Privacy Policy

InPlanet (“InPlanet", "we", "us" or “our”) is committed to protecting and respecting the  privacy and personal data of candidates, applicants, prospective candidates and individuals who participate in our recruitment processes.

This Recruitment Privacy Policy explains how we collect, use, disclose, retain, transfer and protect personal data in connection with recruitment, hiring, talent sourcing, candidate evaluation and related pre-contractual activities.

We use Pinpoint, an online software product provided by The Infuse Group Ltd (t/a Pinpoint Software), to assist with our recruitment process. We use Pinpoint to process personal information as a data processor on our behalf. Pinpoint is only entitled to process your personal data in accordance with our instructions

Where you apply for an opportunity posted by us, these Privacy Notice provisions will apply to our processing of your personal information, in addition to our other Privacy Notice which is available on our website.

This Policy is intended to comply, as applicable, with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, the Brazilian Lei Geral de Proteção de Dados Pessoais – Law No. 13,709/2018 (“LGPD”), applicable United States privacy and employment laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and InPlanet’s internal confidentiality, data protection and non-disclosure standards.

2. Controller and Data Protection Contacts
For purposes of the GDPR, UK GDPR and LGPD, the controller of your personal data is InPlanet, unless otherwise stated in a specific recruitment notice.

For Brazil, InPlanet acts as the “controlador” under the LGPD. Pinpoint and other service providers engaged to support the recruitment process act as “operadores” or processors, as applicable, when they process personal data on InPlanet’s behalf and under InPlanet’s instructions.

3. Role of Pinpoint and Other Service Providers

We use Pinpoint to support our recruitment process, including receiving applications, managing candidate pipelines, communicating with candidates, storing recruitment records and assisting with candidate evaluation.

Pinpoint processes personal data on InPlanet’s behalf and only in accordance with InPlanet’s documented instructions, applicable data protection laws and contractual confidentiality obligations.

Pinpoint and any other processor, operator, subprocessor or service provider engaged in the recruitment process must:

a. process personal data solely for the purposes authorized by InPlanet;

b. not use personal data for its own independent commercial purposes, including benchmarking, resale, advertising, enrichment databases, model development, artificial intelligence training, analytics unrelated to the services, or product improvement using identifiable personal data, unless expressly authorized by InPlanet in writing and permitted by applicable law;

c. implement appropriate technical and organizational security measures;

d. restrict access to personnel and representatives with a genuine need to know;

e. ensure that all personnel and subprocessors are bound by confidentiality obligations at least equivalent to those applicable to InPlanet;

f. assist InPlanet with data subject requests, regulatory inquiries, security incidents, audits, data protection impact assessments and legal compliance obligations;

g. return or delete personal data upon InPlanet’s request or upon termination of services, except where retention is legally required; and

h. notify InPlanet of any actual or suspected personal data breach or security incident.

4. Confidential Information and Confidentiality Treatment

For purposes of this Policy, “Confidential Information” means any non-public information, data, documents, records, communications or materials disclosed, accessed, collected, generated, stored or otherwise processed in connection with InPlanet’s recruitment process, regardless of form or medium, whether oral, written, electronic, digital, visual, tangible or intangible.

Confidential Information includes, without limitation:

a. candidate personal data, application materials, resumes, CVs, cover letters, portfolios, interview records, assessments, evaluation notes, references, background check information, compensation expectations and recruitment communications;

b. information relating to InPlanet’s recruitment strategy, hiring needs, internal evaluations, role requirements, compensation bands, interview feedback, selection criteria, decision-making processes and workforce planning;

c. personal data, sensitive personal data, special category data, professional information, employment history, education data, immigration or right-to-work information, diversity information, accommodation information and any other information relating to an identified or identifiable candidate;

d. information relating to InPlanet’s affiliates, subsidiaries, employees, officers, representatives, contractors, service providers, recruitment partners or candidates;

e. technical, operational, commercial, legal, financial, strategic or business information accessed in connection with recruitment activities; and

f. any notes, analyses, compilations, summaries, reports, outputs, rankings, profiles, scores, models or other derivative materials that contain, reflect or are generated from Confidential Information.

Confidential Information shall be protected regardless of whether it is marked, labeled or otherwise identified as confidential.

InPlanet, Pinpoint and any other processor, operator, subprocessor, service provider, representative or person with access to Confidential Information must:

a. use Confidential Information solely for the authorized recruitment, hiring, compliance, legal, security and administrative purposes described in this Policy;

b. not disclose Confidential Information to any third party except where necessary for the recruitment process, legally required, authorized by InPlanet or otherwise permitted under this Policy;

c. restrict access to Confidential Information to personnel, representatives, processors, operators and service providers with a genuine need to know;

d. ensure that any person or entity with access to Confidential Information is bound by confidentiality and data protection obligations at least equivalent to those set out in this Policy;

e. protect Confidential Information using appropriate technical and organizational measures and, in any event, no less than a commercially reasonable standard of care;

f. not use Confidential Information for benchmarking, resale, advertising, enrichment databases, model development, artificial intelligence training, product improvement, analytics unrelated to the services, competitive purposes or any other purpose not expressly authorized by InPlanet;

g. not create unauthorized derivative materials, databases, profiles, models, rankings, scores, analytics or outputs from Confidential Information;

h. remain responsible for breaches, unauthorized disclosures or misuse of Confidential Information by personnel, representatives, processors, operators, subprocessors or service providers acting on their behalf;

i. return, delete or certify deletion of Confidential Information upon InPlanet’s request or upon termination of the relevant services, except where retention is required by applicable law; and

j. notify InPlanet promptly, and in any event within forty-eight (48) hours, after becoming aware of any actual or suspected unauthorized access, disclosure, loss, misuse, security incident or breach involving Confidential Information.

