Last updated: November 6, 2026 · Version: 2.0
This Privacy Policy explains how Peaku collects, uses, shares, transfers, retains and protects the personal data of the people it interacts with through its website peaku.co, its recruitment and assessment platform, and its headhunting, Employer of Record (EOR) and Peaku Verify services (together, the "Services").
Data controllers. The Services are provided jointly by two companies of the same group ("Peaku", "we", "us"):
| Entity | Identification | Address | Primarily responsible for |
|---|---|---|---|
| PEAKU S.A.S. | Colombian tax ID (NIT) 901.125.230 | Carrera 43D #5-113, Medellín, Colombia | Data subjects located in Colombia, Brazil, Mexico, Argentina, Chile and the rest of Latin America; headhunting, EOR and the platform |
| PeakU, Inc. | Delaware corporation, United States | 16192 Coastal Highway, Lewes, Delaware 19958, United States | Client companies and data subjects located in the United States; billing and contracts with U.S. clients |
Both entities act as joint controllers when they jointly determine the purposes and means of processing (for example, in the shared candidate database and common internal systems), and have agreed their respective responsibilities in writing. Whichever entity is the controller in a given case, you may exercise your rights before either of them through the channel in section 17, and the entity that receives your request will handle it.
What this policy covers. This policy applies to all personal data that Peaku processes as a controller, regardless of the country where you are located. When Peaku processes data on behalf of a client company (as a processor), the processing is also governed by the contract with that company and by that company's privacy policy; section 6 explains these cases.
What it does not cover. This policy does not cover third-party websites, applications or services we link to, nor the processing that client companies carry out on candidate data once they receive it, for which each client company is responsible.
Legal framework. Peaku complies with the data protection laws applicable in each country where it operates, in particular: Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and related regulations, in Colombia; the Lei Geral de Proteção de Dados (Law No. 13.709/2018, "LGPD"), in Brazil; the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other state privacy laws and the Fair Credit Reporting Act ("FCRA"), in the United States; the 2025 Federal Law on the Protection of Personal Data Held by Private Parties ("LFPDPPP"), in Mexico; Law 25.326, in Argentina; and Law 21.719, in Chile. Section 15 contains country-specific provisions, which prevail over the general provisions in case of conflict.
By using the Services, registering on the platform, applying to a job or providing us your data by any means, you acknowledge that you have read this policy. Where the law requires your prior, express and informed authorization, we will request it separately and verifiably before processing your data.
We process data about five categories of people ("data subjects" or "you"). Some sections apply only to one of them and say so expressly.
| Category | Who they are | How their data reaches Peaku |
|---|---|---|
| Contacts at client or prospective companies | People representing a company that hires, evaluates or receives information about the Services (executives, recruiters, talent teams, procurement, finance) | Website forms, sales meetings, contracts, referrals, commercial databases and public professional sources |
| Platform users | People with an account on the Peaku platform on behalf of a client company, to search candidates, post jobs, run assessments or manage processes | Registration by the client company or by the user |
| Candidates | Professionals, mostly in technology, who register on peaku.co, apply to a job, are contacted by Peaku or whose profile is part of Peaku's talent database | Registration, applications, referrals, direct outreach by our team, public professional sources, and information provided by client companies that engage us for a search |
| EOR workers | People employed by Peaku in Colombia or another Latin American country to provide services to a client company under the Employer of Record model | Hiring process and employment relationship |
| Visitors | Anyone who browses peaku.co or interacts with our content and communications | Cookies, forms, subscriptions and emails |
The Services are not directed at people under 18 and we do not knowingly collect data from minors (see section 8).
The following terms have the meaning indicated, in singular or plural, and are interpreted under the law applicable to the data subject.
