PRACTIMATCH

PRIVACY POLICY

Last updated: March 22, 2026

1. Identity of the data controller

PRACTIMATCH S.A.C. (hereinafter, "Practimatch", "we" or "the Platform"), with Tax ID (RUC) No. 20612663441 and domicile in the district of San Borja, province and department of Lima, Peru, is the owner of the personal data bank and responsible for the processing of personal data collected through the web platform accessible at practimatch.com.

ANPDP Registration: Practimatch's personal data bank is registered with the National Registry of Personal Data Protection of the National Authority for Personal Data Protection (ANPDP) under code PJ-2026-153.

Contact: soporte@practimatch.com

2. Applicable legal framework

This Privacy Policy is governed by the following regulations:

  • Political Constitution of Peru, Article 2, paragraph 6 (right to personal data protection).
  • Law No. 29733, Personal Data Protection Law, and its amendments (Legislative Decree No. 1353).
  • Supreme Decree No. 016-2024-JUS, new Regulation of Law No. 29733, effective since March 30, 2025, which repeals Supreme Decree No. 003-2013-JUS.
  • Google API Services User Data Policy, applicable to the use of Google Sign-In.

3. Personal data we collect

3.1 Data provided by the user

When registering and using the Platform, we may collect the following personal data that you provide directly, as applicable to your account type:

Intern Users (students): full name, email address, phone number, profile photo, academic history (university, major, semester), curriculum vitae (CV), work experience, skills and job preferences, location, and supporting documents when required by the Platform.

Company Users: company name, corporate contact information, recruiter or user profile data, job opportunity postings and information related to selection processes.

Partner Universities: institutional information necessary for the administration of their students within the Platform, in accordance with applicable collaboration agreements.

3.2 Automatically collected data

We automatically collect: IP address, browser and device type, operating system, pages visited within the Platform, access dates and times, and cookie and similar technology data.

3.3 Data obtained through Google Sign-In

Practimatch offers the option to register and sign in through Google Sign-In (OAuth 2.0). This functionality is used exclusively for authentication and initial user identification purposes. When using this option, we access only the following data from your Google account:

  • Your full name (scope: profile).
  • Your email address (scope: email).
  • Your profile photo (scope: profile).
  • Unique user identifier (scope: openid).

We do not access any other data from your Google account, including contacts, Google Drive files, calendar, email content, or any other Google service. We do not request or use sensitive or restricted scopes.

4. Purpose of data processing

4.1 General purposes

We use your personal data to: create and manage your user account; facilitate the connection between interns, universities, and employer companies through our talent and employability services; personalize your experience on the Platform; communicate with you regarding opportunities, service updates, and relevant notifications; generate anonymous and aggregated statistics for the continuous improvement of our services; and comply with applicable legal and regulatory obligations.

4.2 Specific use of Google Sign-In data

Data obtained through Google Sign-In is used exclusively to: (a) authenticate your identity, (b) create your account on the Platform, and (c) pre-fill your initial profile with your name, email, and photo. Once incorporated into your Practimatch profile, this data becomes part of your profile information on the Platform and is governed by the general processing rules described in this Policy. We do not use data obtained directly from Google for advertising, commercial profiling, or any purpose other than authentication and initial profile creation. Practimatch does not access Google authentication tokens, session identifiers, or other technical data from your Google account beyond what is strictly necessary for the sign-in process.

4.3 AI-assisted tools

Practimatch uses AI-assisted tools for features such as opportunity recommendations, matching between intern profiles and job offers, and generating indicative rankings for companies. These tools operate as support for the decision-making process and do not independently determine hiring, acceptance, or the final outcome of any selection process. Final hiring or engagement decisions rest exclusively with Company Users and Partner Universities, as applicable. Data obtained from Google Sign-In is not used as input for matching, ranking, or recommendation algorithms.

5. Data storage and security

Your personal data, including data obtained through Google Sign-In, is stored and processed on infrastructure currently provided by Amazon Web Services (AWS) in the us-east-1 region (United States), including hosting, database, and authentication services (Amazon Cognito). Practimatch reserves the right to change its infrastructure provider, hosting region, or technology services, provided that adequate levels of protection are maintained in accordance with applicable regulations and subject to prior updating of this Policy.

We adopt reasonable technical, legal, and organizational measures to protect the security of your data, as required by Article 16 of Law No. 29733 and Title V of Supreme Decree No. 016-2024-JUS. These measures include: encryption of data in transit and at rest, role-based access controls, documented security policies, and access monitoring. No system is completely invulnerable; in the event of an incident, we will act in accordance with Section 12.