If disclosure of Confidential Information is required by law, regulation, court order or competent authority, the disclosing party or service provider must, to the extent legally permitted, provide prior written notice to InPlanet, disclose only the minimum information legally required, seek confidential treatment where appropriate and reasonably cooperate with InPlanet to protect the information.

5. Personal Data We Collect Directly From You

We may collect and process the following categories of personal data directly from you:

a. identification data, such as name, surname, preferred name, date of birth and nationality;

b. contact data, such as email address, telephone number, address and country of residence;

c. application data, such as CV/resume, cover letter, portfolio, references, application forms, interview notes and information submitted through recruitment platforms;

d. professional and educational data, such as employment history, qualifications, degrees, certifications, skills, languages, work experience, professional memberships and career preferences;

e. recruitment communication data, including emails, messages, interview scheduling records and correspondence with InPlanet;

f. interview and assessment data, including interview feedback, technical assessments, written exercises, evaluation notes and candidate scoring, where applicable;

g. right-to-work and immigration-related data, where relevant and legally permitted;

h. compensation and benefits expectations, notice period, availability and work location preferences;

i. equal opportunity or diversity data, where voluntarily provided and legally permitted;

j. disability, accommodation or accessibility-related information, where necessary to provide reasonable accommodation and only where legally permitted;

k. website and technical data relating to visits to our careers pages, including traffic data, log data, device data, browser data, location data, referral source and interaction with recruitment pages; and

l. any other information you voluntarily provide to us during the recruitment process.

6. Personal Data We Collect from other sources

We may collect personal data from third-party sources where legally permitted and relevant to recruitment. These sources may include:

a. professional networking platforms, such as LinkedIn;

b. publicly available professional profiles, websites, publications, conference pages or professional directories;

c. recruitment agencies, referrals, references or former employers, where legally permitted;

d. educational institutions or certification bodies, where verification is necessary and legally permitted;

e. publicly available databases or professional talent databases used to identify potential candidates; and

f. background check providers, only where required or permitted by law and subject to additional notice and authorization where applicable.

Where we collect personal data from sources other than you, we will provide the information required by applicable law, unless an exemption applies. We will not intentionally collect sensitive personal data from social media or public sources unless strictly necessary, legally permitted and proportionate for the recruitment process.

7. Sensitive Personal Data

We may process sensitive or special category personal data only where legally permitted and necessary for a specific recruitment-related purpose.

Sensitive personal data may include information relating to health, disability, racial or ethnic origin, union membership, biometric data, criminal history, immigration status or other categories protected under applicable law.

We will process sensitive personal data only where:

a. you have provided explicit consent, where required;

b. processing is necessary to comply with employment, social security, labor, tax or legal obligations;

c. processing is necessary to provide reasonable accommodation;

d. processing is necessary to establish, exercise or defend legal claims;

e. processing is required or authorized by applicable law; or

f. another lawful basis applies under GDPR, UK GDPR, LGPD or applicable US law.

We will not use sensitive personal data for discriminatory purposes, unauthorized profiling, advertising, resale, commercial enrichment or unrelated purposes.

8. Purposes of processing

We process candidate personal data for the following purposes:

a. receiving, reviewing and managing job applications;

b. assessing qualifications, skills, experience and suitability for a role;

c. communicating with candidates during the recruitment process;

d. scheduling interviews and assessments;

e. conducting interviews, tests, technical reviews and candidate evaluations;

f. verifying information provided by candidates, where legally permitted;

g. considering candidates for current or future roles;

h. maintaining a candidate talent pool, where legally permitted;

i. conducting equal opportunity, diversity and inclusion monitoring, where legally permitted and preferably on an aggregated or anonymized basis;

j. complying with legal, regulatory, tax, immigration, employment and corporate governance obligations;

k. preventing fraud, conflicts of interest, security risks and unlawful conduct;

l. protecting InPlanet’s rights, confidential information, systems, personnel and operations;

m. responding to data subject requests, complaints, disputes, legal claims or regulatory inquiries;

n. improving the recruitment process, provided that any analytics or improvement activities are conducted in accordance with applicable law and, where possible, using aggregated or anonymized data; and

o. administering recruitment systems and ensuring information security.

We may use recruitment technology, including Pinpoint features, to help organize applications, identify relevant skills, compare candidates against role criteria, manage workflows and support recruitment decisions.