We collect only the data necessary for the purpose that justifies it. The categories by type of data subject are:
| Data subject | Data we process |
|---|---|
| Contacts at client or prospective companies | Name, title, company, business email, phone, country, public professional profile, history of communications and meetings, billing and contract data |
| Platform users | Name, email, title, company, login credentials (encrypted password or Google sign-in), platform activity logs, preferences |
| Candidates | Identification (name, ID type and number where required, date of birth, nationality), contact details (email, phone, city, country), résumé and professional data (education, experience, skills, languages, portfolio, public professional profiles), salary expectations and availability, results of knowledge, personality and coding assessments, interview recordings and transcripts when you authorize them, employment references and, only in Peaku Verify and with your express authorization, identity validation and background verification data (see section 7) |
| EOR workers | In addition to candidate data: identity document, address, bank details for payroll, social security enrollments, beneficiaries, tax information, employment contract, payroll events, sick leave and other leave, performance reviews shared by the client company, and immigration data where applicable |
| Visitors | IP address, device and cookie identifiers, browser type and operating system, pages visited, date, time and duration of the visit, referral source, and the data you provide in forms or subscriptions |
Data we do not collect. We do not request payment card data: payments are processed directly by PCI-DSS certified providers (see section 10). We do not collect precise geolocation data or data about minors.
Sources. We obtain your data directly from you; from the client company that engages us for a search or registers you as a user; from referrals; from publicly accessible sources and professional networks where you have published your profile, in which case we will inform you of this policy and obtain your authorization at first contact; from commercial data providers regarding company contacts; and automatically through cookies and Service logs.
Third-party data you provide. If you give us data about another person (a job reference, a beneficiary, a contact at your company), you represent that you are entitled to do so and have informed that person about this policy.
We process your data only for the purposes described below. The legal basis shown is the one that applies in countries whose law requires identifying it (Brazil, Chile, Mexico, United States); in Colombia and Argentina, processing relies on your prior, express and informed authorization, except for the legal exceptions (performance of a contract, compliance with a legal obligation, request from an authority).
| Purpose | Applies to | Legal basis |
|---|---|---|
| Answer information requests, prepare proposals, negotiate, sign and perform contracts with client companies, invoice and collect | Client contacts, users | Performance of a contract or pre-contractual steps; legitimate interest in managing the business relationship |
| Create and manage platform accounts, authenticate users, provide support and secure the service | Users | Performance of a contract; legitimate interest in security |
| Include your profile in Peaku's talent database, evaluate it and present it to client companies for current or future jobs that match your profile | Candidates | Candidate's authorization; in Brazil, consent or steps prior to a contract at the data subject's request |
| Run selection processes: interviews, knowledge, personality and coding assessments, references, coordination with the client company | Candidates | Authorization; pre-contractual steps at the data subject's request |
| Provide Peaku Verify: validate identity and verify the candidate's background at the client company's request | Candidates | Candidate's express and specific authorization; FCRA compliance where applicable |
| Hire, manage the employment relationship, run payroll, enroll in social security, comply with labor, tax and immigration obligations under the EOR model | EOR workers | Performance of the employment contract; compliance with legal obligations |
| Send business communications about Peaku Services, news, events and content | Client contacts, users, subscribed visitors | Legitimate interest in promoting services to business contacts, with the right to object at any time; consent where the law requires it |
| Send candidates information about jobs, the status of their processes and professionally relevant content | Candidates | Authorization; legitimate interest in keeping active candidates informed |
| Operate, analyze and improve the Services, produce aggregate statistics and tech labor market studies (for example, salary trend reports) without identifying individuals | All | Legitimate interest; published reports use only aggregated or anonymized data |
| Train and tune profile search and matching models (see section 9) | Candidates, users | Legitimate interest in improving service quality, with minimization and pseudonymization measures |
| Prevent fraud, verify identity, protect the security of systems and people | All | Legitimate interest; compliance with legal obligations |
| Comply with legal, accounting and tax obligations and requests from authorities; establish, exercise or defend legal claims | All | Compliance with legal obligations; regular exercise of rights |
| Evaluate or carry out a merger, acquisition, financing or sale of Peaku assets | All | Legitimate interest, with the safeguards in section 10 |
Where we rely on legitimate interest, we have assessed that our interest does not override your rights and freedoms, and you may object to the processing as described in section 14. Where we rely on your authorization or consent, you may withdraw it at any time without affecting the lawfulness of prior processing or of processing that has another legal basis.
We will not use your data for purposes incompatible with the above without informing you in advance and, where the law requires, obtaining a new authorization.
In several Services the client company decides which data is processed and why, and Peaku processes it under the client's instructions. In those cases the client company is the controller and Peaku is the processor. This happens, for example, when a client company:
In these cases Peaku: (i) processes the data only to provide the contracted Service and under the client company's documented instructions; (ii) signs a Data Processing Agreement with each client company that meets the requirements of applicable law; (iii) applies the security measures in section 13; (iv) subcontracts only to providers that offer equivalent guarantees, under a written contract; (v) assists the client company in handling data subject rights and notifying incidents; and (vi) returns or deletes the data when the service ends, unless the law requires retaining it.
