PRIVACY NOTICE FOR CANDIDATES

INTRODUCTION

To ensure transparency and reduce complexity, we’ve made this Privacy Notice for Candidates (“Notice”) as simple as possible. 

For Your clarity, words starting with capital letters in this Notice have a specific meaning defined within the Notice.

Whenever there’s a mention of “Nubank,” “Nu,” “we,” “us,” or “our,” we’re referring to the companies (a) that are part of the Nu Group, responsible for their respective selection processes under the terms of this Notice. 

Similarly, whenever there’s a mention of “You” or “Your,” we’re referring to You as a Candidate.

(a)  Any entity that, directly or indirectly through one or more intermediaries, controls or is controlled by, or is under common control with the Company.

Check our job opportunities

1. SCOPE

This Privacy Notice for Candidates applies to the processing of personal data of all Candidates participating in selection processes conducted by Nu Holdings Ltd. (“Company”) and the Nu Group’s group companies (together with the Company, “Nu”), regardless of the position available and the outcome of the selection process.

​​To apply for regular jobs or internships at Nu, You need to be over 18 years old. 

Nu also accepts applications for internships and apprentice positions if You are over 16 years old, provided You submit written authorization from a parent or legal guardian. 

This Notice details what personal data we collect, how it’s used, stored, and shared, and what Your rights are regarding this information.

It applies to You when:

• You receive a message from one of our recruiters and choose to participate in the process;
• You apply for one of our positions on our platform;
• You send Your resume to Nu;
• You are referred to a position by someone at Nu.

By acknowledging this Notice, You recognize that Nu will be the controller of Your personal data, meaning the one responsible for deciding how Your data will be processed. 

Therefore, we recommend that You read the Notice in its entirety.

2. PERSONAL DATA COLLECTED BY NU AND HOW WE COLLECT IT

When You participate in our selection process, we need some information about You (“personal data”). 

This personal data may:

1. Be provided directly by You, in which case You will be solely responsible for the accuracy of the data You provide;
2. Be sent to Nu by recruitment partners.

In both cases, the uses (“processing”) of this data carried out by Nu will always be justified by legitimate purposes and previously communicated to You.

This data includes:

• Registration data, such as full name, date of birth, address, phone number, email address;
• Information related to Your application, such as resume, cover letter, details of previous jobs, labor documents;
• Information related to Your interest in the selection process, such as desired salary, benefits packages, and other work preferences;
• Links to professional social media profiles (like LinkedIn) or to external and personal websites, if You wish to provide them;
• Information obtained through third parties, such as references, recruitment agencies, and background check providers (when applicable);
• Information obtained during in-person and remote interviews and other stages of the selection process;
• Publicly available information about You, such as on open professional social media profiles. In this case, Nu is not responsible for the processing of Your data carried out by these platforms, which have their own privacy notices;
• Sensitive personal data, such as ethnicity, race, sexual orientation, and disabilities. The submission of this data is optional, and providing or not providing this data will not harm You at any stage of the selection process. Other personal data You decide to inform us during Your selection process, such as availability for calls and meetings, among others.

3. PURPOSES OF DATA PROCESSING

In the context of our selection process, Nu may use (“process”) Your personal data for the following purposes:

• Manage and control candidates’ resumes for available positions.
• Evaluate candidates’ skills, qualifications, and interests in relation to the selection process and other career opportunities (if applicable).
• Communicate with candidates about the selection process.
• Conduct personal and professional reference checks and/or background checks (if applicable).*
• Identify illegal, discriminatory, or code-of-conduct-violating behaviors (if applicable).*
• Prepare statistical reports and record candidate history.
• Improve our application and recruitment process.
• Develop and promote diversity and inclusion policies at Nu.
• Comply with legal and regulatory obligations, including laws related to diversity and inclusion.
• Enable the regular exercise of Nu’s rights;
• In the context of sensitive personal data, verify if You fit into any diversity and inclusion policy, always in accordance with applicable legislation, and only if You wish to share this information with us. This data will also be anonymized, and the anonymized information will be used to improve our selection processes and internal processes.

*For certain positions that require access to our customers’ financial data or Nu’s strategic information, we need to perform a due diligence check (criminal and/or financial) to comply with legal and regulatory requirements. Nu will inform You when this check is necessary and, if applicable, will request additional data for this purpose, such as Your mother’s full name and the number of some documents (like Social Security Number, ID number or passport).

4. PERSONAL DATA SHARING

Nu may share Your personal data to achieve the purposes stated above. This data sharing, when necessary, will be done within the limits and purposes of our business and in accordance with applicable law. 

Below, we inform You with whom we may share Your data in the context of the selection process.