We do not make final hiring decisions based solely on automated processing that produces legal or similarly significant effects without meaningful human involvement.

Any automated matching, ranking, filtering, scoring or profiling must be subject to appropriate safeguards, including:

a. human review before final hiring or rejection decisions;

b. use of role-relevant, proportionate and non-discriminatory criteria;

c. reasonable steps to reduce bias, inaccuracy and discriminatory effects;

d. the ability for candidates to request human review, where applicable;

e. the ability for candidates to correct inaccurate data; and

f. meaningful information about the logic, significance and expected consequences of such processing where required by law.

9. Recipients and Disclosure of Personal Data

We may disclose candidate personal data to the following categories of recipients, only where necessary and legally permitted:

a. InPlanet employees, officers, directors, contractors and representatives involved in recruitment;

b. InPlanet group companies, affiliates or subsidiaries;

c. recruitment platforms, including Pinpoint;

d. IT, hosting, cloud, cybersecurity and administrative service providers;

e. recruitment agencies, interviewers, assessment providers or professional advisors;

f. background check providers, only where applicable and subject to additional notice and authorization;

g. legal, tax, accounting, audit and compliance advisors;

h. public authorities, regulators, courts or government agencies where legally required; and

i. other third parties where authorized by the candidate or required by law.

All recipients must process personal data under appropriate confidentiality, security and data protection obligations.

10. Confidentiality

All candidate personal data, recruitment records, application materials, evaluation notes, interview feedback, assessment results, communications and any other information collected, accessed, generated or processed in connection with InPlanet’s recruitment process shall be treated as Confidential Information under Section 4 of this Policy.

11. International Transfer

Candidate personal data may be transferred to, accessed from or stored in countries other than the country where the candidate is located.

Data processed through Pinpoint may be stored in data centers located in Amsterdam, Netherlands, and may be synchronized to data centers located in London, United Kingdom, for backup and redundancy purposes. Other service providers may process data in additional locations only where authorized and subject to appropriate safeguards.

Where personal data is transferred internationally, we will implement safeguards required by applicable law.

12. Retention of Personal Data

We retain candidate personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Unless a shorter period is required by local law or a specific request is accepted, candidate data may be retained for up to forty-eight (48) months from the date of application or the last meaningful interaction with the candidate.

Upon expiry of the applicable retention period, personal data will be deleted, anonymized or securely archived in accordance with applicable law and InPlanet’s retention standards.

Information retained in backups due to technical requirements will remain protected and subject to confidentiality and security obligations until deletion becomes technically feasible in the ordinary backup lifecycle.

13. Security and Personal Data Breaches

We implement appropriate technical and organizational measures designed to protect candidate personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, misuse and other unlawful processing.

Any processor, operator, subprocessor, service provider or representative that becomes aware of an actual or suspected personal data breach, security incident, unauthorized access, misuse, loss or disclosure involving candidate personal data must notify InPlanet without undue delay and, in any event, within forty-eight (48) hours of becoming aware of the incident.

InPlanet will assess whether notification to candidates, regulators, authorities or other third parties is legally required and will make such notifications in accordance with applicable law.

14. Data Subject Rights

Depending on your location and applicable law, you may have rights to:

a. confirm whether we process your personal data;

b. access your personal data;

c. request correction of inaccurate, incomplete or outdated data;

d. request anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;

e. request deletion of personal data processed on the basis of consent, where applicable;

f. request restriction of processing;

g. object to processing, including processing based on legitimate interest;

h. request portability of personal data, where applicable;

i. withdraw consent, where processing is based on consent;

j. request information about public and private entities with which data has been shared;

k. request information about the possibility of refusing consent and the consequences of refusal;

l. request review of decisions made solely on the basis of automated processing, where applicable;

m. lodge a complaint with a competent data protection authority; and

n. seek compensation where provided by applicable law.

To exercise your rights, please contact us or use the tools made available through the recruitment platform.

We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.

15. Legally Required Disclosure
If we are required by law, regulation, court order or competent authority to disclose candidate personal data, we will, to the extent legally permitted:

a. provide prior notice to the affected candidate or relevant party where appropriate;

b. disclose only the minimum information required;

c. seek confidential treatment where appropriate; and

d. ensure that the disclosure is documented and legally justified.

Service providers and processors must not disclose InPlanet candidate data to any authority or third party unless legally required or expressly instructed by InPlanet.

16. Complaints

Candidates may contact us using the contact details in Section 2 if they have questions, concerns or complaints about how we process personal data.

Candidates may also lodge complaints with the competent data protection authority, including:

a. the relevant EU supervisory authority, where GDPR applies;

b. the UK Information Commissioner’s Office, where UK GDPR applies;

c. the Brazilian Autoridade Nacional de Proteção de Dados — ANPD, where LGPD applies; or

d. the relevant US state authority, where applicable.

We encourage candidates to contact us first so that we can attempt to resolve any concern directly.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our recruitment practices, legal requirements, technology, vendors or internal standards.

Where required by law, we will provide notice of material changes or obtain consent where applicable.

The effective date of this Policy is: June 25th, 2026.