Privacy Policy — Kaptas Global

1. Introduction

HR Technology LLC, a Florida limited liability company doing business as Kaptas Global ("Kaptas Global," "we," "us," or "our"), provides recruitment, staffing, and market-entry services that connect companies — primarily in the United States — with senior professionals based in Brazil and other Latin American countries. We operate the website at kaptasglobal.io (the "Site") and offer related services described at that address (collectively, the "Services").

This Privacy Policy describes how we collect, use, share, and protect personal information when you interact with the Site or Services. It also explains the rights you have over your personal information under the General Data Protection Law of Brazil (LGPD), the General Data Protection Regulation of the European Union and United Kingdom (GDPR / UK GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), where applicable.

We have written this Policy to be as clear and specific as possible. If anything is unclear, please contact us using the information in Section 17.

2. Who This Policy Applies To

This Policy applies to personal information we process about:

Clients and prospects — representatives of companies that hire (or consider hiring) talent through Kaptas Global.
Candidates and professionals — individuals we source, screen, present to clients, or place with clients.
Site visitors — anyone who browses our website, downloads materials, or fills out a contact form.
Subscribers — recipients of our newsletter and other marketing communications.

This Policy does not apply to personal information our clients process under their own privacy notices once a candidate has been hired and an employment, contractor, or service relationship is established with the client.

3. Information We Collect

We collect the following categories of personal information:

3.1 Information You Provide Directly

Contact data: full name, business email, company, role, country, phone (when provided).
Hiring-need data: information you share through our forms about roles you want to fill, seniority, tech stack, budget range, timeline, and preferred hiring model.
Candidate data: when you apply or are sourced — name, email, location, professional profile, resume content, work history, language proficiency, salary expectations, and references.
Communications: messages, attachments, and notes from emails, calls, video meetings, and chat exchanges with our team.

3.2 Information Collected Automatically

Device and usage data: IP address, browser type and version, operating system, referring URL, pages viewed, time on page, and links clicked.
Approximate location: derived from IP address (city/country level), not precise GPS.
Cookies and similar technologies: see Section 13.

3.3 Information From Other Sources

Public professional profiles: when we source candidates, we may collect information from publicly available sources such as LinkedIn, GitHub, professional directories, and personal websites.
References: information shared by professional references with the candidate's consent.
Business partners: lead-generation, analytics, and outreach tools we use to identify and engage prospective clients.

We do not knowingly collect sensitive personal data (such as data about racial origin, religion, health, sexual orientation, political opinions, or trade-union membership). If such information is incidentally included in a candidate's profile or resume, we do not use it for screening and we remove it where reasonably possible.

4. How We Use Information

We use personal information for the following purposes:

To deliver our Services: sourcing, screening, presenting candidates to clients, coordinating interviews, managing placements, and supporting payroll and compliance.
To communicate with you: respond to inquiries, schedule calls, send proposals and contracts, and follow up on ongoing engagements.
To market our Services: send relevant content and offers to prospective clients, subject to applicable opt-out and consent requirements.
To improve the Site and Services: understand how visitors use the Site, troubleshoot issues, and refine our content and product strategy.
To comply with law and protect rights: meet legal obligations, enforce our Terms of Service, prevent fraud, and protect the safety of users and third parties.

We do not sell personal information for monetary consideration, and we do not engage in profiling that produces legal or similarly significant effects on you without human review.

5. Legal Bases for Processing

Where the LGPD, GDPR, or UK GDPR applies, we rely on the following legal bases:

Contract performance — to provide the Services you or your employer have requested.
Legitimate interests — to run, secure, and grow our business (including B2B outreach to professional contacts at companies that match our ideal client profile), balanced against your interests and rights.
Consent — for marketing communications where consent is required, for non-essential cookies, and for processing in jurisdictions where consent is the appropriate basis.
Legal obligation — to comply with applicable law, regulation, court order, or government request.

You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We share personal information only as described below:

With clients — when we present qualified candidates, we share the candidate's professional profile and screening notes with the prospective employer. Candidates are informed before their profile is shared.
With service providers — vendors that help us run the Site and the Services (see Section 7).
With professional and legal advisors — accountants, lawyers, and auditors under confidentiality obligations.
In business transactions — if we are involved in a merger, acquisition, financing, or sale of assets, personal information may be disclosed to the counterparty under appropriate safeguards.
For legal reasons — to comply with law, respond to lawful requests, enforce our agreements, or protect rights, property, and safety.

We do not share personal information with third parties for their own independent marketing without your consent.

7. Service Providers and Sub-Processors

We use a limited set of trusted vendors to operate the Site and Services. As of the Last Updated date above, these include:

Vercel Inc. — website hosting and content delivery.
Web3Forms — secure transmission of contact-form submissions to our team.
Google LLC — Gemini AI API for the AI-assisted features on the Site, and Google Workspace for internal email and file storage.
LinkedIn — sourcing and professional outreach.
Email and CRM tools — to manage sales pipeline and client relationships.

Each provider processes personal information only on our instructions and under contractual obligations that include security, confidentiality, and data-protection requirements appropriate to the processing.