• Position-related Employees: Nu departments/employees who need access to candidates’ personal data to evaluate their application and participate in the interviewing process related to the position which the candidate is being considered for.
• External Service Providers: We use platforms and agencies specialized in recruitment and selection, partners who support Nu in the regular exercise of our rights, as well as partners who assist in hiring foreign individuals, including partners who provide relocation and moving services (if applicable). These service providers are carefully selected by Nu and are contractually obliged to process our candidates’ data only for the purpose for which they were hired and in strict compliance with applicable data protection legislation.
• Authorities and regulatory bodies: We may share candidates’ personal data to respond to investigations, lawsuits, actions regarding illegal activities, suspected fraud, as well as to comply with legal requirements for diversity and inclusion reports, for the regular exercise of Nu’s rights, or if otherwise required by legislation.
• New business partners: In cases where Nu is involved in a full or partial merger or acquisition of its businesses, we may share the data of candidates whose selection process will continue after the merger or acquisition.

5. PERSONAL DATA RETENTION AND DELETION

When applicable, and even after the selection process has concluded, regardless of the outcome, Nu needs to store Your personal data for an additional period of time. 

This storage is necessary for auditing purposes, compliance with legal or regulatory obligations, the regular exercise of Nu’s rights, and also to achieve the processing purpose (for example, to contact former candidates about new opportunities that are a better fit for their profile). 

Don’t worry: Your personal data will always be kept in a secure and controlled environment, and will be deleted or anonymized as soon as its retention is no longer necessary or justifiable according to the applicable legal bases.

6. YOUR RIGHTS AS A PERSONAL DATA SUBJECT

The candidate, as the data subject, has rights regarding their personal data, which include:

• Confirmation of personal data processing: The fact that You are a candidate for an open position at Nu already means that we process Your personal data. In any case, You can always ask Nu if we process Your personal data.
• Access to personal data: You can request that Nu inform You of and provide the personal data it holds about You, within the limits and terms of applicable legislation.
• Correction of incomplete, inaccurate, or outdated personal data: If You verify that Your personal data is incomplete, inaccurate, or outdated, You can request that Nu correct or supplement this data. To do so, You can directly inform the recruiter responsible for Your application, or, if that’s not possible, submit a request via the channels specified in sections 11 to 14. 
• Anonymization, blocking, or deletion of data: In some cases, You can request the anonymization, blocking, or deletion of Your data. Please note that this right is not absolute, and there are situations where Nu needs to retain Your data even if You request its deletion, as stated in section 5 of this Notice. These situations will always comply with the applicable data protection legislation.
• Revocation of consent, deletion of personal data processed based on your consent, and information about the consequences: If any of Your personal data has been collected based on Your specific consent, such as sensitive personal data about race, ethnicity, and sexual orientation, You may revoke Your consent. This means that Nu will no longer be able to use that data for the purpose You consented to. Additionally, You can also request the deletion of data processed based on Your consent. Finally, You can ask Nu about the consequences of revoking certain consent.
• Access to more information about the processing of Your personal data: You can request, at any time, that Nu provide You with information about the processing of Your personal data, in accordance with applicable data protection legislation.
• Automated decisions: In some locations, candidates have rights related to automated decisions, such as objecting to them, requesting their review, or asking for more information about them. 
• Data portability: You can exercise Your right to data portability for Your personal data, under the terms of the applicable legislation.
• Petition: in some jurisdictions, You have the right to petition the applicable Data Protection Authority regarding Your personal data.

Should You wish to exercise any of these rights, please contact our Data Protection Officer (DPO) according to the channels described in sections 12 to 14. 

To effectively process Your rights, we may request proof of Your identity as a security and fraud prevention measure.

It’s important to note that Your rights will be guaranteed under the terms of applicable legislation, as described in the sections 12 to 14 below.

7. INTERNATIONAL DATA TRANSFER

Your personal data may be transferred to other countries (for example, when stored by Nu on cloud computing servers located in other countries). 

In such cases, Nu follows all requirements established by applicable law and adopts the best security and privacy practices to ensure the integrity and confidentiality of Your personal data.

8. SECURITY MEASURES

Nu uses various types of security measures to ensure the integrity of Your personal data, such as industry-standard information security practices when collecting and storing personal data.

Personal data may also be stored using cloud computing technology and other potential future technologies, always aiming to improve and perfect our services and security.

We have a robust, highly qualified team responsible for ensuring Nu adopts the best security practices, including:

• Multi-factor authentication for information access,
• Security as code, to enable automations and fast, efficient responses to security events in the technological environment,
• Encryption for data at rest, in transit, and in use, to ensure information integrity,
• Continuous environment monitoring,
• Continuous information security analyses and tests on our systems, performed by internal and external teams,
• Periodic audits.

We also recommend You always take care when sharing Your personal data on social media or in any other public environment. To learn more about digital security, please access our blog.

