1. Data controller
The controller responsible for processing the data collected in this process is Eulen (the DePix issuing entity), whose contact email address is privacy@eulen.app.
2. Data we collect
When you fill in the DePix operator application form, we collect the following information:
- Personal identification: full name, role in the company, corporate email address.
- Company data: registered company name, website, CNPJ or foreign registration number, country of operation.
- Business data: product description, target audience, payment flow, estimated financial volumes, customer acquisition channels and compliance status.
- Technical data: session identifier (a UUID generated locally in your browser), IP address (through Cloudflare Turnstile, for fraud prevention).
- Incomplete application data: if you close the form without finishing it after answering at least 3 questions, we send our server your full name, corporate email, chosen language and the question you stopped at. This allows us to contact you to help you complete the application. You may revoke this contact at any time (see section 7).
3. Purpose of the processing
The data collected is used exclusively for:
- Qualifying and assessing candidates to become DePix operators, including automated analysis by a language model (LLM) for the initial screening.
- Fraud prevention and verification of the candidate’s identity.
- Communicating with the candidate about the progress and the outcome of the qualification process.
- Keeping an audit trail of automated decisions, as required by the LGPD (the Brazilian General Data Protection Law).
- In the case of an incomplete application (item 5 of section 2): contact by email to offer support in completing the form, either at the candidate’s request or after an internal assessment of relevance.
The legal basis for this processing is Eulen’s legitimate interest in selecting qualified partners (article 7, IX of the LGPD) and, for completed applications, the express consent given when the form is submitted. Contact by email about incomplete applications relies exclusively on legitimate interest and may be revoked at any time (see section 7).
4. Who has access to the data
Access to the data is strictly limited to:
- The Eulen team responsible for operator qualification (designated members with controlled access to the internal CRM).
- Anthropic, Inc. (USA) — for processing by the language model (Claude) used in the automated screening. See section 6 for details on the international transfer.
- Cloudflare, Inc. (USA) — for anti-bot validation through Turnstile. Only the IP address and the challenge token are shared.
The data is not sold, shared with commercial third parties or used for marketing purposes.
5. Retention period
Personal data from completed applications is retained for 24 months from the final decision on the application (approval, rejection or closure of the process). After that period the data is anonymized: the personal identifiers (name, email, CNPJ) are replaced by irreversible hashes, and the application reference is kept only for statistical audit purposes.
Data from incomplete applications (forms started but not submitted, as described in item 5 of section 2) is retained for 180 days. After that period the name and the email are removed automatically; the number of questions answered and the last question viewed are kept anonymously for statistical analysis of the abandonment funnel.
Technical traceability data (execution logs of the automated workflow) is retained for at most 30 days, for the purpose of debugging systemic errors.
6. International data transfer
For the automated analysis, the form answers are sent to Anthropic, Inc., a company headquartered in the United States, for processing by the Claude language model. This international transfer is covered by the express consent given by the candidate when accepting this policy and submitting the form. Anthropic applies technical and organizational data protection measures consistent with international security standards.
Anthropic does not retain the data after the request has been processed, as stated in its privacy policy.
7. Your rights as a data subject
Under the General Data Protection Law (Law no. 13,709/2018), you have the following rights:
- Confirmation and access: to request confirmation that processing exists and access to your data.
- Correction: to request the correction of incomplete, inaccurate or outdated data.
- Deletion (right to be forgotten): to request the erasure of your personal data. We answer requests of this kind by email within 15 business days.
- Portability: to request the export of your data in a structured format.
- Withdrawal of consent: to withdraw your consent at any time, without affecting the processing carried out beforehand.
- Objection to automated processing: to request human review of decisions taken exclusively by automated means.
To exercise any of these rights, send an email to: privacy@eulen.app
We will identify your request by the corporate email given in the form or by any other data that lets us link the request to the application.
8. Data security
We apply technical and organizational measures to protect the data against unauthorized access, loss, alteration or improper disclosure, including: encrypted transmission (HTTPS/TLS), role-based access control (RBAC) in the internal CRM, storage on continuously monitored servers and a data minimization policy in the audit records.
9. Updates to this policy
This policy may be updated from time to time to reflect changes in the qualification process, in the applicable legislation or in our privacy practices. When relevant changes are made, the “last updated” date at the top of this document will be changed. Applications in progress whose processing has already begun remain governed by the version of the policy in force when the form was submitted.
10. How this policy differs
This policy applies exclusively to the DePix operator qualification process and is distinct from the general privacy policy of the depix.info website, which governs the processing of data of site visitors, DePix end users and candidates who get in touch through other channels. In the event of a conflict, this specific policy prevails for the operator qualification process.