8. International Data Transfers

Kaptas Global is incorporated in the United States and operates a distributed team that includes Brazil and other Latin American countries. As a result, personal information may be transferred to, processed in, and stored in countries other than the country where it was collected — including the United States and Brazil — which may have data-protection laws that differ from those in your jurisdiction.

When we transfer personal information from the European Economic Area, the United Kingdom, Switzerland, or Brazil to countries that have not been recognized as offering an adequate level of protection, we use appropriate safeguards, including Standard Contractual Clauses approved by the European Commission and equivalent mechanisms recognized by the ANPD in Brazil.

9. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy or as required by law. In general:

Client and prospect data — for the duration of the relationship and up to five (5) years after the last interaction, to support repeat engagements and comply with commercial-record obligations.
Candidate data — up to two (2) years after the last interaction, unless the candidate has been placed (in which case we retain the engagement record for the period required by labor and tax law).
Marketing-list data — until you unsubscribe or otherwise withdraw consent.
Site analytics — typically up to fourteen (14) months in identifiable form.
Records required by law — for the legally mandated retention period (for example, tax and accounting records).

After the applicable retention period, we delete, anonymize, or aggregate the information.

10. Information Security

We apply technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. These measures include encryption of data in transit (HTTPS/TLS), access controls, the principle of least privilege, regular software updates, and ongoing review of our security posture.

No system can be guaranteed to be completely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and the competent authorities as required by applicable law.

11. Your Rights

You have rights over your personal information. The specific rights depend on where you live and the law that applies. The sections below summarize the most common frameworks. We honor verified requests from any individual, regardless of jurisdiction, to the extent feasible.

11.1 Rights Under LGPD (Brazil)

If you are in Brazil, you have the right to:

Confirm the existence of processing of your personal data.
Access your personal data.
Correct incomplete, inaccurate, or outdated data.
Anonymize, block, or delete unnecessary, excessive, or unlawfully processed data.
Request the portability of your data to another service or product provider.
Delete personal data processed on the basis of consent.
Receive information about the public and private entities with which we share your data.
Be informed about the possibility of denying consent and the consequences of that denial.
Withdraw consent at any time.
File a complaint with the Brazilian Data Protection Authority (ANPD).

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

Access your personal data.
Request rectification of inaccurate data.
Request erasure ("the right to be forgotten") in certain circumstances.
Restrict processing in certain circumstances.
Object to processing carried out on the basis of legitimate interests, including for direct marketing.
Receive your personal data in a portable format.
Withdraw consent at any time.
Lodge a complaint with your local data-protection supervisory authority.

11.3 Rights Under CCPA/CPRA (California)

If you are a California resident, you have the right to:

Know what personal information we collect, use, disclose, and (where applicable) "share" or "sell" — as those terms are defined under California law.
Access the specific pieces and categories of personal information we have collected.
Request deletion of personal information, subject to legal exceptions.
Correct inaccurate personal information.
Limit the use and disclosure of sensitive personal information.
Opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.
Non-discrimination for exercising your privacy rights.

You may designate an authorized agent to make a request on your behalf, subject to verification.

12. How to Exercise Your Rights

To exercise any of the rights described above, email support@kaptasglobal.io. Please describe your request and the jurisdiction whose rights you are invoking. We may need to verify your identity before processing the request, which typically requires confirming information we already have on file. We will respond within the timeframe required by applicable law (generally within 15 days under LGPD and 30 days under GDPR and CCPA/CPRA, with one possible extension where permitted).

13. Cookies and Similar Technologies

The Site uses cookies and similar technologies (such as local storage and pixel tags) to operate the Site, remember your preferences, and understand how the Site is used. We categorize them as follows:

Strictly necessary — required for the Site to function (e.g., load balancing, form submissions).
Functional — remember your choices, such as language or accessibility preferences.
Analytics — help us understand which pages are visited and how visitors arrive at the Site. We aggregate and pseudonymize this data wherever possible.

You can control cookies through your browser settings. If you reject non-essential cookies, parts of the Site may not function as intended.

14. Artificial Intelligence Features

Some features of the Site and Services use AI-assisted tools (including the Google Gemini API) to summarize information, generate first-draft content, and surface insights. When you interact with these features, the content you submit is processed by the AI provider under terms that prohibit the use of your data to train their models, and is not retained by us beyond what is necessary to deliver the requested output.

We do not use AI to make automated decisions that produce legal or similarly significant effects on you without meaningful human review.

15. Children's Privacy

The Site and Services are intended for use by adults in a professional context. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected information from a child, please contact us and we will delete it.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. The "Last Updated" date at the top of this page indicates when the Policy was last revised. Material changes will be communicated through prominent notice on the Site or, where appropriate, by email.

17. Contact and Data Protection Inquiries

For any privacy-related question or to exercise the rights described in Section 11, contact us at:

HR Technology LLC (d/b/a Kaptas Global)
7345 W Sand Lake Rd, Ste 210, Office 460
Orlando, FL 32819, United States
Email: support@kaptasglobal.io
Phone: +1 (689) 293-9252