Privacy and Personal Data Protection Policy
Last updated: .
This Policy explains how Projects Evolution collects, uses, stores, shares, and protects personal data in its websites, applications, and services. It was prepared in accordance with Brazilian Federal Law No. 13,709/2018, the General Data Protection Law (LGPD), and should be read together with the Terms of Use applicable to each service.
1. Controller and scope
Projects Evolution is the controller of personal data for which it determines the purposes and means of processing. In some operations, such as recruitment processes managed by companies using PEJ, Projects Evolution may act as a processor and handle data under the instructions of the company responsible for the vacancy or assessment.
This Policy covers the corporate website, Projects Evolution JOB (PEJ), Projects Evolution E-learning (P2E), Agenda Online, HUB, VivaLeve, administrative areas, customer and partner registration, contact channels, and related features. Third-party services accessed through links or integrations have their own privacy policies.
2. Personal data processed
The data processed depends on the service, user profile, and contracted features.
Data categories by service| Service or context | Examples of data processed |
|---|
| Website, contact, customers, and partners | Name, tax identification when necessary, email, telephone number, messages, company, commercial relationship data, password, and service records. |
|---|
| PEJ — candidates | Identity and contact information, address, photograph, résumé and attachments, academic and professional history, languages, skills, positions, salary expectations, applications, interviews, proposals, alerts, and assessment responses and results. |
|---|
| PEJ — companies and recruiters | Company and representative registration information, contacts, address, website, vacancies, requirements, benefits, salary ranges, departments, employees participating in assessments, and interactions with candidates. |
|---|
| P2E — students, instructors, and customers | Identity and account data, photograph, courses, enrollment, progress, tests, responses, results, certificates, vouchers, reports, uploaded files and content, and, when applicable, financial information required for payments and controls. |
|---|
| Agenda Online | Identity, contact and address data, photographs, documents, company information, authorized users, schedules, services, preferences, notes, comments, amounts, payment status and method, and Pix key when registered. |
|---|
| VivaLeve | Account and consent data; food information, photographs, calories and protein; body measurements and indicators; location, accuracy, date and time when authorized; alerts, device, session, support, and technical records. |
|---|
| Payments and subscriptions | Transaction identifier, product or plan, amount, currency, payment status, and payer information received from the payment provider. Full card details are normally provided directly to the provider and are not stored by Projects Evolution. |
|---|
| Technical use and security | IP address, date and time, pages and resources accessed, session identifiers, cookies, browser, operating system, device type, access source, use events, authentication, errors, and audit records. |
|---|
2.1. Data sources
Data may be provided directly by the data subject; by authorized companies, schools, instructors, recruiters, or administrators; through user-authorized integrations; by payment providers; automatically through access records and cookies; or from public sources and partners when permitted by law and compatible with the stated purpose.
2.2. Sensitive personal data
The services do not generally request sensitive personal data. However, résumés, documents, assessments, messages, or free-text fields may contain sensitive information entered by the data subject or an authorized organization. VivaLeve food data, photographs, body measurements, indicators, and notes may reveal health information and are handled accordingly. Processing is limited to what is necessary and must rely on a legal basis under Article 11 of the LGPD.
2.3. Children and adolescents
PEJ candidate registration and P2E and VivaLeve profiles are intended for people aged 18 or older. If a specific service processes data from a child or adolescent, their best interests and Article 14 of the LGPD must be observed, including specific consent from a legal guardian when applicable.
2.4. VivaLeve, device permissions, and location
VivaLeve may request location, camera, file, notification, or device biometric authentication permissions only when required for a feature and after the operating system presents the request. Denying or revoking a permission affects only the dependent feature.
Location is collected only while using a feature that requires it, with latitude, longitude, accuracy, date, time, and application version; it is not collected continuously in the background. It is not sold or used for behavioral advertising. Device biometric authentication is performed by the operating system; VivaLeve receives only the result and does not access or store fingerprints, facial images, or biometric templates.
3. Purposes and legal bases
Data may be processed to create and manage accounts; authenticate users; provide contracted features; manage recruitment, education, schedules, support, billing, fraud prevention, security, legal obligations, and service improvement; communicate operational information; and exercise rights in judicial, administrative, or arbitration proceedings.
Depending on the situation, the legal bases may include performance of a contract or preliminary procedures, compliance with legal or regulatory obligations, legitimate interests subject to safeguards, regular exercise of rights, fraud prevention and security, protection of health where applicable, and consent when required.
3.1. Profiles, scores, and automated decisions
PEJ and P2E may calculate results or scores from answers and configured criteria. These results support recruitment or learning decisions and do not guarantee hiring, approval, certification, or any other outcome. A data subject may request information and review when a decision based solely on automated processing significantly affects their interests.
4. Sharing personal data
Data may be shared only as necessary with customer organizations and authorized users; infrastructure, hosting, communication, analytics, support, and payment providers; professional advisers; public authorities when legally required; and parties involved in corporate transactions subject to confidentiality and legal safeguards. Projects Evolution does not sell personal data.
4.1. International transfers
Some suppliers may process data outside Brazil. Transfers will follow the LGPD and applicable ANPD regulations through recognized adequacy decisions, contractual clauses, certifications, or another lawful mechanism.
5. Cookies and similar technologies
Cookies may be used for essential operation, authentication, security, preference storage, performance measurement, and, when applicable, analytics or advertising. Nonessential cookies will be subject to the available consent choices. Browser settings can block or delete cookies, but this may affect some features.
6. Retention, anonymization, and deletion
Data is retained only as long as necessary for the stated purposes, contractual and legal obligations, audit requirements, dispute resolution, and the regular exercise of rights. When there is no lawful reason to retain it, data will be securely deleted or anonymized. Restricted backup copies may remain until their normal replacement cycle.
7. Security and incident response
Projects Evolution applies technical and administrative measures proportionate to risk, which may include access controls, authentication, role segregation, audit logs, backups, component updates, communication protection, and need-to-know access restrictions.
No environment is entirely risk-free. If an incident may cause relevant risk or harm, containment, investigation, remediation, and legally required notifications to affected data subjects and the ANPD will be performed. Users must keep passwords confidential, use strong credentials, end sessions on shared devices, and report suspected misuse promptly.
8. Data subject rights
Subject to the LGPD, a data subject may request confirmation and access; correction; anonymization, blocking, or deletion of unnecessary or unlawfully processed data; portability; deletion of consent-based data subject to legal retention; information about sharing; information about the consequences of refusing consent; withdrawal of consent; objection to unlawful processing; review and explanation of solely automated decisions; and the right to petition the ANPD and consumer-protection authorities.
Identity confirmation and information needed to locate the data may be requested to prevent fraudulent requests.
9. User responsibilities and third-party data
A user who enters another person's data represents that they have authorization or another valid legal basis and must provide the required privacy information. Users are responsible for accuracy, lawful files and contact lists, and permissions granted within their organization. Public profiles, vacancies, résumés, or content may be viewed by third parties; users should avoid publishing unnecessary information.
10. Changes to this Policy
This Policy may be updated to reflect legal, regulatory, technology, or service changes. The revision date will appear at the beginning. Material changes may be communicated through available channels, and renewed consent will be requested when required.
11. Privacy contact and exercise of rights
For questions, complaints, or privacy requests, contact Projects Evolution at comercial@projectsevolution.com.br. Use “Privacy/LGPD” in the subject line, describe your relationship with the service and the right you wish to exercise, and do not send sensitive documents in the first message.
If the request concerns an organization acting as controller, it may be forwarded to the appropriate organization.