Privacy Notice for Candidates

1. Goals

The present Privacy Notice for Candidates (“Notice”) aims to provide clear information on how the Personal Data of these individuals are treated by the Grupo QuintoAndar (“Grupo”) in the countries in which it operates, as well as informing their rights as Data Subjects.

2. Scope

The Grupo is committed to fulfill applicable privacy and personal data protection laws and regulations, currently in force or that may come into force in the future (“Data Protection Legislation”), according to the country of operation of the companies belonging to the Grupo, as provided below:

Country	Companies of the Grupo	Applicable Legislation
Argentina	DRIDCO S.A.U.ONELOOP S.R.L. GRUPO NAVENT S.R.L.	Law No. 25,326/2000 (Personal Data Protection Law - PDPA).
Brazil	GRPQA LTDA. MLSP AVALIAÇÃO E CAPACIDADE DE CRÉDITO LTDA. QUINTO CORRETORA DE SEGUROS LTDA.	Law No. 13,709/2018 (General Personal Data Protection Law - LGPD).
Ecuador	BROLOG CÍA LTDA.	Organic Law on Personal Data Protection - Official Registry Supplement No. 459/2021.
Mexico	DRIDCO MEXICO S.A. DE C.V.SOLUSER SOLUCIONES Y SERVICIOS, S.A. DE C.V.TECNOLOGIA PARA INMOBILIARIAS S.A. DE C.V.	Federal Law on the Protection of Personal Data Held by Private Individuals (LFPDPPP) of July 6, 2010.
Panama	ADS PUBLISHER INC.	Lei nº 81/2019 (LawaboutPersonal Data Protection).
Peru	E-HOLDING S.A.C.	Law No. 29,733/2011 (Personal Data Protection Law).
Portugal	BENVI TECNOLOGIA PORTUGAL LDA.	Regulation (EU) 2016/679 (GDPR).
Uruguay	LODIXAR S.A.	Law No. 18,331/2008 (Uruguayan Personal Data Protection Law).

3. Definitions

Anonymization: use of reasonable technical means available at the time of Processing, through which Personal Data loses the possibility of direct or indirect association with an individual;

Controller: natural or legal person, under public or private law, responsible for decisions regarding the Processing of Personal Data;

Personal Data: any and all information related to a natural person that identifies or makes them identifiable, either alone or in conjunction with other information. Examples of Personal Data (but not limited to): name, CPF (Brazilian Individual Taxpayer Registry), identity document, address, telephone number, registration number, position, salary information, and performance evaluations;

Sensitive Personal Data: Personal Data about racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person;

Candidate: any and all persons who have applied or may apply for employment opportunities, for young apprenticeships or internships in the Grupo, regardless of the result obtained in the selection process.

Employee: interns, young apprentices, employees, executives and directors of the Grupo, with a current or terminated employment contract, in the exercise of the professional activities for which they were hired to perform;

Job Posting Platforms: platforms that offer job openings, such as Greenhouse, LinkedIn, Indeed, ZipRecruiter, Monster, Appcast, Blind, Levels.fyi, Nexxt, OfferUp, Ramped, Secret Tel Aviv e X Hiring.

Data Subject: natural person to whom the Personal Data refer; and

Processing: any operation carried out with personal data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

4. Controller of Personal Data

For the purposes of this Notice, the Grupo will act as Controller, that is, responsible for the Processing carried out with the Personal Data of Candidates due to the interest of the Grupo or the individual in their participation in a selection process promoted by the Grupo, even if such Processing operations are carried out by third parties.

5. Processing of Personal Data

The Group only Processes Personal Data that is strictly necessary to achieve specific, legitimate purposes and that are supported by Data Protection Legislation.

1. Collection

The collection of Personal Data necessary for conducting the recruitment process may take place in the following ways:

• Candidate's application for a vacancy available on the Job Posting Platforms: For this type of application, the Grupo requests information necessary for the recruitment process through the use of Job Posting Platforms.
• Nomination of Candidate by an Employee of the Group: For this type of application, the Grupo requests additional information about: (i) how the Employee heard about the Candidate; (ii) whether the Candidate was informed that they were being recommended for the position; (iii) a brief comment about the Candidate; and (iv) whether the Candidate qualifies as a Person with Disabilities. In this case, the Employee is responsible for obtaining authorization to share the Candidate's Personal Data with the Grupo. The Grupo will send a notification to the Candidate's email address, informing them of the recommendation.
• Active search conducted by the Grupo, directly or through third parties hired for this purpose: In cases where the Grupo conducts an active Candidate search, a description will be created on the LinkedIn platform with the necessary characteristics for the position, and, using the platform's available features, a search will be conducted for professionals who meet the requirements. For those selected, the Grupo will send a message through the platform itself or contact them by email to verify their interest in participating in the recruitment process. If interested, the Candidate will follow the same steps applicable to all positions. If there is a negative response, the contact will be terminated and the information will be recorded in our database, to prevent the Candidate from being approached again in another recruitment process and/or in a short period of time.

2. Processing

The Grupo may process the Personal Data and Sensitive Personal Data of Candidates:

• With the consent of the Candidates;
• To comply with the Grupo’s legal and regulatory obligations;
• For preliminary procedures related to the envisaged employment contract; and
• For the regular exercise of the Grupo’s rights in judicial, administrative or arbitration proceedings.

For detailed information on the purposes and categories of Personal Data involved in the Processing carried out by or on behalf of the Group, we recommend consulting the Annex I - Data Processing Purposes, an integral and inseparable part of this Notice.

