Sunday, September 7, 2025

Privacy Policy = Globant

This is a legal analysis of the provided Privacy Policy for Globant's augmented recruiting platform. The analysis will cover the policy's key components, including data collection, purpose and legal basis, data retention, disclosure, and user rights, with a focus on its compliance with international data protection standards like GDPR and LGPD.

1. Data Collection and Purpose

The policy outlines several methods of data collection, including:

Automatic Collection: The platform automatically collects IP addresses and uses cookies. This is a standard practice for online services.
Account Information: When a user creates an account, or an account is assigned to them, Globant collects personally identifiable information such as name, address, and email. This is directly relevant to the purpose of the platform, which is recruiting.
Voice Recordings: A significant point is the explicit mention of voice recordings during interviews. The policy states these recordings are used by the HR department to "evaluate your progress in the recruitment process." This is a key disclosure that users must be aware of and consent to.
Other Data: The policy also mentions collecting data from third-party widgets, link clicks, and mobile devices, with the latter requiring user permission.

The stated purposes for collecting this data are clearly tied to the recruitment process: identifying candidates, assessing their compatibility with open positions, and preparing reports for HR. The policy also includes a catch-all clause that the company can use personal information to comply with legal obligations, protect its rights, or in emergencies.

2. Legal Basis for Processing

The policy lists several legal bases for processing personal information, which is a key requirement under data protection laws like the GDPR. These include:

Legitimate Interest: Processing data for "research and development, to market and promote our Platform, to protect our legal rights and interests." This is a broad but legally valid basis, provided Globant can demonstrate that its interests are not overridden by the individual's rights.
Consent: Processing data with the user's consent for a specific purpose.
Legal Obligation: Using data to comply with legal requirements.
Performance of a Contract: Processing data necessary to provide the platform's services as outlined in the Terms and Conditions.
Other Valid Processing: A general clause for any other legally permissible processing.

This multi-faceted approach to legal basis is common in modern privacy policies and helps the company remain compliant even if one basis is challenged.

3. Data Retention and Disclosure

The policy states that personal information is retained "for as long as necessary to fulfill the purposes for which it was collected" or to comply with legal obligations. After the purpose is fulfilled, the data is "blocked up" (a term for making it inaccessible for further processing) until the statute of limitations for legal claims has expired. This practice of data minimization and retention is a core principle of privacy law.

Data disclosure is limited to affiliated companies and situations where disclosure is required by law (e.g., in response to a subpoena or court order) or to protect Globant's rights. This appears to be a reasonable and standard approach to data sharing.

4. International Data Transfers and User Rights

The policy clearly states that user data will be stored on servers in the United States of America. It also explicitly notes that data may be transferred to other companies within the Globant group located in different countries, including Ireland. This is a critical disclosure, as it informs users that their data may be transferred to and stored in countries with different data protection laws. The policy requires users to authorize this transfer, which is a standard procedure.

The policy specifically addresses European residents, stating their information will be stored on servers in Ireland. This likely reflects efforts to comply with GDPR, as Ireland is a member of the European Union.

Users are granted the rights of access, rectification, cancellation, and opposition regarding their personal information. This aligns with fundamental rights provided under data protection regulations like GDPR. The policy provides a specific email address (privacy@globant.com) and a physical address for exercising these rights.

5. Special Provisions for Brazil (LGPD)

The policy includes a dedicated section for data protection in Brazil. This is a crucial addition, as it shows an attempt to comply with the Brazilian General Data Protection Law (LGPD), which has specific requirements similar to GDPR. The policy names a specific "in charge" person (encarregado), as required by LGPD, and provides contact information for inquiries related to data protection in Brazil. This demonstrates a targeted effort to address the legal requirements of a key market.

Conclusion

Globant's Privacy Policy is a well-structured document that addresses many of the key requirements of modern data protection laws. It transparently outlines what data is collected, for what purposes, and the legal basis for that processing. The policy's explicit mention of voice recordings, international data transfers, and dedicated sections for specific jurisdictions (like Brazil) demonstrates a sophisticated and legally sound approach to privacy. However, the effectiveness and legal enforceability of these clauses depend on the specific jurisdiction and whether the company's practices are genuinely compliant in all respects, particularly regarding the concept of "legitimate interest" and the specifics of consent for voice recordings.

Original

Privacy Policy

Effective Date: 28 April, 2020

Globant values individual privacy and we want to give our candidates and employees visitors that use our Augmented Recruiting Platform (the “Platform”) the opportunity to know what information we collect about them and how it is treated by us.

This Privacy Policy (this “Policy”) explains:

INITIAL EXPLANATORY NOTE

Capitalized terms not otherwise defined in this Policy shall have the meaning ascribed to such terms in the Terms and Conditions. We recommend you to read this Policy together with our Terms and Conditions in order to better understand the rules governing the use of our Platform.

We may update this Privacy Policy from time to time. When we update the Privacy Policy, we will revise the “Effective Date” date above and post the new Privacy Policy.

1. WHICH INFORMATION ABOUT YOU WE COLLECT.

A. Information collected automatically.

When navigating our websites and accessing or using our Platform, Globant will collect and store the Internet protocol (IP) address of your computer and the Internet address of the site from which you linked directly to access the Platform.

