Data processing agreement

This Data processing agreement (the “Agreement”) forms part of the Terms of service and applies between the organization using CTAS Work (the “Organization”, the data controller) and CTA Solution Co., Ltd. (“CTA Solution”, the data processor) for the personal data of workers that the Organization puts into CTAS Work.

The Agreement takes effect when the Organization is created in CTAS Work. Business customers who need a signed copy can contact support@ctasolution.vn.

1. Scope and data

• Data subjects: employees, contractors and candidates the Organization invites into CTAS Work, and the Organization’s administrators.
• Data: name, contact details, department, position, contract and ID document numbers; attendance data (time, location at clock-in, Wi-Fi network); schedules; requests; leave; pay, allowances, insurance, tax and advances; forms and photos in processes.
• Purpose: providing the CTAS Work features the Organization uses — attendance, scheduling, approvals, leave, payroll, processes, reports and notifications.
• Duration: for as long as the Organization uses the Service, plus the post-termination period in section 7.

2. The Organization’s responsibilities (controller)

• Determine the purposes and have a lawful basis for processing workers’ data, including informing workers and obtaining consent where the law requires (in particular for location at clock-in).
• Only put necessary, accurate data into CTAS Work and configure appropriate permissions for managers and team leads.
• Receive and handle workers’ requests about their data; CTA Solution assists under section 5.
• Meet the controller’s legal obligations, including a data processing impact assessment where required.

3. CTA Solution’s commitments (processor)

• Process data only on the Organization’s instructions as expressed through its configuration and actions in CTAS Work, the Terms and this Agreement; never for its own purposes and never selling it.
• Ensure staff with access are bound by confidentiality and only access data when needed to operate, support or resolve incidents.
• Apply appropriate technical and organizational measures: encryption in transit, per-organization isolation, permissions, encrypted ID documents with access logging, multi-factor authentication.
• Notify the Organization without undue delay of any breach affecting its data, with the information the Organization needs to meet its own notification duties.

4. Sub-processors

The Organization authorises CTA Solution to use infrastructure providers (servers, cloud databases, file storage, email delivery, push notifications, Zalo verification) as sub-processors bound by data protection obligations no weaker than this Agreement. The provider categories are listed in the Privacy policy, which we update when a significant provider changes.

5. Data subject requests

CTAS Work gives the Organization tools to view, edit, export and pause members’ data. Where further help is needed to answer a worker’s request (access, correction, deletion, restriction), the Organization contacts CTA Solution and we assist within reason.

6. International transfers

Data may be stored on infrastructure providers’ servers outside Vietnam. CTA Solution completes the cross-border transfer procedures the law requires and provides the necessary information on request.

7. End of service

• While using the Service the Organization can export its data with CTAS Work’s export features.
• When the Organization asks for it to be deleted, CTA Solution deletes or anonymises its data within 30 days, except where the law requires retention; backups are purged on the system’s regular cycle.
• When the trial ends or a plan expires, no data is deleted for that reason; data is kept for the plan’s retention period, and older data is archived for the Organization as Excel and PDF files (plus JSON on Business and Enterprise).

8. Audits

On reasonable written request, CTA Solution provides the information needed for the Organization to assess compliance with this Agreement — for example by answering a security questionnaire — without exposing other customers’ data or security-sensitive details.

9. Contact

CTA Solution Co., Ltd. — tax code 0316683514
215 Bach Dang Street, Hanh Thong Ward, Ho Chi Minh City, Vietnam
Email: support@ctasolution.vn