9. IMPORTANT DISCLAIMERS

At Nu, we may use ARTIFICIAL INTELLIGENCE tools in processing personal data to enhance our selection process, always in compliance with our legal and regulatory obligations and the commitments stated in this Notice.

You are aware that if You don’t agree to share some of this data with Nu, Nu might not be able to proceed with the selection process.

This Notice is not part of, nor does it constitute, any employment contract or other service agreement.

If the Candidate is approved in the selection process and hired by Nu, the processing of their personal data will then be entirely governed by the Employee Privacy Notice.

10. CHANGES TO THIS NOTICE

Nu may change this Notice at any time, at Nu’s sole discretion. To check the date of the current version, please refer to the “Last updated” date at the end of this document. The changes will be effective from the stated last updated date.

11. CONTACT US

If You have any questions about this Notice or how we process Your personal data, You can contact us via email at dpo@nubank.com.br. 

This contact channel is available to all Candidates, regardless of their location, and can also be used to exercise the rights informed in this Notice.

For the exercise of rights guaranteed by data protection laws, please refer to the specific sections below to find the appropriate support channel. 

12. BRAZIL – ADDITIONAL INFORMATION FOR CANDIDATES UNDER THE GENERAL DATA PROTECTION LEGISLATION (LGPD)

This section applies to Candidates located in Brazil or whose personal data is processed in Brazil, under the scope of Law No. 13.709/2018 – the Brazilian General Data Protection Law (LGPD).

Nu processes personal data in accordance with the principles and legal bases provided in the LGPD, including consent (Art. 7, I), compliance with legal or regulatory obligations (Art. 7, II), and legitimate interest (Art. 7, IX).

Nu may transfer Your personal data internationally based on mechanisms permitted under Art. 33 of the LGPD, such as standard contractual clauses and ensures appropriate safeguards are in place.

With regards to Your right in automated decisions, we inform that: should you be subject to an entirely automated decision-making process through the course of Your candidacy which affects Your interests, You have the right to request a revision of the decision, as well as the right to obtain information about the criteria and procedure used in the decision, observing industrial and business secrecy.

You may exercise Your data subject rights through dpo@nubank.com.br. 

Additionally, You have the right to file a complaint before the Autoridade Nacional de Proteção de Dados (ANPD) at:

https://www.gov.br/anpd/pt-br/canais_atendimento/cidadao-titular-de-dados

13. EUROPEAN ECONOMIC AREA / UNITED KINGDOM – ADDITIONAL INFORMATION FOR CANDIDATES UNDER THE GDPR

This section applies to candidates located in the European Economic Area (EEA) or the United Kingdom, whose personal data is processed under Regulation (EU) 2016/679. For the purposes of this section, both are referred to collectively in this section as “GDPR”.

Nu processes Your personal data in accordance with Article 6 of the GDPR, based on grounds such as performance of pre-contractual steps (Art. 6(1)(b)), compliance with legal obligations (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)). Where required, we may ask for Your consent (Art. 6(1)(a) and Art. 9(2)(a)) for special categories of data.

You have additional rights under the GDPR, including:

• The right to object to processing where we rely on legitimate interest (Art. 21);
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects (Art. 22).

Your personal data may be transferred outside the United Kingdom or EEA to countries not recognized as providing an adequate level of protection. When this occurs, Nu uses mechanisms such as Standard Contractual Clauses approved by the European Commission or the UK Government and implements supplementary safeguards where necessary.

You also have the right to lodge a complaint with the competent supervisory authority in Your country of residence or work.

You may exercise these rights by contacting the recruiter who reached out to you or emailing dpo@nubank.com.br. 

14. CALIFORNIA – ADDITIONAL INFORMATION FOR CANDIDATES UNDER THE CCPA/CPRA

This section applies to Candidates who are residents of California and whose personal information is processed in accordance with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

Nu does not sell or share Your personal information as defined under the CCPA.

We may collect and disclose the following categories of personal information (as defined by Cal. Civ. Code § 1798.140) for the purposes described in this Notice:

• Identifiers (e.g., name, email, address)
• Professional or employment-related information
• Sensitive personal information (only if you voluntarily provide it)
• California residents have the following additional rights:
• The right to opt out of the sale or sharing of personal information;
• The right to limit the use and disclosure of sensitive personal information;
• The right to correct inaccurate personal information;
• The right to know what personal information we collect and how we use it;
• The right to delete personal information;
• The right to non-discrimination for exercising any of the above rights.

To exercise your rights, please follow the instructions provided in the “Data Subjects’ Rights” section above. You may also designate an authorized agent to make requests on your behalf, subject to verification.

You have the right to contact the California Attorney General at: https://oag.ca.gov/privacy/ccpa. 

You may exercise these rights by contacting the recruiter who reached out to You or emailing dpo@nubank.com.br. Last updated: July 11th, 2025.