Orient Software - Candidate Privacy Statement
Effective 01 Jan 2026
ORIENT SOFTWARE DEVELOPMENT CORPORATION Candidate Personal Data Protection Notice Privacy Statement - Website / Recruitment Portal
IMPORTANT - PLEASE READ BEFORE APPLYING By submitting your CV, creating a profile, or clicking “I Agree” on our recruitment platform, you confirm that you have read, understood, and explicitly consent to the collection and processing of your personal data as described in this notice, in accordance with Law 91/2025/QH15 on Personal Data Protection and Decree 356/2025/NĐ-CP.
1. Who We Are - Data Controller
Orient Software Development Corporation (“Orient Software”, “we”, or “the Company”) acts as the Data Controller for your personal data provided during recruitment, as defined under Law 91/2025/QH15 on Personal Data Protection and Decree 356/2025/NĐ-CP dated 31 December 2025.
This notice applies to all candidates who submit a resume, create a profile, or interact with any Orient Software recruitment channel - including our website, career portal, and third-party job platforms.
Authorized Processing Locations
- Head Office (Etown 1) - Suite 5.8, 5th Floor, E.town 1 Building, 364 Cong Hoa Street, Tan Binh Ward, Ho Chi Minh City
- Branch Office (Da Nang) - 162 Nguyen Co Thach Street, Ngu Hanh Son Ward, Da Nang City
- Branch Office (Hanoi) - 3rd Floor, FLC Landmark Tower, Le Duc Tho Street, Tu Liem Ward, Ha Noi City
2. Personal Data We Collect
We collect only the personal data necessary for recruitment purposes. This includes information you provide directly in your CV, application form, or profile, as well as data gathered during assessments and interviews.
Basic Personal Data
Full name & aliases, Date of birth, Gender, Nationality, Place of birth / Hometown, Permanent & current address, Email address, Phone number, National ID / Passport number, Marital status, Education & degrees, Professional certifications, Language proficiency, Work history & experience, Skills & portfolio, Profile photo, LinkedIn / GitHub profiles, Expected salary, Interview notes & assessment results.
Sensitive Personal Data - Only When Strictly Necessary
WARNING: Sensitive data (background checks / criminal records, biometric data for access control - post-hire only, health information) is collected only when strictly required for specific roles, with your separate, explicit, and informed consent. You may refuse to provide sensitive data without affecting your application for roles that do not require it.
Data from Third-Party Sources
- Job platforms: LinkedIn, TopCV, VietnamWorks, ITviec (when you apply via those channels)
- Professional references you provide - contacted only with your prior knowledge
3. How We Use Your Data
We process your personal data only for the following specific, lawful purposes:
| Purpose | Description & Legal Basis |
|---|---|
| Recruitment Evaluation | Reviewing your application for current and future vacancies across Orient Software and affiliated entities. Legal basis: Consent |
| Communication | Contacting you about application status, interview scheduling, assessments, and offer details. Legal basis: Consent |
| Automated Job Matching (AI) | AI-assisted tools match your profile to open roles. All final hiring decisions are made by our human recruiting team. You may opt out. Legal basis: Consent |
| Talent Pool | Retaining your profile for future career opportunities - only with your explicit additional consent. Withdrawable at any time. Legal basis: Consent (separate) |
| Legal & Contractual | Fulfilling record-keeping requirements under Vietnamese Labour Code 2019 and applicable regulations. Legal basis: Legal obligation |
| Platform Updates | Notifying you of material changes to our privacy practices or recruitment platform. Legal basis: Consent |
Our Commitment on AI & Data: Your personal profile data will NOT be used to train any third-party public AI models, machine learning systems, or shared with AI vendors for training purposes. Automated matching tools serve solely to assist our recruiters - our human team makes all final decisions.
4. Legal Basis for Processing
Our processing of your personal data is grounded in the following legal framework:
- Law on Personal Data Protection No. 91/2025/QH15 - Primary law governing personal data protection in Vietnam, effective 1 July 2025.
- Decree 356/2025/NĐ-CP - Detailed implementation regulations, effective 1 January 2026.
- Cybersecurity Law No. 24/2018/QH14
- Law on Network Information Security No. 86/2015/QH13
- Labour Code 2019 - Regulations on candidate and employee personal information.
- Criminal Code 100/2015/QH13
- Constitution of Vietnam 2013 & Civil Code 2015 - Inviolable rights to privacy, dignity, and honor. Where applicable to international clients and operations, we align our practices with the General Data Protection Regulation (GDPR).
The primary legal basis for collecting and processing your recruitment data is your explicit consent given when you submit your application. You have the right to withdraw this consent at any time without affecting the lawfulness of prior processing.
5. Data Sharing & Third-Party Processors
We do not sell, rent, or trade your personal data. Data is shared only under strict confidentiality obligations and only as described below.
Internal Recipients
- People & Culture (P&C) department and authorized HR personnel
- Hiring managers and department heads relevant to the applied role
Senior management for roles requiring executive approval Third-Party Service Providers (Data Processors)
- Cloud & ATS providers: Platforms supporting resume storage, applicant tracking, and recruitment workflow - bound by strict Data Processing Agreements (DPAs).
