How we handle your personal data.

1. Definitions

For clarity, key terms used in this policy:

• Venture People: the legal entity responsible for data processing (data controller), headquartered in Brazil. Serves clients in Brazil and in the United States via nearshore LatAm hiring product.
• User: any person who accesses the site, submits a form, books a meeting, or communicates with Venture People through official channels.
• Candidate: an individual who applies for a position, registers in our talent network, or is mapped by our research team.
• Client: a company (typically a startup) that contracts Venture People for executive search services.
• Personal data: any information that identifies or can identify a natural person — name, email, phone, address, resume, professional profile, biometric data, and so on.
• Sensitive personal data: a subset of personal data covering racial or ethnic origin, religious beliefs, political opinions, union membership, health data, sexual orientation, genetic or biometric data.
• LGPD: Brazilian General Data Protection Law (Law 13.709/2018), the primary regulation governing data processing for Venture People as a Brazilian entity.

2. Who we are and how to reach us

Venture People is an executive-search boutique specialized in Seed–Series B startups. We operate in Brazil and serve US clients via our nearshore LatAm hiring product.

For any data-related question or to exercise your rights as a data subject, write to [email protected].

3. What personal data we collect

3.1 From candidates

• Full name
• Email
• Phone / WhatsApp
• LinkedIn profile and other public professional links
• Resume (CV) and professional information (experience, education, skills)
• Compensation expectations and availability (when provided)
• Results of interviews, VPA assessments, and reference checks we conduct
• Messages exchanged with our team

3.2 From clients and business contacts

• Full name
• Corporate email
• Phone
• Company / startup and role
• Startup stage (Seed, Series A, etc.) and open position context
• Messages exchanged with our team

3.3 Automatic collection on the site

When you browse venturepeople.com.br, we may automatically collect: IP address (anonymized when analyzed via GA4), device type, browser type, operating system, approximate geographic location (city or country level), pages visited, time on site, and referral source. This data is collected via cookies — you control it via the consent banner.

3.4 Sensitive personal data

In specific cases, and only when there is appropriate legal basis, we may process sensitive data (for example, disability information for inclusive roles or diversity monitoring under client contractual requirements). Collection of sensitive data is always optional for the candidate and handled with additional safeguards.

4. Why we use your data (purposes)

4.1 For candidates

• Evaluate fit with open positions in our client portfolio
• Apply the VPA Method (Venture People Assessment) in your evaluation
• Present your profile to clients when there's a fit (always with your prior consent for each presentation)
• Maintain you in our talent network for future opportunities (when you opt in)
• Conduct reference checks with sources we map
• Send communications about opportunities, ongoing processes, and relevant content

4.2 For clients

• Understand the open position and calibrate the ideal candidate profile
• Communicate progress on the search mandate
• Issue commercial documents (proposal, contract, invoice)
• Maintain post-placement relationship (follow-up, guarantee period, new mandates)

4.3 Site operation and continuous improvement

• Understand how the site is used (analytics)
• Personalize browsing experience
• Measure paid marketing campaigns (only when you consent via cookie banner)
• Detect and prevent fraud, abuse, and intrusion attempts

4.4 Legal and regulatory obligations

• Respond to court orders and requests from competent authorities
• Defend Venture People's rights in administrative or judicial proceedings
• Comply with tax and fiscal obligations

5. Legal bases (LGPD Art. 7)

We process your personal data based on one or more of the following legal bases:

• Consent: for marketing communications, presentation of your profile to specific clients, and non-essential cookies
• Contract performance or pre-contract steps: to conduct selection processes and serve contracted clients
• Legitimate interest: to maintain talent records, measure site usage, prevent fraud, and communicate about opportunities aligned with your declared professional profile
• Legal or regulatory obligation: to meet tax, fiscal, judicial, or administrative requirements

6. With whom we share your data

Venture People shares personal data only with third parties strictly necessary for the operation of our service, and always under protection agreements compatible with LGPD.

6.1 Contracting clients

When a candidate's profile fits an open position, we share the necessary data (resume, VPA assessment, contact info) with the client so they can decide on interview. We always inform the candidate before such presentation.

6.2 Data processors we use

• RecruitCRM (recruitcrm.io) — candidate and job management system. Servers in the US.
• Lunacal (lunacal.ai) — meeting scheduling. Servers in the US.
• Slack Technologies — internal notifications when forms are submitted. Servers in the US.
• Google LLC — Google Analytics 4, for traffic analytics. Servers in the US. Data anonymized.
• Meta Platforms and LinkedIn Corporation — paid-campaign measurement pixels (only when you consent via cookie banner).
• Hostinger — site hosting and form processing. Servers in the European Union.
• Substack — Venture News newsletter distribution (only if you subscribe). Servers in the US.

