CTAS Course privacy policy

This policy explains how CTA Solution Co., Ltd. (“CTA Solution”, “we”) processes personal data when you use the CTAS Course marketplace at course.ctas.vn and the CTAS Learn app on iOS and Android (together “CTAS Course”): buying courses, learning, taking quizzes, receiving certificates, writing reviews and asking for support.

It follows the Personal Data Protection Law No. 91/2025/QH15, the E-commerce Law No. 122/2025/QH15, the Consumer Protection Law and their implementing regulations. The CTAS account you sign in with is shared across CTAS products — the account section below applies to CTAS Course too. Website cookies are described in the Cookie policy.

1. Who is responsible for your data

• When you buy and learn a course yourself: CTA Solution is the data controller.
• Publishers (companies and organisations selling courses on the marketplace) receive part of the learner data of their own courses to support you and issue certificates (section 5). They may only use it within their contract with CTA Solution and are responsible for their own use.
• When a course is assigned by the organisation you work for (internal training through CTAS Studio, including when you learn in the CTAS Learn app): that organisation controls your learning data; CTA Solution processes it under the Data processing agreement. Questions about that data should go to the organisation first.

2. Data we process

2.1. Account

• Name, email, phone number, password (stored hashed), profile picture, language.
• Sign-in security: the multi-factor methods you enable, trusted devices, sign-in history with IP address and browser/device type.

2.2. Buying a course

• Orders: the course, publisher, price, discount code, amount, payment time and status, the payment gateway’s transaction reference. We never receive or store your card number or banking password.
• Invoice details (only if you ask for an invoice): buyer or company name, tax code, address, invoice email.
• Proof of consent: when you accept the terms and the no-refund policy before paying, we record the version you accepted, the time, your IP address and browser — to evidence the transaction under consumer protection law.

2.3. Learning

• Your enrolments, progress in each lesson (pages viewed, position in a video, time spent), quiz attempts, answers and scores.
• Certificates of completion: the name printed on the certificate, course, issue date and serial. Anyone with the serial can check that a certificate is genuine.

2.4. Reviews and support

• Course reviews: stars, text and time — shown publicly on the course page with your display name; the publisher may reply.
• Support, complaints and content reports: what you send, attachments and contact details.

2.5. Devices and usage

• Website: IP address, browser, access and error logs; necessary cookies; analytics and marketing cookies only with your consent in the cookie banner.
• CTAS Learn app: the screens you open, key actions, app version, device model and OS — linked to your account, used only to improve the product; crash and performance reports are not linked to your account. You can turn this off under Account › Privacy. The app has no ads, uses no advertising ID, does not track you across other apps or websites and uses no third-party analytics SDK.
• Face ID or fingerprint sign-in is handled by the operating system; we never receive your biometric data.

2.6. Data we do not collect

CTAS Course does not collect your location, contacts, calendar, microphone or health data. The CTAS Learn app only accesses photos you pick yourself for a profile picture or a support attachment.

3. Why we process it

• To create and protect your account and verify sign-in.
• To process orders, enrol you, send order confirmations and service notices, and pass publishers what they need to issue an invoice.
• To provide the learning space: saving progress, marking quizzes, issuing and verifying certificates.
• To show reviews and to handle support and complaints under the complaint procedure.
• To keep the service secure, detect fraud (unusual transactions, fake reviews) and enforce the operating rules.
• To analyse usage in aggregate and measure advertising — only with your consent.
• To meet legal obligations: keeping e-commerce transaction records, accounting, tax, reporting and providing information to competent authorities.

4. Legal bases

• Performing the contract you enter into when buying and learning (sections 2.1–2.4).
• Legal obligations: keeping transactions, proof of consent and accounting records; providing information on lawful request.
• Your consent: analytics, marketing and conversion-measurement cookies; app usage data. You can withdraw it at any time without affecting buying or learning.

5. Who receives your data

CTA Solution does not sell personal data. Data is shared only as follows:

• The publisher of a course you take: your name, email, progress, quiz results and certificate for that publisher’s courses; your invoice details if you ask for an invoice. Publishers do not receive your phone number, password, payment details or what you learn from other publishers, and may not use the data for marketing outside the marketplace without your separate consent.
• Co-brand partners of a course (if the publisher enables it): the name, status and progress of that course’s buyers — no email, phone or payment details.
• Your organisation: for courses it assigned, under the permissions it sets.
• Service providers processing on our behalf under contract: servers and databases (Laravel Cloud, MongoDB Atlas), delivery and protection networks (Cloudflare, Vercel), file storage (Amazon Web Services), video streaming (Bunny), email delivery.
• The PayOS payment gateway and the banks involved; the e-invoice provider when an invoice is issued.
• Advertising partners (Google, Meta, TikTok) — only if you accept marketing cookies on the website: visit data through cookies; when you buy a course, your email and phone number one-way hashed (SHA-256), IP address, browser and order value to measure advertising. The CTAS Learn app sends nothing to advertising partners.
• Competent authorities (Ministry of Industry and Trade, tax authorities, police…) on lawful request.

6. Transfers abroad

Some providers in section 5 host servers outside Vietnam (mainly in Singapore) or deliver content through global networks. CTA Solution keeps an impact assessment of cross-border transfers, signs data protection terms with providers and completes the other formalities required by personal data protection law.

7. How long we keep data

• Account, learning progress, certificates: while your account is active; deleted or anonymised within 30 days after you delete the account.
• Orders, invoice details, proof of consent: at least 3 years under e-commerce law, and longer where accounting or tax law requires — including after you delete your account.
• Reviews: until you delete the review or your account; reviews hidden for breaking the rules are kept to resolve complaints.
• Support and complaints: up to 24 months after closing. Technical logs: up to 12 months. App usage data: 180 days; crash reports: 90 days.

8. Security

• HTTPS/TLS encryption in transit; passwords hashed with bcrypt; optional multi-factor authentication.
• Videos stream through signed, expiring links; course packages are encrypted.
• Publishers only see learners of their own courses; CTA Solution staff access data by role and every admin action is logged.

If a personal data breach occurs, we notify the competent authority and affected people within the time limits set by law.

9. Your rights

You have the right to be informed; to give or withdraw consent; to access and correct; to request deletion; to restrict or object to processing; to request a copy of your data; and to complain, report, sue and claim compensation under the law. You can view and edit your account, order history and progress in “My learning” and the app; send other requests to support@ctasolution.vn. We may verify your identity first and will reply within the time limits set by law. Requests concerning data a publisher received are forwarded to the publisher and followed up until done.

10. Deleting your account

• In the CTAS Learn app: Account › Delete account; or
• Email support@ctasolution.vn with the subject “Account deletion request” from your registered email.

Deleting your account deletes your shared CTAS account: you lose access to every course you bought and every certificate you received; issued certificates may no longer be checkable by serial. Orders and records are kept as in section 7. If you are the only administrator of an organisation or storefront, transfer that role first.

11. Children and minors

Buyers must be at least 18 or have a parent or guardian make the purchase. People under 16 may use CTAS Course only with the consent and supervision of a parent or guardian, as personal data protection law requires for children. If we find a child’s data was provided without that consent, we delete it as soon as possible.

12. Changes

New versions are posted on this page with their effective date and a summary of changes. For important changes the CTAS Learn app asks you to accept again before continuing; the website shows a notice and we email you.

13. Contact

CTA Solution Co., Ltd. — personal data protection
Tax code: 0316683514
Address: 215 Bach Dang Street, Hanh Thong Ward, Ho Chi Minh City, Vietnam
Email: support@ctasolution.vn