If you are a candidate in a process that a client company manages on our platform, that company is responsible for informing you and handling your rights; if you contact us directly, we will help you and forward your request to the client company. This does not limit the rights you may exercise before Peaku regarding the processing for which Peaku is the controller (sections 5 and 14).
The client company warrants that it has the legal basis and, where applicable, the data subjects' authorization to provide us their data and for the purposes it instructs.
Peaku Verify is a service through which, at a client company's request and only with your prior, express, specific and written authorization (including electronic means), we validate that you are who you say you are and verify the information you have declared in your selection process.
What a verification may include. Depending on the scope contracted by the client company and the law of the country of the job: identity validation by comparing your identity document with a capture of your face during a live interview; verification of academic degrees and certifications; verification of work experience and references; checks of public sanctions lists, disqualifications and criminal, disciplinary or fiscal records that the law of the country allows to be checked for employment purposes; and review of publicly available professional information.
What we do not do. We do not check credit information or sensitive data (health, union membership, sexual orientation, beliefs, ethnic origin) unless the law of the country requires it for the position and you expressly authorize it. We do not check records that applicable law prohibits considering for employment decisions.
Biometric data. Identity validation may involve processing your facial image to compare it with your document. This processing requires your express and specific consent, which you may refuse; the biometric template is used only for the comparison, is not used for any other purpose and is deleted within a maximum of 30 days after the verification is completed. Where the law requires a specific biometric retention policy (for example, Illinois, Texas or Washington in the United States), we apply the strictest one.
Your guarantees. Before starting a verification we will tell you what will be verified, from which sources and who will receive the result. You have the right to know the result, to request correction of inaccurate information and to have disputed information re-verified. The result is delivered only to the client company that requested it, which is responsible for the hiring decision; Peaku does not make that decision.
United States (FCRA). When the verification is carried out for an employment decision in the United States, it is additionally governed by the Fair Credit Reporting Act and equivalent state laws: you will receive a clear and conspicuous stand-alone disclosure and must authorize the verification in writing; if the client company intends to take an adverse action based on the report, it must first provide you a copy of the report and a summary of your rights under the FCRA, and you will have the opportunity to dispute its content. Verifications are limited to the information and look-back periods that the FCRA and state laws allow to be reported.
Retention. Verification reports are retained for 12 months from issuance, or any longer period required by applicable law to handle disputes, and are then deleted.
Sensitive data. We do not request sensitive data in our registration forms or selection processes, and we ask you not to include it in your résumé. If you include it voluntarily, we understand that you authorize its processing for the corresponding selection process; even so, we will not use it as an evaluation criterion or share it beyond what is necessary, and you may ask us to delete it at any time. You are not obliged to authorize the processing of sensitive data and refusing does not affect your participation in any process.
We process sensitive data only in these cases: (i) health data of EOR workers (sick leave, other leave, occupational exams, enrollments) strictly to comply with labor and social security obligations; (ii) biometric data in Peaku Verify, with your express consent (section 7); (iii) when the law of the country of the job requires collecting a sensitive data item for the position and you authorize it; and (iv) when required by a legal obligation or an order from an authority. We apply enhanced access controls and encryption to this data.
Biometric data. We process it only in Peaku Verify, as described in section 7. We do not sell it, do not use it to identify people outside the authorized verification and do not share it with third parties other than the technology provider that performs the comparison under a confidentiality agreement.
Minors. The Services are directed at people aged 18 or older. We do not knowingly collect data from minors; if we learn that we have done so, we will delete it. If you are the parent or legal guardian of a minor who has provided us data, contact us (section 17). In Colombia, minors' data would only be processed when it serves their best interest and with the authorization of their legal representative; in the United States we comply with the Children's Online Privacy Protection Act (COPPA) and do not collect data from children under 13 or sell data of minors under 16.
We use software tools, including artificial intelligence models, to make talent search and evaluation more efficient. Specifically:
No solely automated decisions with significant effects. Peaku does not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (such as rejecting you from a process) without meaningful human involvement. You have the right to request human review of any automated decision, to obtain information about the criteria used and to express your point of view, under Article 20 of the LGPD, Chile's Law 21.719, Mexico's LFPDPPP and the CCPA regulations on automated decision-making technology.
