in accordance with applicable law without affecting the lawfulness of processing carried out before withdrawal.

10. Personalization, AI and automated processing

Jobzem may use searches, location, favorites, interaction history and other signals to rank and recommend jobs or content that may be more relevant to the user.

These processes are intended to organize the user experience within the platform. Jobzem does not make hiring, rejection or candidate selection decisions on behalf of employers.

Certain features may use artificial intelligence or automation to help create or improve resumes, cover letters, professional text or other tasks requested by the user. Generated content should be reviewed by the user before use.

Where a decision is based solely on automated processing and produces legal effects or significantly affects the data subject, and applicable law grants specific rights, we will provide the information and review mechanisms required by law.

11. Data sharing

We share personal data only to the extent necessary to operate the service, fulfill user requests, comply with legal obligations or achieve the purposes described in this Policy.

11.1. Service providers

We may use providers for hosting, infrastructure, email, notifications, analytics, security, fraud prevention, support, authentication, advertising and payments. These providers may process data as necessary to provide their services and are subject to applicable legal, contractual and security obligations.

11.2. Data made public by the user

When the user enables a public profile, the professional data configured for display are made available to visitors, companies, recruiters, other users and, potentially, search engines and services that access public internet pages.

Enabling a public profile does not make all data held by Jobzem public.

11.3. Companies and recruiters

Jobzem may facilitate communications between users and companies or recruiters. Sharing will depend on the feature used and the information made public or otherwise provided by the user in the context of the communication.

11.4. Authorities and protection of rights

We may disclose data when necessary to comply with law, a court order or a valid request from a competent authority, prevent fraud, investigate incidents, protect rights or preserve the security and integrity of the service.

11.5. Corporate transactions

In the event of a merger, acquisition, reorganization, sale of assets or similar transaction, data related to the service may be transferred to a successor, subject to applicable data protection obligations and required notices.

12. Cookies, sessions, analytics and advertising

Jobzem may use cookies, local storage, identifiers, pixels and similar technologies for authentication, security, fraud prevention, website operation, preference storage, analytics, traffic attribution and advertising, where applicable.

When the user enables the "Remember me" option, we may use a persistent cookie, token or equivalent technology to keep the session active on that browser or device for up to 6 (six) months, unless the session ends earlier, the credential is removed, the password is changed, a security risk is identified or another situation requires re-authentication.

When "Remember me" is not enabled, authentication may operate only for the current session and may end after the browser is closed or according to the applicable technical session rules.

Strictly necessary cookies may be used without consent where permitted by law. Analytics cookies, advertising cookies and other non-essential technologies are handled in accordance with consent or opt-out requirements in the applicable jurisdiction.

Jobzem may use Google Tag Manager, Google Analytics, Google Ads, Google AdSense or other Google and third-party services when those integrations are enabled on the platform. The actual use of each product must correspond to the technical configuration that is in fact deployed.

Where personalized advertising, cross-context behavioral advertising or other activities are legally classified as a "sale," "sharing," targeted advertising or similar regulated activity under a U.S. state privacy law, Jobzem will provide the transparency and opt-out mechanisms required by applicable law.

The Cookie Policy should identify the providers actually used, cookie categories, purposes, duration and control options. The consent banner or preference manager should technically reflect the user's choices before non-essential technologies are activated where required by law.

13. Third-party services and websites

Jobzem contains links to external websites and may integrate third-party services, including Google, LinkedIn, Stripe and providers of analytics, advertising, hosting, security or other features necessary for the operation of the platform.

When you click a job listing and leave the Jobzem domain, processing performed by the destination website is also governed by that third party's privacy policy, cookie policy and terms.

Jobzem does not fully control the privacy practices of external websites. Before providing personal data, documents or financial information, we recommend reviewing the destination's policies.

Authentication, advertising and payment providers may act as independent controllers for certain processing activities performed according to their own criteria and obligations.

14. International data transfers

Because Jobzem operates internationally and uses providers and infrastructure that may be located in different countries, personal data may be stored, accessed or processed outside the user's country of residence.

Where the LGPD applies, international transfers will be carried out in accordance with mechanisms permitted by law and regulations of Brazil's National Data Protection Authority (ANPD), including, where appropriate, adequacy decisions, standard contractual clauses, approved specific contractual clauses, binding corporate rules or other legally authorized mechanisms.

Where the EU or EEA GDPR applies, we may use European Commission adequacy decisions, European Union Standard Contractual Clauses and appropriate supplementary measures, as necessary.

Where the UK GDPR applies, we may use UK adequacy regulations, the International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses or another mechanism recognized under UK law.

The mechanisms actually used depend on the provider, destination country, nature of the transfer and applicable legal regime. Additional information may be requested through Jobzem's privacy channels.

15. Security and retention

15.1. Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or improper destruction. These measures may include encryption in transit, credential protection, access controls, segregation of duties, security logging, monitoring and abuse-prevention mechanisms.

No internet-connected system provides absolute security. We may apply additional measures such as ending sessions, resetting credentials, restricting access, blocking activity or using other controls when a relevant risk is identified.

15.2. Retention

We retain personal data for the period necessary to fulfill the purposes described in this Policy, provide the service, protect the platform, comply with legal obligations, resolve disputes and exercise rights.