6.3 Authorities and legal partners

We may share data with competent authorities (police, public prosecutors, ANPD, judiciary) upon formal order, or with law firms to defend Venture People's rights in administrative or judicial proceedings.

6.4 Corporate transactions

In case of merger, acquisition, or investment in Venture People, personal data may be transferred to the acquiring or investing party, always under data protection obligations consistent with this policy.

7. International data transfers

Several of the processors listed above have servers outside Brazil (especially in the US and European Union). This means your data may be stored or processed outside Brazilian territory.

When this happens, we ensure processing occurs under contractual clauses compatible with LGPD, or that the processor adheres to recognized protection frameworks (European GDPR, California CCPA, ISO 27001 certifications, and so on). For details on a specific international transfer involving your data, you can request more information at [email protected].

8. How long we keep your data

• Active candidates: while your registration is active in our network. You can request deletion at any time.
• Inactive candidates (no interaction for 24 months): data is archived or anonymized after this period, unless you ask to maintain the profile.
• Clients: during the term of contract and up to 5 years afterward, to meet tax obligations and potential legal demands.
• Site logs and analytics cookies: up to 14 months (Google Analytics 4 default).
• Marketing communications: until you unsubscribe.

9. Your rights as a data subject (LGPD Art. 18)

You may exercise the following rights at any time:

• Confirmation — confirm whether Venture People processes any personal data about you
• Access — obtain a copy of the data we hold
• Correction — correct incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion — request alternative treatment of unnecessary, excessive, or non-compliant data
• Portability — request transfer of your data to another provider (when applicable)
• Deletion — request erasure of data processed based on consent
• Information about sharing — know with whom we share your data
• Withdrawal of consent — revoke previously granted consent
• Opposition — oppose processing based on legitimate interest

To exercise any of these rights, email [email protected] with the subject "LGPD — data rights request". We respond within 15 days.

Withdrawing consent or requesting deletion does not affect the lawfulness of processing carried out prior to the request, and some data may need to be retained for legal obligations (tax, fiscal, etc.) even after the request.

For US residents: if you are located in a state with a comprehensive privacy law (California CCPA, Virginia VCDPA, Colorado CPA, and others), additional rights may apply (right to opt out of "sale" of personal information, right to know about automated decision-making). The Brazilian LGPD rights above cover the substantive equivalents — to exercise state-specific rights, use the same email above and reference the applicable law.

10. Cookies

The site venturepeople.com.br uses cookies (small files stored in your browser) in three categories:

10.1 Essential cookies (always on)

Required for basic site function. They store, for example, your consent banner decision (`vp_consent`). They do not track you outside the site.

10.2 Analytics cookies (optional — you choose)

Google Analytics 4 (`_ga`, `_ga_*`). They collect anonymous data about how you use the site: most visited pages, time on site, traffic source. They help us understand what works without identifying you individually.

10.3 Marketing cookies (optional — off by default)

Meta Pixel (Facebook/Instagram) and LinkedIn Insight Tag. They enable measurement of paid campaigns on these platforms and show relevant ads. These pixels are currently inactive — they only load if you enable the "Marketing" category in the banner.

10.4 Managing your consent

You can change your choices at any time by clicking "Cookies" in the site footer, or via your browser settings (every modern browser allows blocking cookies per site).

11. Data security

Venture People adopts reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or destruction. This includes HTTPS (SSL/TLS), internal access control on a need-to-know basis, encryption in transit, regular backups, and use of processors adhering to recognized security standards.

No system is 100% failure-proof. In case of a security incident that may pose relevant risk to data subjects, we will notify the ANPD and affected parties as required by LGPD.

12. Children and minors

The Venture People site is not directed at people under 18. We do not knowingly collect personal data from children or adolescents. If we become aware of any such collection, we will delete the data immediately.

13. Policy updates

This policy may be updated periodically to reflect changes in our services, legislation, or market practice. The latest version is always available at venturepeople.com.br/en/privacy with the update date at the top. Material changes will be communicated to active candidates and clients by email.

14. Contact and regulator

For any question related to this policy or to your data: [email protected].

If you believe your rights have not been honored, you may also reach out to the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd. US residents may contact the relevant state attorney general's office for state-law privacy concerns.