Fairness and non-discrimination. We design and review our tools so that they do not use sensitive data, or variables that act as proxies for it, as criteria. Where the law of the job location requires bias audits or specific notices to candidates about the use of automated employment decision tools (for example, New York City Local Law 144, the Colorado Artificial Intelligence Act or California regulations), we cooperate with the client company to comply and make the necessary information available.
Model training. We may use platform data, previously pseudonymized or aggregated, to improve the accuracy of our search and evaluation tools. We do not use your data to train third-party models or hand it to AI providers to train their own models; the AI providers we use are contractually bound not to retain or use the data for their own purposes.
We share personal data only when necessary to provide the Services, comply with the law or protect rights, and always under contracts that require confidentiality and security.
| Recipient | What we share and why |
|---|---|
| Client companies | Profiles, résumés, assessment results and verification reports of candidates you have authorized us to present for jobs, or that the company manages on the platform. Each client company is contractually bound to use the data only for its selection process and in accordance with the law |
| Peaku group entities | PEAKU S.A.S. and PeakU, Inc. share data with each other to operate the Services, under the joint controllership agreement described in section 1 |
| Infrastructure and software providers (processors) | Cloud hosting and databases (Amazon Web Services), CRM and marketing automation (HubSpot), web analytics (Google Analytics), transactional email (Mailgun), authentication (Google), video calls, transcription and AI tools, e-signature, support and communications. They act under our instructions and may not use the data for their own purposes |
| Payment processors | Stripe and banks process payments from client companies; Peaku does not store card data. These providers comply with the PCI-DSS standard and have their own privacy policies |
| Verification providers | Identity validation and background check providers that perform parts of Peaku Verify under contract and only with your authorization |
| Payroll, social security and benefits operators | For EOR workers: social security entities, pension and severance funds, banks, insurers, payroll operators and benefits providers, under the labor law of the country |
| Professional advisors | Lawyers, accountants, auditors and insurers, bound by confidentiality |
| Authorities | Judicial, administrative, labor, tax or data protection authorities, when required by law or a valid order, or to protect rights and safety or prevent fraud |
| Buyers or investors | In a merger, acquisition, financing or sale of assets, under confidentiality and with the obligation to honor this policy; we will notify you before your data becomes subject to a different policy |
We do not sell your personal data. Peaku does not sell or rent personal data to third parties for money or other valuable consideration, and does not share it for cross-context behavioral advertising. Presenting candidate profiles to client companies is part of the recruitment service you authorize and is subject to the contractual limits above. We also do not sell or share data of minors under 16. If applicable law were ever to treat any disclosure as a "sale" or "sharing", you may opt out through the channel in section 17, and we honor opt-out preference signals (such as Global Privacy Control) on our website.
We provide the current list of main processors on request from the data subject or the client company.
Peaku operates in the corridor between Latin America and the United States, so your data may be transferred or transmitted to countries other than the one where you are located, in particular to the United States (where PeakU, Inc., most of our cloud and software providers and many client companies are located) and to Colombia (where PEAKU S.A.S. and its operations team are located). It may also be transferred to the country of the client company to which you authorize us to present your profile.
Some of these countries have not been recognized as providing an adequate level of protection by the authority of the country where the data originates. To make the transfer lawful we apply, depending on the law of origin, one or more of these mechanisms:
In all cases we require the recipient to apply security measures equivalent to those in section 13 and to commit to honoring your rights. You may ask us for more information about the mechanisms applied to a specific transfer through the channel in section 17.