When navigating our websites and accessing or using our Platform, Globant will collect and store Cookies.

B. Information collected when setting-up your account.

You will need an account to use and access our Platform. You may create your own account, or your account may be assigned to you by Globant.

If you are creating your own account, information is collected when you volunteer to identify yourself, register to our Platform and provide requested information.

If your account is being assigned to you by Globant, we will use personally identifiable information about yourself in order to create your account, such as your first name, last name, address, e-mail address, and related information.

C. Voice Recording.

By using the Platform, you will participate in interviews where audio will be recorded. The recording of your voice during the interview will be used by Globant's recruitment and human resources area to evaluate your progress in the recruitment process for a job position at Globant.

D. Widget data.

Other websites may integrate Globant widgets. When you visit a site with a Globant widget or a widget related to the Platform or any of our products embedded, we may receive certain information, including information about the web page you visited. Globant and the widget can recognize you when you interact with a widget.

E. Links data.

We may keep track of how you interact with links across our Platform, including our email notifications, third-party services, and other applications, by redirecting clicks or through other means. We do this to help improve our Platform and to be able to share aggregate click statistics such as how many times a particular link was clicked on.

F. Data from your mobile device.

We may provide features that rely on the use of additional information on your mobile device or require access to certain Platform on your mobile device that will enhance your experience but are not required to use the Platform. Before we access this information or these features of your mobile device, we will ask for your permission. If you provide such permission, we will collect the information for the specific purposes explained at the time we ask for your permission.

2. PURPOSES OF USING YOUR PERSONAL INFORMATION AND LEGAL BASIS.

Globant uses the information collected through our Platform to (i) identify potential candidates to open positions; (ii) identify in the candidates compatibilities with Globant expectations for such open positions; (iii) prepare a report for Globant HR departments to have quick access and details on those candidates that better suit the profile desired for each open position; (iv) evaluate the candidates' information for the recruitment process.

If you contact us regarding identity theft or some other form of unauthorized use of the Platform, Globant may disclose pertinent information to law enforcement agencies and other third parties with responsibility and authority.

At all times, however, Globant reserves the right to disclose information where required by law or to comply with valid legal process (such as a search warrant, subpoena or court order), to protect Globant’s rights or property, including without limitation in the event of a transfer of control of Globant or substantially all of its assets, or during emergencies when safety is at risk.

We are entitled to use your personal information based on (i) our legitimate interest such as for research and development, to market and promote our Platform, to protect our legal rights and interests, to the extent that your interests or your fundamental rights are not overridden; (ii) your consent to do so for a specific purpose; (iii) to process your data to comply with a legal obligation; (iv) to process your data for the performance of a contract; (v) any other valid processing allowed by the relevant regulations.

3. RETENTION OF YOUR PERSONAL INFORMATION.

Globant will retain your personal information for as long as necessary to fulfill the purposes for which it was collected or as necessary to comply with our legal obligations, resolve disputes, and maintain appropriate business records. Once the purpose has been fulfilled your personal information will be retained blocked up due to the possibility of legal and governmental requirements and until their status of limitations have run out.

4. DISCLOSURES OF PERSONAL INFORMATION.

Globant may share your personal information with affiliated companies. In addition, Globant reserves the right to disclose information where required by law or to comply with valid legal process (such as a search warrant, subpoena or court order) as well as to protect Globant’s rights or property, including without limitation in the event of a transfer of control of Globant or substantially all of its assets, or during emergencies when safety is at risk.

5. WHERE IS YOUR PERSONAL INFORMATION STORED AND WHICH ARE YOUR RIGHTS.

A. Storage of the Information.

All of the information collected by Globant through the Platform is stored on secured servers, to protect against unauthorized use and access. Our servers are located in the United States of America.

Globant may share your information with other companies in the Globant group that are located in countries different than your home country in order to carry out the activities specified in this Privacy Policy.

Irrespective of which country you live in, you authorize us to transfer, store, and use your information in the United States, Ireland, and any other country where we operate. In some of these countries, the privacy and data protection laws and rules regarding when government authorities may access data may vary from those in the country where you live.

If you are a European resident, your information will be stored in the servers located in Ireland.

B. Your access rights.

You can exercise your rights, of access, rectification, cancellation and /or opposition regarding your personal information, directly in your employer or by email to the following address: privacy@globant.com.

6.DATA PROTECTION IN BRAZIL.

Personal data that has been collected and/or processed in Brazil, and any other personal data that is processed relating to persons and/or services located in Brazil, will be subject to the provisions of the Brazilian General Data Protection Law (Law 13.709/2018 - Lei Geral de Proteção de Dados Pessoais or "LGPD"). Any inquiries related to personal data protection in Brazil can be sent to privacy@globant.com. The person "in charge" (encarregado, according to the provisions of Art. 41.1 of LGPD) is Bryan Longo, lawyer of Clasen & Casado Filho Sociedade de Advogados.

7.CONTACT US.

If you have any question regarding this Policy, please contact us at privacy@globant.com or reach out to Globant using the contact information below:

Globant S.A.
37A Avenue J.F. Kennedy
L-1855, Luxembourg

Leituras, traduções e links