On this page
This policy explains how personal data is processed in CTAS Work — the iOS and Android apps and the work.ctas.vn website for attendance, scheduling, requests, HR records, payroll, processes and internal training. It applies together with the General privacy policy (CTAS accounts, payments) and the Data processing agreement, and follows the Personal Data Protection Law No. 91/2025/QH15, the Labour Code and their implementing regulations.
1. Who is responsible
- The employer organisation (company, shop) that adds you to CTAS Work is the controller of your HR data: it decides what is collected, who sees it, how long it is kept and whether location or Wi-Fi check-in is on. Questions about HR data should go to the organisation first.
- CTA Solution is the processor of that data on the organisation’s instructions, and the controller of CTAS account data, plan payments and app usage data.
2. Data processed
2.1. Account
- Name, email, phone number, password (stored hashed), profile picture, language; sign-in devices and device limits.
2.2. HR records (entered by you or the organisation)
- Department, position, role, start date, working terms, employment contract, salary, allowances, additions and deductions, insurance, tax code, number of dependants.
- Identity details: date of birth, permanent address, ID document number and issue date, salary bank account — encrypted at rest, with every view logged; can be filled by scanning the QR code on the ID document.
2.3. Attendance and location
- Clock-in and clock-out times, shifts, schedules, worked days.
- Your location at the moment you clock in or out (when the organisation turns on location check-in) and when a manager pins the workplace on a map. The app never tracks your location in the background or outside clocking.
- The name and identifier of the connected Wi-Fi network when the organisation turns on Wi-Fi check-in, or when you confirm a manager’s request to record the workplace Wi-Fi.
2.4. Requests, payroll and processes
- Leave, shift adjustment, advance and overtime requests with reasons; payslips, pay periods, payment orders.
- Forms, checklists, evidence photos in processes; employment contracts; badges and rewards.
- Progress in internal training courses the organisation assigns to you.
2.5. Devices and usage
- Device type, OS, app version, push token, IP address, sign-in and error logs.
- Usage data: screens you open, key actions (e.g. clocking in, buying a plan), device model — linked to your account, used only to improve the product; never what you type, amounts or location; never used for ads or tracking in other apps. Crash and performance reports are not linked to your account. Turn it off under Account › Privacy › Share usage data.
3. Sensitive personal data
- Location from location services: processed only when you clock in after granting location permission, to confirm you are at work. Revoke the permission in device settings; location check-in then stops working.
- Leave types such as sick, maternity or bereavement leave can reveal health or family circumstances. Only people with approval rights in the organisation see the details; give only the reason needed, and attach medical records only if the organisation requires them under labour law.
- Financial information (salary, bank account) and ID numbers: encrypted at rest, tightly permissioned, access logged.
- We do not ask for religion, political opinions or biometric data. Face ID or fingerprint sign-in is handled by the operating system; we never receive biometric data.
4. Why we process it
- Attendance, scheduling, requests, leave, payroll, processes, training and reports as the organisation requires.
- Service notices: pending requests, payslips, shift reminders, tasks, maintenance.
- Plan payments, invoices, fraud prevention; customer support.
- Security; aggregate analysis to improve the product; legal compliance.
5. Legal bases
For HR data, the employer determines and is responsible for the legal basis (employment contract, labour, tax and insurance obligations, or employee consent). CTA Solution processes account and payment data to perform the service contract, under legal obligations and — for usage data and advertising measurement — with your consent.
6. Who sees and receives data
- Within the organisation: administrators, managers and team leads see your data according to the permissions and department scope the organisation sets.
- CTA Solution’s service providers under contract: servers and databases (Laravel Cloud, MongoDB Atlas), file storage and delivery (Amazon Web Services, Bunny, Cloudflare, Vercel), email delivery, push notifications (Apple, Google), maps and address search (Apple Maps, Google Maps, Goong), codes via Zalo, e-contracts and e-invoices (Viettel).
- Plan payments: Apple (App Store), Google (Google Play), the PayOS gateway.
- Advertising partners (Meta, TikTok): when an organisation buys a plan and the buyer accepted marketing cookies on the website, the buyer’s email and phone number one-way hashed (SHA-256) and the transaction value are sent to measure advertising. HR, attendance and payroll data is never sent to advertising partners.
- Integrations the organisation connects through CTAS Developer, within the permissions it grants.
- Competent authorities on lawful request.
7. Transfers abroad
Some infrastructure providers host servers outside Vietnam (mainly in Singapore). CTA Solution keeps an impact assessment of cross-border transfers, completes the other formalities required by personal data protection law, and helps organisations meet their obligations as controllers.
8. Retention
- Organisation HR data: kept online for the plan’s period (Starter 6 months, Growth and Business 1 year, Enterprise by contract) and as the organisation instructs; older data is exported to Excel and PDF files (and JSON on Business and Enterprise) for the organisation to keep. Organisations may have to keep attendance and payroll records under labour and accounting law.
- Accounts: while active; deleted or anonymised within 30 days after you delete the account, except what the organisation or the law requires to keep.
- Identity access logs: as long as HR records are kept. Technical logs: up to 12 months.
- App usage data: 180 days. Crash and performance reports: 90 days.
9. Security
- HTTPS/TLS in transit; passwords hashed with bcrypt; identity details and bank accounts encrypted at rest with every access logged.
- Data separated by organisation; role and department-scoped permissions; multi-factor authentication; device and rate limits.
- CTA Solution staff access on a need-to-know basis, with logs.
If a personal data breach occurs, we notify the organisation, the competent authority and affected people within the time limits set by law.
10. Your rights
You have the right to be informed; to give or withdraw consent; to access and correct; to request deletion; to restrict or object to processing; to request your data; and to complain, report, sue and claim compensation. You can see most of your data in the app (attendance, requests, payslips, profile). For HR data contact your organisation; you can also write to support@ctasolution.vn and we will forward the request and help the organisation respond.
11. Deleting your account
- In the app: Account › Delete account; or
- Email support@ctasolution.vn with the subject “Account deletion request” from your registered email.
If you are the only administrator of an organisation, transfer the role or dissolve the organisation first. Attendance and payroll records belonging to the organisation may be kept by it under its own legal obligations.
12. Age
CTAS Work is for workers and managers aged 16 and over. Employing minors, including obtaining the consent of a legal representative where the law requires, is the organisation’s responsibility under the Labour Code.
13. Changes
New versions are posted here with their effective date and a summary of changes; for important changes the app asks you to accept again before continuing.
14. Contact
CTA Solution Co., Ltd. — personal data protection
Tax code: 0316683514
Address: 215 Bach Dang Street, Hanh Thong Ward, Ho Chi Minh City, Vietnam
Email: support@ctasolution.vn