We keep your data only for as long as necessary to fulfill the purpose for which it was collected and the associated legal obligations. Reference periods are:
| Data | Retention period |
|---|---|
| Candidate profile in the talent database | No fixed period: for as long as the purpose of presenting you job opportunities subsists and you neither withdraw your authorization nor request deletion. We will periodically ask you to update your data. If there is no activity (update, application or reply to an outreach) for 5 years, we will ask whether you wish to remain in the database; without a reply, we anonymize the profile |
| Data from a specific selection process (interviews, assessments, recordings) | 2 years from the close of the process, to handle claims and evaluate related new jobs; interview recordings are deleted after 6 months |
| Peaku Verify reports | 12 months from issuance, or any longer period required by law (section 7) |
| Biometric templates | Maximum 30 days after verification |
| Client company contact and user data | During the business relationship and up to 5 years after it ends, unless you object to business communications earlier |
| Contracts, invoices and accounting records | The period required by the commercial and tax law of each country (10 years in Colombia under article 28 of Law 962 of 2005 and the Commercial Code) |
| EOR worker employment files | During the employment relationship and afterwards for the period required by the labor and social security rules of the hiring country (in Colombia, social security and payroll records are kept indefinitely for pension purposes) |
| Records of authorizations and rights requests | For the duration of the processing plus 5 years, as evidence of compliance |
| Browsing data and cookies | As described in section 16; server logs are kept for up to 12 months |
Once the period expires, we securely delete the data or irreversibly anonymize it for statistical use. We may keep it longer when necessary to comply with a legal obligation, respond to an authority's request or establish, exercise or defend legal claims in ongoing proceedings. Backups are overwritten in cycles of up to 90 days.
We apply technical, organizational and administrative measures proportionate to the risk to protect your data against unauthorized access, loss, alteration or disclosure. These include: encryption of data in transit (TLS) and at rest; role-based access control and least privilege; multi-factor authentication for staff; access logging and monitoring; segregation of each client company's data; backups; vendor assessment before engagement; confidentiality agreements and regular staff training; and security reviews of the platform.
No system is completely secure. If a security incident affects your personal data and may pose a relevant risk to you, we will notify you and the competent supervisory authority within the periods required by applicable law (for example, the ANPD in Brazil within 3 business days of becoming aware of the incident, under Resolution CD/ANPD No. 15/2024; the Superintendencia de Industria y Comercio in Colombia; data subjects and state authorities in the United States under breach notification laws), explaining what happened, which data was affected and what measures we took. When we act as a processor, we will notify the client company without undue delay so that it can meet its own obligations.
You also contribute to security: keep your credentials confidential, use strong passwords and tell us immediately if you suspect unauthorized access to your account.
Regardless of the country where you are located, you have the following rights over your personal data, under the terms and within the limits of the law that applies to you:
How to exercise them. Send your request to contact@peaku.co or by post to the address in section 1, stating: your full name and, where needed to verify your identity, your identification document or the account from which you write; the right you are exercising and the facts behind it; a contact address for the reply; and any supporting documents. You may act through a representative who proves their authority. Platform users may also update or delete part of their data directly from their account, and candidates may unsubscribe from communications using the link in every email.
Verification. Before responding we will verify your identity using means proportionate to the sensitivity of the request, to avoid disclosing data to the wrong person. We will not use the information you provide for verification for any other purpose.
Response times. We respond within the periods required by the law of your country and, in any case, within a maximum of 15 business days for inquiries and claims, except where the law sets shorter periods:
| Country | Statutory period |
|---|---|
| Colombia | Inquiries: 10 business days, extendable by 5. Claims: 15 business days, extendable by 8; an incomplete claim must be completed within 5 days; without a reply within 2 months it is deemed withdrawn |
| Brazil | Confirmation and access: immediately in simplified format or within 15 days in full format; other rights, within a reasonable period as determined by the ANPD |
| United States (CCPA and state laws) | 45 days, extendable by 45 more with notice; opt-out requests regarding sale or sharing are honored within 15 business days |
| Mexico | 20 business days to respond, and 15 additional business days to give effect to the right, each extendable by the same period |
| Argentina | Access: 10 calendar days. Rectification, update or deletion: 5 business days |
| Chile | 30 business days from receipt of the request |
Exercising these rights is free of charge. We may charge a reasonable fee only where the law allows it, for example for manifestly repetitive requests, and we will always tell you in advance. If we deny a request in whole or in part, we will explain the reasons and how you can challenge the decision.
These provisions supplement the previous sections for data subjects located in each country and prevail in case of conflict.
PEAKU S.A.S. is the controller under Law 1581 of 2012 and Decree 1377 of 2013. This document constitutes the Personal Data Processing Policy and the privacy notice required by those rules. Processing is governed by the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality.
We request your prior, express and informed authorization before processing your data, in writing, orally or through unequivocal conduct from which it can reasonably be concluded that you granted it, and we keep evidence of it. Authorization is not required for public data, for processing ordered by an authority in the exercise of its functions, or in the other cases of article 10 of Law 1581. Authorization for sensitive data is optional and is requested expressly and separately.