6. Data sharing and transfer

We do not sell your personal data. We share your data only in the following cases:

  • With employer companies registered on the Platform, to the extent necessary to provide our job intermediation services (professional profile, academic history, CV, skills, and contact data relevant to the hiring flow).
  • With partner universities, in accordance with current collaboration agreements, limited to affiliation, participation, and employability information of their students within their own institutional environment on the Platform.
  • With technology service providers (hosting, authentication, analytics) acting as data processors under confidentiality obligations.
  • When required by law, court order, or competent authority.

Data visibility within the Platform depends on the user type, their permissions, and the applicable workflow. Data from one institutional environment (tenant) is not shared with other institutional environments unless the operational flow requires it and the user has been duly informed.

Roles in data processing: Practimatch acts as the data controller for data collected directly through the Platform. When a Partner University or Company User uses Platform tools within their own environment to manage selection processes or talent administration, that entity may act as an independent controller or joint controller for decisions it makes regarding candidate data within its workflow.

Regarding Google Sign-In data: Google's technical authentication data (tokens, session identifiers) is not shared with third parties under any circumstances. Profile data originating from Google Sign-In (name, email, photo) that is incorporated into the user's Practimatch profile is treated as Platform profile data and is subject to the general sharing rules described in this section. We do not sell or transfer data obtained from Google to third parties for purposes unrelated to service provision.

Cross-border flow: Currently, personal data is stored and processed on AWS servers located in the United States (us-east-1 region), including the Amazon Cognito authentication service. Practimatch may change its infrastructure provider or the geographic location of its servers in the future, ensuring adequate levels of protection. Any international data transfer is carried out in accordance with Article 15 of Law No. 29733 and the applicable provisions of Supreme Decree No. 016-2024-JUS.

7. Data retention

We retain your personal data as long as your account is active and necessary for the purposes described in this Policy. Specific retention periods for each data category will be established according to applicable operational and legal needs.

Once you request the deletion of your account or revoke your consent, we will proceed to delete your data within a reasonable period, in accordance with our internal account management and compliance processes. Certain data may remain in backups, system logs, or audit files for a limited period before final deletion, or when there is a legal, contractual, or regulatory obligation requiring its retention. Authentication data obtained through Google Sign-In is deleted together with your account.

Additionally, you may revoke Practimatch's access to your Google account at any time from your Google account permissions settings at myaccount.google.com/permissions.

8. Rights of the data subject (ARCO-P Rights)

In accordance with Law No. 29733 and Supreme Decree No. 016-2024-JUS, you have the right to: Access (know what data we hold about you), Rectification (correct inaccurate or incomplete data), Cancellation (request the deletion of your data), Opposition (object to processing in certain circumstances), and Portability (request your data in a structured and commonly used format, to the extent technically feasible and in accordance with Article 20 of S.D. 016-2024-JUS).

To exercise any of these rights, send your request to soporte@practimatch.com indicating your full name, the right you wish to exercise, and the reasons for your request. We will respond within a maximum of ten (10) business days from receipt of the complete request, in accordance with applicable regulations. If you are not satisfactorily attended, you may file a complaint with the National Authority for Personal Data Protection (ANPDP), headquartered at the Ministry of Justice and Human Rights (Calle Scipión Llona 350, Miraflores, Lima, Peru).

9. Age restriction

The Platform is intended exclusively for persons over eighteen (18) years of age. We do not intentionally collect personal data from minors. If we become aware that a minor under 18 has provided personal data through the Platform, we will proceed to delete such information as soon as reasonably possible.

10. Cookies and similar technologies

We use cookies and similar technologies for the operation of the Platform, session authentication, usage analysis, and improvement of our services. You may configure your browser to reject cookies, although this may affect the functionality of the Platform. For more information, please consult your browser settings.

11. Compliance with Google Data Policy

The use and transfer to any other application of information received from Google APIs by Practimatch adheres to the Google API Services User Data Policy, including the Limited Use requirements. This means that Practimatch: limits the use of Google data to authentication and initial profile creation as user-visible features; does not transfer Google's technical authentication data to third parties; does not use Google data for advertising or commercial profiling; and protects Google data with reasonable and adequate security practices.

12. Security incident notification

In the event of a security incident that compromises personal data, Practimatch will notify the ANPDP within forty-eight (48) hours of becoming aware of the incident, in accordance with Supreme Decree No. 016-2024-JUS. We will also notify affected data subjects when the incident may pose a relevant risk to their rights or freedoms.

13. Modifications to this Policy

Practimatch reserves the right to update this Privacy Policy. Any substantial modification will be notified to users through the Platform or by email before it takes effect. Continued use of the Platform after notification of changes will constitute acceptance of the updated Policy. In accordance with the Google API Services User Data Policy, if we modify the use of data obtained from Google, we will request your express consent before applying such changes.

14. Contact

For any inquiry, request, or complaint related to this Privacy Policy or the processing of your personal data, you may contact us through:

Email: soporte@practimatch.com Legal name: PRACTIMATCH S.A.C. Tax ID (RUC): 20612663441 Address: San Borja, Lima, Peru