Account data may be retained while the account remains active. Logs and technical records may be retained for periods appropriate to security, fraud prevention and auditing. Financial and transaction data may be retained for periods required by tax, accounting, contractual or regulatory obligations.

When the user requests deletion and the request applies, we remove, block or anonymize data from active systems, except where information must or may be retained because of legal obligations, the exercise or defense of rights, fraud prevention, security or another authorized basis.

Residual copies may temporarily remain in backups until normal replacement and deletion cycles are completed.

16. Rights in Brazil — LGPD

Where Brazil's General Data Protection Law (LGPD) applies, data subjects may exercise rights provided by law and applicable regulations, including:

• confirmation of whether processing exists;
• access to personal data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability, subject to applicable regulation;
• information about entities with which data have been shared;
• information about the possibility of refusing consent and the consequences of doing so, where applicable;
• withdrawal of consent;
• deletion of data processed on the basis of consent, subject to legal exceptions;
• objection to processing carried out in violation of the LGPD;
• review of decisions made solely on the basis of automated processing that affect the user's interests, where applicable.

The data subject may also submit a complaint to Brazil's National Data Protection Authority (ANPD), subject to the procedures made available by the authority.

17. Rights in the European Economic Area — GDPR

Where the European Union General Data Protection Regulation (GDPR) applies, data subjects may have the following rights, depending on the circumstances:

• access to personal data;
• rectification of inaccurate data;
• erasure in situations provided by law;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests;
• objection to direct marketing at any time;
• withdrawal of consent where processing is based on consent;
• rights relating to solely automated decisions, where applicable;
• the right to lodge a complaint with the competent supervisory authority.

Where Jobzem is not established in the European Economic Area but is subject to the GDPR because it offers services to or monitors the behavior of individuals in the EEA, it may be necessary to appoint a representative in the European Union under the conditions provided by law. If that obligation applies, the representative's details should be published in this Policy.

18. Rights in the United Kingdom — UK GDPR

Where the UK GDPR and UK data protection law apply, data subjects may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent and rights relating to automated decision-making, as provided by applicable law.

Users may also lodge a complaint with the Information Commissioner's Office (ICO), where applicable.

If Jobzem is subject to the UK GDPR without being established in the United Kingdom and there is a legal obligation to appoint a UK representative, the details of that representative should be made available in this Policy.

19. Rights in California and other U.S. states

Certain U.S. state privacy laws, including California law where applicable to Jobzem and the user, may provide additional rights.

Depending on the applicable law, these rights may include:

• the right to know or confirm which categories and specific pieces of personal information are processed;
• the right to request access to or a copy of data;
• the right to request correction of inaccurate information;
• the right to request deletion, subject to legal exceptions;
• the right to obtain information about categories of sources, purposes and recipients;
• the right to opt out of certain forms of sale, sharing, targeted advertising or cross-context behavioral advertising where those legal definitions apply;
• the right to limit certain uses of sensitive personal information where provided by law;
• the right not to receive discriminatory treatment for exercising privacy rights.

Jobzem should not state that it "does not sell" or "does not share" personal information within the technical meaning of U.S. state laws unless that statement accurately reflects the integrations actually in use. If advertising, analytics or other provider configurations legally constitute a sale, sharing or targeted advertising, we will provide an appropriate notice and opt-out mechanism, such as a "Your Privacy Choices" link or equivalent.

Where legally required and technically supported, we may also recognize universal opt-out signals or mechanisms provided for by applicable law.

20. Children and minors

Jobzem is primarily intended for individuals seeking professional opportunities and is not designed as a service directed to children.

Minimum age requirements and rules applicable to processing minors' data vary by country. Where the law requires parental consent, representation, a best-interests assessment or other special protections, the processing must comply with those requirements.

If you believe that data relating to a child or minor have been provided or published improperly, please contact us so that we can assess the situation and take appropriate measures.

21. How to exercise your rights

To exercise privacy rights, use our Contact Page and clearly identify the request you wish to make.

We may request information reasonably necessary to verify the identity of the requester, protect the account and prevent improper disclosure, deletion or alteration of another person's data.

We will respond within the timeframes required by applicable law. Some requests may be limited or denied where there is a legal retention obligation, a need to protect third-party rights, fraud-prevention or security concerns, or another legal exception. Where required, we will explain the reason for the limitation or denial.

In addition to formal requests, users can use controls directly available on the platform, such as profile editing, alert management, communication preferences, cookie settings and enabling or disabling the public profile.

22. Changes and contact

22.1. Changes to this Policy

We may update this Policy to reflect changes to services, features, technologies, processing practices, providers, legal requirements or security measures.

The "Last updated" date identifies the current version. Material changes that significantly affect how we process personal data or users' rights may be communicated through a notice on the site, in the account, by email or through another appropriate channel.

Where the law requires renewed consent or a specific choice for a new or materially different purpose, we will obtain the relevant indication before beginning processing that depends on that legal basis.

22.2. Contact

Questions about this Policy, requests relating to personal data, requests for access, correction, deletion, objection, portability, withdrawal of consent or other privacy matters may be submitted through our Contact Page.

To help us process the request, provide enough information to locate the account, such as the registered email address, without sending your password, full card number, CVV/CVC or other unnecessary sensitive information.