You have the rights in article 8 of Law 1581: to know, update and rectify your data; to request proof of authorization; to be informed about how your data has been used; to file complaints with the Superintendencia de Industria y Comercio (SIC); to withdraw authorization and request deletion when legal principles, rights and guarantees are not respected; and to access your data free of charge. The procedure for inquiries and claims is that of articles 14 and 15 of Law 1581 (periods in section 14). You may file a complaint with the SIC only after exhausting the inquiry or claim procedure before Peaku.
Responsible area: Legal Area, contact@peaku.co, Carrera 43D #5-113, Medellín, Colombia. Supervisory authority: Superintendencia de Industria y Comercio, Delegatura para la Protección de Datos Personales, www.sic.gov.co. Peaku's databases are registered in the National Database Registry (RNBD) where the rules require it. This policy is effective from publication, and databases have the retention periods indicated in section 12.
For data subjects located in Brazil, PEAKU S.A.S. acts as controlador under the LGPD, and in the cases of section 6 as operador. The legal bases we use are those of article 7 of the LGPD: consent, performance of a contract or preliminary procedures at the data subject's request, compliance with a legal or regulatory obligation, regular exercise of rights and legitimate interest (with the balancing test of article 10). Sensitive data is processed only with specific and highlighted consent or in the cases of article 11.
You have the rights in article 18: confirmation of the existence of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about the third parties with whom we share data, information about the possibility of not giving consent and its consequences, withdrawal of consent, objection and review of automated decisions (art. 20). International transfers are carried out under article 33 and Resolution CD/ANPD No. 19/2024 (section 11).
Data protection officer (DPO / encarregado): Juan Pablo Isaza, juan@peaku.co. Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD), www.gov.br/anpd.
PeakU, Inc. is the responsible entity for client companies and data subjects located in the United States. We process data in accordance with Section 5 of the FTC Act, applicable state privacy laws and, for Peaku Verify, the FCRA (section 7).
California residents (CCPA/CPRA). This subsection is the notice required by the CCPA. In the last 12 months we have collected the following categories of personal information: identifiers (name, email, phone, IP address, account); categories under Cal. Civ. Code § 1798.80(e) (name, address, phone, education, employment history); commercial information (services contracted); internet activity (interaction with the website and platform); professional or employment-related information (résumé, experience, assessment results, references); audio and visual information (interview recordings, with your authorization); inferences limited to a profile's fit with a job; and sensitive personal information only when you provide it voluntarily or in Peaku Verify (identity document, biometric data for identity validation). Sources, purposes and recipients are those in sections 4, 5 and 10. We do not sell or share personal information within the meaning of the CCPA, have not done so in the last 12 months, and have no actual knowledge of selling or sharing data of minors under 16. We use sensitive personal information only to provide the Services you request and for the purposes permitted by the CCPA regulations.
You have the right to: know what personal information we collect, use and disclose and for what purposes; access it; request its deletion; correct inaccurate information; opt out of sale or sharing (not applicable, as we do not sell or share); limit the use of sensitive personal information; and not be discriminated against for exercising these rights. You may exercise them by writing to contact@peaku.co, directly or through an authorized agent with written permission. We will verify your identity by matching the information you provide with the information we hold. We respond within 45 days, extendable by 45 more. We honor Global Privacy Control signals as a valid opt-out request. To request the annual information about disclosures to third parties for direct marketing purposes under the Shine the Light law (Cal. Civ. Code § 1798.83), write to the same email; we do not make such disclosures. Our website does not respond to browser "Do Not Track" signals, but does respond to Global Privacy Control.
Other states. If you reside in a state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island), you have equivalent rights of access, correction, deletion, portability and opting out of targeted advertising, sale of data and profiling with significant effects, to the extent those laws apply to data processed in an employment or business context. You may exercise them through the same channel and, if we deny your request, appeal by writing to the same email with the subject "Privacy appeal"; we will respond to the appeal within 45 days and, if we uphold the denial, tell you how to contact your state Attorney General.
Biometric data. For residents of Illinois (BIPA), Texas (CUBI) and Washington, biometric data in Peaku Verify is processed only with your informed written consent, is not sold or disclosed except to complete the authorized verification, and is destroyed as described in section 7 and, at the latest, within the period those laws require.
