LGPD, GDPR and data subject rights
Operational summary of the Coodesh privacy policy as applied to Workdex: processing roles, legal bases, international transfers, subject rights and request channels.
Workdex is a spin-off brand owned by Coodesh Serviços Tecnológicos Ltda. (Brazilian company ID CNPJ 30.078.586/0001-78), headquartered at Av. Afonso Pena, 3.351, 11th floor, room 1103, Funcionários, Belo Horizonte/MG, Brazil, ZIP 30130-008. All references to Coodesh in this document cover the Workdex operation and the workdex.ai domain.
This page complements the Privacy Policy with an objective view of how Coodesh, the company behind the Workdex brand, complies with the LGPD and the GDPR: who controls the data, on what grounds, how it moves, and how to exercise your rights.
1. Processing roles and DPO
Coodesh acts as controller of the data it collects directly, such as account, browsing and commercial-contact data. When evaluating candidates or employees under instructions from a customer company, the customer company acts as controller and Coodesh as processor.
Coodesh has appointed a Data Protection Officer (DPO), pursuant to LGPD art. 41 and GDPR art. 37, reachable at dpo@coodesh.com.
2. Legal bases
Personal-data processing rests on the legal bases of the LGPD and the GDPR, depending on the purpose.
- Contract performance: service delivery, account creation and maintenance, and assessment delivery.
- Consent: sensitive diversity data, video and audio recordings, and marketing communications.
- Legitimate interest: service improvement, anonymized benchmark data, security and fraud prevention.
- Legal obligation: compliance with legal and regulatory requirements.
3. International transfers
The core infrastructure is located in the United States (AWS and Google Cloud Platform), and some vendors may operate in other countries.
For data subjects in Brazil, transfers comply with LGPD art. 33 through standard contractual clauses, adequacy commitments or countries with an adequate level of protection. For data subjects in the EU/EEA, transfers comply with GDPR Chapter V through Standard Contractual Clauses (SCCs), adequacy decisions or the EU-US Data Privacy Framework.
4. Data subject rights
Data subjects may exercise the rights provided by the LGPD and the GDPR, including confirmation of processing and access, correction, anonymization, blocking or deletion, portability, information about sharing, withdrawal of consent and objection to legitimate-interest processing, as well as complaints to the ANPD or the competent supervisory authority.
Data subjects in the EU/EEA also have the right to restriction of processing and the right not to be subject to solely automated decisions, including profiling.
5. How to exercise your rights
Requests can be made through the platform (Menu, Settings) or by email at dpo@coodesh.com. Operational topics can be directed to help@workdex.ai.
- Response times: 15 business days (LGPD) or 30 days (GDPR), extendable depending on complexity.
- Requests tied to processes run by a customer company may require coordination with that company, as controller.
- We may ask for identity confirmation and additional details to prevent improper access to third-party data.
6. Security and incidents
Coodesh adopts encryption in transit (TLS/SSL) and at rest, role-based access control (RBAC), monitoring with audit logs, regular backups, internal policies and training.
In the event of a security incident with relevant risk, the ANPD, the applicable supervisory authority (GDPR) and affected data subjects will be notified within the legal deadlines.