- Assessment platforms: Tools for technical or behavioral testing, where required for specific roles.
Background verification providers: For designated roles only, with your prior explicit consent. Legal Disclosures
- Courts and competent Vietnamese state authorities when required or permitted by law
- Professional advisors (auditors, lawyers) acting under confidentiality obligations
All third-party processors are contractually required to process your data only for specified purposes, apply adequate data protection measures, and comply with Vietnamese data protection law.
6. Data Retention & Storage
Storage Method
Your data may be stored on secure, encrypted cloud computing infrastructure or third-party systems that fully comply with Vietnamese data protection regulations.
Retention Periods
| Scenario | Retention Period |
|---|---|
| Hired - join Orient Software | Transferred to Employee Personal Data Protection Policy |
| Not hired | Retained in BRAVO recruitment system for future recruitment opportunities unless an erasure request is submitted |
| Interview notes & assessment records | Retained in BRAVO recruitment system unless an erasure request is submitted |
| Erasure request submitted | Permanently deleted within 20 working days (unless legally required to retain) |
7. Your Rights as a Data Subject
You have the following rights in relation to your personal data, as provided in Law 91/2025/QH15 and Article 5, Decree 356/2025/NĐ-CP. To exercise any right, contact people-culture.department@orientsoftware.com. We will acknowledge your request within 2 working days.
| Right | Details & Response Time |
|---|---|
| Right to Access | Request a copy of data we hold. Acknowledged within 2 working days; fulfilled within 10 days. |
| Right to Rectification | Request correction of inaccurate or incomplete data. Fulfilled within 10 days. |
| Right to Erasure | Request permanent deletion. Note: this ends our ability to consider you. Fulfilled within 20 days. |
| Right to Withdraw Consent | Revoke consent at any time without affecting prior lawful processing. Effective within 15 days. |
| Right to Restrict Automated Processing | Request limitation of AI/automated tools in profile evaluation if you believe it affects your rights. |
| Right to Data Portability | Receive your data in structured, machine-readable format (PDF / JSON). |
| Right to Object | Object to processing based on legitimate interests or for direct marketing. |
| Right to Lodge a Complaint | File a complaint with the Personal Data Protection Authority under the Ministry of Public Security of Vietnam. |
8. Cross-Border Data Transfers
To deliver efficient recruitment services using globally recognized technology platforms, your personal data may be transferred to, stored on, and processed by servers located outside of Vietnam.
Cross-Border Transfer Safeguards: All international data transfers comply with Article 17, Decree 356/2025/NĐ-CP. We maintain a Cross-Border Data Transfer Impact Assessment (DPIA) filed with the Personal Data Protection Authority (Ministry of Public Security) within 60 days of commencing transfer. Sensitive data transfers include physical security measures and end-to-end encryption.
Recipients include cloud infrastructure providers and recruitment technology platforms bound by Data Processing Agreements requiring equivalent data protection levels.
9. Data Security
- Encryption: All data encrypted in transit (TLS/SSL) and at rest.
- Access Control: Role-based access - only authorized P&C staff and relevant hiring managers can view your data.
- Data Processing Agreements: All third-party technology partners are contractually bound by strict data protection obligations.
- No AI Training: Your data will not be used to train any public third-party AI or machine learning models.
- Security Audits: Annual compliance audits and regular penetration testing.
- Breach Response: In the event of a data breach, we will notify the supervisory authority within 72 hours. Where required (e.g., location or biometric data per Article 29, Decree 356), we will notify affected candidates directly.
10. Contact & Data Protection Representatives
To exercise your rights, ask questions about this notice, or report a data protection concern, please contact:
| PDPR / DPO | dpo@orientsoftware.com |
Policy Updates
We may update this notice periodically to reflect changes in law or our practices. The effective date at the top reflects the most recent version. Material changes will be communicated in advance via email or a prominent notice on our platform.
You have the right to complain to the Personal Data Protection Authority under the Ministry of Public Security of Vietnam if you believe your rights have been violated.
Consent Acknowledgement
By submitting a job application, creating a candidate profile, or clicking ‘I Agree’ on our recruitment platform, you confirm that:
- [Required] You have read and understood this Candidate Personal Data Protection Notice.
- [Required] You explicitly consent to Orient Software collecting, processing, and retaining your personal data as described in this notice for recruitment evaluation, communication, and legal compliance purposes.
- [Optional] You consent to Orient Software retaining your profile in its Talent Pool for up to 24 months for future opportunities. You may withdraw this consent at any time.
- [Optional] You consent to the use of automated matching tools (AI-assisted) in evaluating your profile. All final decisions are made by Orient Software’s human recruiting team, and you may opt out at any time.
You may withdraw your consent at any time by contacting people-culture.department@orientsoftware.com. Withdrawing consent will not affect the lawfulness of processing before the withdrawal.
ORIENT SOFTWARE DEVELOPMENT CORPORATION
This Candidate Privacy Statement was last updated in May 2026
Law 91/2025/QH15 & Decree 356/2025/NĐ-CP