To ensure that we are being transparent, we have highlighted below some purposes that you may not initially expect, reinforcing that all are carried out in accordance with the Data Protection Legislation:

• Recruitment process indicators: The Grupo informs that the Candidates' Personal Data is also used to populate a chart of key performance indicators (KPIs). This analysis is done in an aggregated manner, that is, the Candidates are not identifiable, and normally concentrates in information about the recruitment process, as the closing time, how many days it was open, total number of subscribers, among others.
• Diversity, Equity and Inclusion (DE&I): The Grupo values ​​the unique contributions of individuals with different identities, characteristics, backgrounds, and experiences, and believes that diversity, equity, and inclusion contribute to the success of its business. To learn more about all of the Grupo's initiatives, click here. The Grupo monitors the evolution of the demographic profile of the recruitment processes it conducts, anonymously, to identify and implement practical actions and policies that contribute to the advancement of its diversity, equity and inclusion objectives.

Affirmative vacancies:
One of the Grupo's initiatives is to offer affirmative action positions, which aim to increase the representation of underrepresented groups in its workforce and create an inclusive environment for all. When applying for the Grupo's affirmative action positions, it may be necessary for the Candidate to share Sensitive Personal Data in order to verify your compliance with the selection criteria for these specific vacancies.

3. Sharing

The Grupo may share your Personal Data with:

• Government, judicial, legislative and supervisory authorities, to comply with legal and regulatory obligations or for the regular exercise of rights in judicial, administrative or arbitration proceedings;
• Business partners and service providers, to carry out preliminary procedures related to the recruitment and selection process; and
• Other companies in the Grupo, to execute activities under its responsibility related to the contract and to meet the legitimate interests of the Grupo companies or third parties.

All business partners and service providers of the Grupo are contractually obliged to comply with the obligations and requirements set forth in Data Protection Legislation.

6. Retention and Disposal

The Grupo understands that Candidates who have submitted their resumes and/or participated in a recruitment process are interested in new opportunities that fit their profile. Therefore, we inform you that your Personal Data will be stored in our talent database, allowing future communications and consultation of your participation history in previous processes. If the Candidate is no longer interested in participating in any of the Grupo's recruitment processes, he/she may request the deletion of his/her CV through our Customer Service Channel.

7. Security of Personal Data

The Group adopts technical and administrative measures capable of protecting Personal Data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication or dissemination.

Personal Data is stored in a secure environment, protected by encryption, continuous monitoring and intrusion detection tools, firewalls, access control, Single Sign-On (SSO), registration of logs, backups centralized and automated, entropy validation mechanism, regular updates of software, multiple-factor authentication (MFA), security information and event management (SIEM) solution, capture of audit logs, among other good practices of security standards and procedures that guarantee the continuous evaluation of new technologies that can reinforce the protection of our environments.

8. International Transfer

The Candidates' Personal Data may be transferred outside the national territory considering the country of residence of Candidates, the headquarters of the Grupo's companies and the location of cloud computing servers.

In cases where international transfers occur, the Grupo contractually requires that the receivers of Personal Data demonstrate their compliance with the Data Protection Legislation and comply with other regulatory requirements established by the competent Authority.

9. Rights of Data Subjects

Every Data Subject has a series of rights in relation to their Personal Data guaranteed by Data Protection Legislation, which may be exercised before the Group through our Customer Service Channel. 

The rights available to Candidates are as follows:

Confirmation of the existence of data processing	Allows you to confirm whether the Group Process your Personal Data.
Data access	Allows you to receive a report with all your Personal Data processed by the Group, observing commercial and industrial secrets.
Correction of incomplete, inaccurate or outdated data	Allows you to request the correction of your Personal Data, if you identify that any of them are incorrect, incomplete(s) or outdated. To make the correction, we may require you to present a document proving the veracity of the new information provided.
Information on data sharing	Allows you to receive information about any public and private entities with which the Grupo shares your Personal Data, if applicable.
Anonymization, blocking or deletion	Allows you to request the anonymization, blocking or deletion of Personal Data in the following scenarios: (a) when they are unnecessary;(b) when they are excessive; or(c) regardless of the purposes, when they have been processed in a manner that does not comply with the Data Protection Legislation.  If one of these hypotheses is met, the Personal Data relevant to the Processing in question will be anonymized or deleted from our servers and files. The deletion of data essential to our selection and recruitment process will result in your disqualification.
Revocation of consent	Allows the right to revoke consent, when this is the legal basis adopted by the GGrupo for the Processing of Personal Data in a given activity. Any revocation does not affect the legality of the Processing carried out between the granting and the request for revocation of consent. We will always notify you if revoking consent may prevent the provision of any service or benefit so that the Candidate can make an informed decision.
Deletion of data processed with consent	Allows you to request the deletion of Personal Data when the legal basis of the Treatment is consent, unless there is another reason for its maintenance, such as a possible legal or regulatory obligation to retain Personal Data or if there is a need for preservation to protect the rights of the Grupo.

Identity Validation:
To ensure that the rights are being exercised by the Candidate or their duly appointed legal representative, the Grupo may request necessary information or proof regarding their identity, in order to prevent fraud and guarantee their privacy, so that Personal Data is not shared inappropriately.

We will respond to your requests within a reasonable timeframe in accordance with the Data Protection Legislation, remembering that we will only be able to respond to some requests after receiving the confirmations provided above.

10. Contact Us

If you want to exercise any of the rights set out above, please contact us through our Customer Service Channel. We are always available to answer your questions, receive comments or complaints.

11. Changes in this Notice

This Notice will be updated periodically, with the most recent version always being the one in force, duly published on the Job Posting Platforms.