Privacy Policy

1. Who we are

Employ Latam Labs ("Employ Latam", "we", "us") provides Employer of Record and contractor payment services across Latin America. We act as a data controller for our direct customers and as a data processor for the personal data of employees and contractors we administer on behalf of our customers.

2. What we collect

To deliver our services, we collect three categories of personal data:

• Customer data: business contact details (name, email, role, company), billing details, and authentication metadata.
• Employee & contractor data: full legal name, government tax IDs (RFC, RUT, CUIT, CPF, etc.), date of birth, address, bank or wallet details, salary, employment history, dependents and benefits elections, and signed contracts.
• Usage data: IP address, device fingerprint, log timestamps, and interaction events on the Employ Latam dashboard.

3. Why we collect it

• To draft and execute compliant local employment or contractor agreements.
• To run payroll, withhold taxes, and remit statutory contributions to local authorities.
• To enroll employees in mandatory and optional benefits.
• To verify identity and prevent fraud.
• To respond to lawful requests from labor courts and tax authorities in the relevant jurisdiction.

4. Legal basis

We process personal data on the basis of (a) contractual necessity, (b) compliance with local labor and tax law, (c) the legitimate interests of operating an EOR service, and (d) explicit consent where required by law, including under Brazil's LGPD and the GDPR.

5. Where we store it

Customer and employee records are stored in encrypted databases hosted in the European Union and the United States. Backups are encrypted at rest. Access is restricted to named Employ Latam staff under role-based access control with audit logging.

6. Sub-processors

We rely on a limited set of sub-processors for hosting, analytics, payroll execution, banking, and customer support. A current list is available on request. We sign data processing agreements with all sub-processors and review them annually.

7. Your rights

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of data we no longer need to hold (subject to legal retention requirements).
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, write to [email protected]. We'll respond within 30 days.

8. Retention

We retain employment records for the period required by local labor law (typically 5 to 30 years after the end of employment, depending on the country). Customer billing records are retained for 7 years for tax purposes. Logs are retained for 12 months.

9. Security

We maintain a SOC 2 Type II program, encrypt data in transit (TLS 1.2+) and at rest (AES-256), and run quarterly third-party penetration tests. Incidents that affect personal data are reported to affected customers within 72 hours of discovery.

10. Changes

We'll post material changes to this policy on this page and notify customers by email at least 30 days before they take effect.

11. Contact

Questions, requests, or complaints: [email protected].