On this page
This Privacy policy explains how CTA Solution Co., Ltd. (“CTA Solution”, “we”) collects, uses, shares and protects personal data when you visit ctas.vn or use CTAS products, including the CTAS Work app, work.ctas.vn, account.ctas.vn and business.ctas.vn (together, the “Service”).
It follows Decree 13/2023/ND-CP on personal data protection, the Personal Data Protection Law and related Vietnamese regulations.
1. Our role
- For CTAS account data, data on ctas.vn and payment data, CTA Solution is the data controller.
- For HR data an organization (a company or store) puts into CTAS Work to manage its own employees — attendance, schedules, pay, records — that organization is the controller and CTA Solution is the processor under the Data processing agreement. If you are an employee, questions about your HR data should go to your organization first.
2. Data we collect
2.1. Data you provide
- Account: name, email, phone number, password (stored hashed), profile photo, language.
- Organization profile (entered by you or your organization): department, position, role, start date, employment contract, salary and allowances, insurance and tax details, ID document numbers (encrypted at rest).
- Requests and content: leave, shift changes and advances with their reasons; forms, checklists and photo evidence in processes.
- Contact: what you send through the contact form, email, phone or Zalo.
2.2. Data generated as you use the Service
- Attendance: clock-in and clock-out times; location coordinates at the moment of clocking in; the name and identifier of the connected Wi-Fi network when the organization turns on Wi-Fi checks. The app does not track location in the background or outside clock-in.
- Device and technical: device type, operating system, app version, device identifier for sign-in and device limits, push notification token, IP address, sign-in and error logs.
- App usage data: the CTAS Work app sends us the screens you open, main actions (for example clocking in, buying a plan), app version, device model and operating system — linked to your account, solely to improve the product; it never includes what you type, amounts of money or location, and is not used for advertising or tracking across other apps. The app also sends crash and performance diagnostics that are not linked to your account. You can turn this off in the app under Account › Privacy › Share usage data.
- ctas.vn website: cookies and similar technologies under the Cookie policy — analytics and advertising cookies are only used with your consent.
2.3. Sensitive personal data
Location determined through positioning services is sensitive personal data. We only process location when you actively clock in, after you have granted location permission on your device, and only to confirm you are at work. You can revoke this permission in your device settings; location-based clock-in will then stop working. We do not ask for health, religious, political or biometric data — Face ID and fingerprint sign-in are handled by the operating system and we never receive your biometric data.
3. Why we process data
- To create, verify and protect accounts and provide attendance, scheduling, requests, leave, payroll, processes and reports.
- To send service notifications: pending approvals, payslips, reminders, policy changes and maintenance.
- To process payments, issue invoices and prevent fraud.
- To support customers and handle requests and complaints.
- To keep the system secure and detect and stop unauthorised access and abuse.
- For aggregate analysis to improve the product (de-identified wherever possible).
- To send product news and offers — only with your consent, which you can withdraw at any time.
- To meet legal obligations and requests from competent authorities.
4. Legal basis
We process data on the basis of your consent; performing the contract to provide the Service; legal obligations; or other cases where the law allows processing without consent. For HR data in CTAS Work, the employing organization is responsible for the legal basis for processing its employees’ data.
5. Sharing
CTA Solution never sells personal data. We share data only:
- Within your organization: administrators, managers and team leads see your data according to the permissions and department scope your organization sets.
- With service providers processing on our behalf under contract and only as needed: cloud servers and databases (e.g. MongoDB Atlas, Laravel Cloud), file storage and delivery (e.g. Amazon Web Services, Bunny), email delivery, push notifications (Apple, Google), Zalo verification and map address search.
- For payments: Apple (App Store), Google (Google Play) and the PayOS gateway process transactions; we never store your card number.
- With integrations your organization chooses: when it connects a third-party app through CTAS Developer, data is shared within the scope the organization grants.
- Where the law requires, or to protect the rights and safety of users, CTA Solution and the public.
6. International transfers
Some infrastructure providers host servers outside Vietnam. When data is transferred abroad, CTA Solution follows the procedures and safeguards required by Vietnamese law, including preparing and keeping a transfer impact assessment.
7. Retention
- Account data: while the account is active; when you delete your account, data is deleted or anonymised within 30 days, except where the law requires longer.
- Organization HR data: kept online for the plan’s retention period (Starter 6 months, Growth and Business 1 year, Enterprise per contract) and as the organization instructs; older data is archived as Excel and PDF files (plus JSON on Business and Enterprise) for the organization to keep. Organizations may have to keep attendance and payroll records under labour and accounting law.
- Contact messages: up to 24 months. Technical logs: up to 12 months. Cookie consent evidence: as long as needed to prove consent.
- App usage data: 180 days. Crash and performance diagnostics: 90 days. After that they are deleted automatically.
8. Security
- HTTPS/TLS encryption in transit; passwords hashed with bcrypt; ID document numbers encrypted at rest with every access logged.
- Per-organization isolation; role- and scope-based permissions; multi-factor authentication; rate limiting.
- Internal access limited on a need-to-know basis.
No system is perfectly secure. If a personal data breach occurs we notify the competent authority and affected people within the time the law requires.
9. Your rights
Under personal data protection law you have the right to be informed; to give or withdraw consent; to access and correct data; to request deletion; to restrict or object to processing; to request a copy of your data; and to complain, report, sue and claim compensation as the law provides. You can view and edit most information in the app, or email support@ctasolution.vn. We may need to verify your identity first and will reply within the time the law requires.
10. Deleting your account
- In the app: Account › Delete account; or
- Email support@ctasolution.vn from your registered address with the subject “Account deletion request”.
If you are the only administrator of an organization, transfer the admin role or close the organization first. Attendance and payroll records belong to the organization and may be kept by it under its legal obligations.
11. Children
The Service is not intended for anyone under 16. We do not knowingly collect children’s data; if we find any, we delete it as soon as possible.
12. Changes
We may update this policy. New versions are posted here with an effective date; for material changes affecting your privacy we also notify you in the app or by email. The Vietnamese version prevails in case of any difference.
13. Contact
CTA Solution Co., Ltd. — personal data protection
Tax code: 0316683514
Address: 215 Bach Dang Street, Hanh Thong Ward, Ho Chi Minh City, Vietnam
Email: support@ctasolution.vn · Hotline: 0931 102 398