Personal data protection policy

• Name: Công ty Cổ phần IIG Việt Nam (IIG Vietnam JSC).
• Enterprise code: to be updated.
• Head office: 75 Giang Van Minh, Ngoc Ha Ward, Hanoi, Vietnam.
• Personal data protection contact: info@iigvietnam.edu.vn, hotline 1900 636 929.
• Job applications: Recruitment team, tuyendung@iigvietnam.edu.vn.

IIG Vietnam acts as both controller and processor for the activities in this policy.

This policy covers:

• The corporate website iigvietnam.edu.vn, including news, content pages and test pages.
• The careers website tuyendung.iigvn.com, including job application and open application forms.
• Other IIG Vietnam pages served by the same website system that link to this policy.

The websites link to test registration, competition and e-learning systems, and to third-party forms (such as Google Forms or Microsoft Forms) in older articles. When you open those links, processing is governed by the policy of the system concerned.

We do not use personal data collected through the websites for automated decision-making, advertising profiles or marketing.

• Required: full name, email, phone number and CV, so that we can assess your application and contact you. The message is optional.
• Neither consent box is pre-ticked. Consent to processing for recruitment is required to apply; keeping your application in the talent pool is optional and does not affect how your application is assessed.
• Please do not include data that recruitment does not need, especially sensitive data such as photos of identity cards, health information, religion, political views or bank account details. If you include it anyway, we use it only for recruitment and delete it together with your application.
• The careers site has no database. Applications go directly to IIG Vietnam’s internal HR system; CV files are format-checked, scanned for malware and kept in private storage.
• Only recruitment staff and managers of the hiring department can view applications; every view, CV download or deletion is logged.
• Each application is stored with the time, IP address, browser and version of the notice you agreed to, as evidence of consent under Article 6(2), Decree 356/2025/ND-CP.
• After 12 months (or 24 months if you agreed to the talent pool), the system automatically deletes the CV and identifying fields and keeps only non-identifying statistics. You can ask us to delete it sooner.
• If you are hired, the necessary data becomes part of your employee record and is processed under the notice for employees.

Ordinary visitors receive no cookies from our websites; the language is part of the page address. The table below lists everything the websites may store in your browser.

All of the above are essential or only remember your own choices and are not used for tracking or advertising, so the websites show no cookie consent banner. If we add a page view measurement tool later, it will only run with your consent.

You can delete these items at any time in your browser’s privacy settings.

• IIG Vietnam’s internal systems: the HR system (job applications) and the customer relationship system (personal data requests, when the online request channel is enabled).
• Cloudflare, Inc. (United States): content delivery, connection encryption and attack protection for the websites. All traffic, including form content, passes through Cloudflare’s global network encrypted in transit; Cloudflare also provides Turnstile and receives browser network error reports. This is a transfer of personal data abroad under Article 20, Law 91/2025/QH15.
• Cloudflare Web Analytics is currently enabled at the content delivery layer: a Cloudflare script measures page load time and counts page views in aggregate, without cookies. We are reviewing whether to turn it off.
• Google LLC (YouTube): only when you press play on an embedded video.
• Competent authorities: when required by law.

We prepare and update the personal data processing impact assessment and the cross-border transfer impact assessment required by Articles 20 and 21, Law 91/2025/QH15.

Under Article 4, Law 91/2025/QH15, you have the right to:

• Be informed about the processing of your personal data.
• Give or refuse consent, and withdraw consent.
• Access and rectify your data, or ask us to rectify it.
• Request a copy of your data, its erasure or restriction of processing; object to processing.
• Lodge complaints or denunciations, bring legal action and claim damages as provided by law.
• Ask the competent authority or us to apply measures to protect your data.

Some rights may be limited where the law provides otherwise.

• Email info@iigvietnam.edu.vn (or tuyendung@iigvietnam.edu.vn for job applications). Tell us which right you want to exercise, your name, the email or phone number you used, and your application code if you have one.
• To protect you, we may ask you to confirm through the email address or phone number you used before acting on the request.
• We acknowledge your request and act on it within the periods in Article 5, Decree 356/2025/ND-CP: access, rectification or a copy within 10 days; withdrawal of consent, restriction or objection within 15 days; erasure within 20 days. These periods may be extended where the law allows, and we will tell you why.
• Exercising your rights is free of charge.

• Applicants: email tuyendung@iigvietnam.edu.vn with your application code to withdraw all consent (we stop assessing and delete your application) or only the talent pool consent.
• Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (Article 10(4), Law 91/2025/QH15).

The websites are not directed at children. If you are under 16, please do not send data through the website forms; a parent or guardian can contact us on your behalf. If we find that we have received a child’s data without the consent of their legal representative, we will delete it.

• Connections are always encrypted (HTTPS), and a strict content security policy blocks foreign code.
• The web servers do not store form data; access keys to internal systems stay on the server side.
• Internal systems use role-based access, log access to applicant data and keep files in private storage.
• If we discover a breach that may harm data subjects, we notify the personal data protection authority within 72 hours of discovery, as required by Article 23, Law 91/2025/QH15, and take remedial measures.

If you are not satisfied with how we handle your data, please contact info@iigvietnam.edu.vn so that we can review it. You also have the right to complain to the personal data protection authority under the Ministry of Public Security or to take legal action as provided by law.

Each time the content changes, the policy gets a new version code and effective date at the top of the page. Applications are recorded with the version you agreed to when submitting. If a change extends the purposes of processing, we will ask for your consent again.