Privacy policy

Job applications

Now that the applications form is open, this site collects personal data. There are two different situations and they are stated separately, because what is collected is not the same.

If you apply to a specific role

From what you write in the form, we collect:

• your name
• your email address
• your phone number, if you give one
• your curriculum vitae, as a file
• the message you write, if you write one

If you send a speculative application

From what you write in the form, we collect:

• your name
• your email address
• your phone number, if you give one
• your curriculum vitae, as a file
• the message you write, if you write one
• the area of interest you state

What travels with your application and is not written by you

This is the part that usually goes unwritten, and it is the part that matters to whoever is sending. Besides what you write, the following travels with it:

• A cryptographic fingerprint of your IP address, salted with a secret of ours. The address itself never leaves this site: what travels is an opaque value, which tells whether two submissions came from the same connection and does not tell where they came from. Without it, the anti-abuse limit on the other side would count every application as coming from the same person.
• The language the page was in, so that recruitment can reply to you in it.
• A random identifier for the submission, generated in your browser, which exists so that pressing send twice does not create two applications. It does not identify you and does not persist between visits.
• An internal reference for the role, or for the group company a speculative application is destined for. These are references of ours; they are not data about you.
• The exact text of the authorisation you were shown and the text of this policy, each with its fingerprint.

On what basis

The processing is based on pre-contractual steps taken at your request — the assessment of your application — under Article 6(1)(b) of the General Data Protection Regulation.

Your authorisation, and the proof of it

Before you send it, you are asked to expressly authorise this processing. We record that authorisation by keeping the exact text you were shown and a fingerprint of that text, so that what you consented to is always clear — not merely that you consented. The time of consent is the time we receive it in our systems, not your computer's clock.

What happens next

The data is received by this site and passed, in the same operation, to EVOLEO Technologies' recruitment system, which is who keeps it and who processes it. This site keeps no copy of anything: not on disk, not in storage, not in logs, not in a variable that outlives the request.

Your curriculum vitae, as a file

The file passes through this site without being opened or copied — it goes on to the recruitment system in the same request in which it arrives, and this site never reads its contents. That is where it is stored, separately from the rest of the application, and that is where it is deleted within the same period. If the upload fails part-way, nothing is kept: half an application is not an application.

For how long

Your application data is kept for 12 months from the date we receive it, after which it is deleted. You may request deletion before that period ends.

You may request access to your data, its rectification or its erasure, object to the processing and withdraw your authorisation at any time — including before the period ends. Write to bruno.ribeiro@evoleo.tech and we will reply.