PEAKU S.A.S. is the controller under the Federal Law on the Protection of Personal Data Held by Private Parties published on March 20, 2025 and its regulations. This section, together with the rest of this document, constitutes the comprehensive privacy notice (aviso de privacidad integral). Primary purposes are those necessary for the legal relationship with you (section 5); secondary purposes (business communications, statistics) may be refused by you from the outset or at any time, without preventing the provision of the Services. The transfers we make are those in sections 10 and 11; transfers not exempted by article 37 of the law require your consent, which we will deem granted if you do not object, except for sensitive or financial data, for which express consent will be requested.
You may exercise your rights of access, rectification, cancellation and objection (ARCO rights), withdraw your consent and limit the use or disclosure of your data, by request to contact@peaku.co meeting the requirements in section 14; we will respond within 20 business days and give effect to the response within the following 15 business days. To stop receiving business communications you may also register with PROFECO's Public Registry to Avoid Advertising. Supervisory authority: Secretaría Anticorrupción y Buen Gobierno, which took over the functions of the former INAI. Changes to this notice will be published at peaku.co.
PEAKU S.A.S. is the controller under Law 25.326 and its Regulatory Decree 1558/2001. The data subject may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown, under article 14(3) of Law 25.326. The Agencia de Acceso a la Información Pública (AAIP), the supervisory body for Law 25.326, is empowered to handle complaints and claims regarding non-compliance with personal data protection rules. Transfers to countries without an adequate level of protection, such as the United States, are made with your consent or under the model contracts of Disposition 60-E/2016 (section 11). You may at any time request removal or blocking of your name from databases used for business communications (art. 27). Peaku's databases containing Argentine data subjects are registered in the AAIP's National Database Registry where applicable. Supervisory authority: Agencia de Acceso a la Información Pública, www.argentina.gob.ar/aaip.
For data subjects located in Chile, Law 21.719 applies, effective December 1, 2026, which creates the Agencia de Protección de Datos Personales; until that date Law 19.628 governs. The lawful bases we use are those of article 13 of Law 21.719: consent, compliance with a legal obligation, performance of a contract or pre-contractual steps, and legitimate interest. You have the rights of access, rectification, deletion, objection, portability and blocking, and the right not to be subject to decisions based solely on automated processing; we will respond within 30 business days. If we deny your request, you may file a claim with the Agencia de Protección de Datos Personales and subsequently with the courts. International transfers are carried out under articles 27 to 29 of Law 21.719 (adequate country, contractual clauses, consent or necessity for the performance of a contract). Supervisory authority: Agencia de Protección de Datos Personales.
We use cookies, pixels, tags and similar technologies on peaku.co and on the platform. A cookie is a small file the website stores on your device to recognize it on later visits.
| Type | Purpose | Managed by | Duration |
|---|---|---|---|
| Necessary | Authentication, security, load balancing, remembering your cookie choice. Without them the site does not work | Peaku | Session or up to 12 months |
| Functional | Remembering language, preferences and platform settings | Peaku | Up to 12 months |
| Analytics | Measuring visits, page views, traffic sources and performance, in aggregate, to improve the site | Google Analytics, HubSpot | Up to 24 months |
| Marketing and CRM | Recognizing company contacts who visit the site from our emails and measuring campaigns | HubSpot | Up to 13 months |
We do not use cookies for third-party behavioral advertising or to sell data. Analytics and marketing cookies are only set with your consent, which you may give or withdraw from the cookie banner or your browser settings; refusing them does not affect access to the site. You may also install the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout) and review the privacy policies of Google (policies.google.com/privacy) and HubSpot (legal.hubspot.com/privacy-policy). Our emails may include pixels that tell us whether they were opened; you can block them by disabling image loading in your email client.
Changes. We may update this policy to reflect changes in the Services, the law or our practices. We will publish the updated version at peaku.co with the date of last update. If the change is material (for example, new purposes, new recipients or changes to your rights), we will notify you by email or through a prominent notice on the platform at least 15 days in advance and, where the law requires, request a new authorization. Previous versions are available on request.
Effective date. This policy is effective from November 6, 2026 and replaces the version dated January 10, 2024.
Languages. This policy is published in Spanish, English and Portuguese. In case of discrepancy, the version in the official language of the data subject's country of residence prevails; otherwise, the Spanish version.
Contact. For inquiries, claims, exercise of rights or any question about this policy: