Privacy Policy

1. Overview

eMentor Education Technology JSC ("eMentor", "we", "us") is committed to protecting your personal data. This Privacy Policy explains what information we collect when you use our platform at ementor.com.vn (the "Service"), how we use it, and what choices you have.

This Policy applies to all users of the Service, including students, teaching assistants (TAs), instructors, and visitors. By using the Service, you consent to the practices described herein. If you do not agree, please discontinue use of the Service.

2. Data We Collect

2.1 Information You Provide

2.2 Information Collected Automatically

• Device & browser: IP address, browser type, OS, screen resolution, device identifiers
• Usage data: Pages visited, features used, session duration, click patterns, referral source
• Location data: Approximate location derived from IP address (city-level only; no GPS tracking)

2.3 Information from Third Parties

• Social login: If you sign in via Google or Facebook, we receive your name, email, and profile photo as permitted by your OAuth settings
• Payment processors: Transaction confirmation and status from Stripe, MoMo, ZaloPay, or VNPay (we never store full card numbers)

3. How We Use Your Data

We use your data for the following purposes:

1. Service delivery — providing access to courses, tracking progress, grading assignments, and facilitating mentoring sessions
2. Personalization — recommending courses, adapting difficulty, and customizing your dashboard
3. Communication — sending enrollment confirmations, assignment reminders, grade notifications, and platform updates
4. Payments — processing subscriptions, generating invoices, and managing refunds
5. Safety & integrity — detecting fraud, preventing abuse, and enforcing our Terms of Service
6. Analytics & improvement — understanding how the platform is used to improve features and content
7. Legal compliance — meeting obligations under Vietnamese law, including tax reporting and data protection regulations

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human oversight.

4. Legal Basis for Processing

Under Vietnamese Decree 13/2023/ND-CP and, where applicable, the GDPR, we process your data based on:

• Contract performance — processing necessary to deliver the educational services you enrolled in
• Consent — for marketing emails, optional analytics cookies, and processing of sensitive data (e.g., health-related accommodations)
• Legitimate interest — for platform security, fraud prevention, and service improvement (balanced against your rights)
• Legal obligation — for tax records, regulatory compliance, and responding to lawful requests from authorities

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Third Parties

We share personal data only in the following circumstances:

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

6. Cookies & Tracking

We use the following types of cookies:

• Essential cookies — required for authentication, session management, and security. Cannot be disabled.
• Functional cookies — remember your preferences (language, theme, timezone). Disabled by default; enabled upon consent.
• Analytics cookies — help us understand usage patterns. We use Plausible Analytics (self-hosted, privacy-first, no cross-site tracking). Disabled by default; enabled upon consent.

We do not use third-party advertising cookies or cross-site tracking pixels. You can manage your cookie preferences at any time via the cookie banner or your account settings.

7. Data Retention

• Active accounts: Data retained for the duration of your account
• Inactive accounts: After 24 months of inactivity, we send a reminder. If no response within 90 days, the account is scheduled for deletion
• Learning records: Retained for 5 years after course completion for certification verification purposes
• Payment records: Retained for 10 years as required by Vietnamese tax law
• Support tickets: Retained for 3 years after resolution

Upon account deletion, personal data is removed within 30 days, except where retention is required by law.

8. Your Rights

Under Vietnamese data protection law and (where applicable) the GDPR, you have the following rights:

• Access — request a copy of all personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — limit how we process your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format (CSV or JSON)
• Objection — object to processing based on legitimate interest or for direct marketing
• Withdraw consent — at any time, without affecting prior processing

To exercise any of these rights, contact us at privacy@ementor.com.vn. We will respond within 30 days. If we cannot fulfil your request, we will explain why.

You also have the right to file a complaint with the Vietnamese Ministry of Public Security's Department of Cybersecurity and High-Tech Crime Prevention if you believe your data protection rights have been violated.

9. Data Security

We implement the following security measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Multi-factor authentication available for all accounts
• Regular security audits and penetration testing (quarterly)
• Role-based access control for internal staff
• Automated intrusion detection and anomaly monitoring
• Incident response plan with 72-hour breach notification obligation

While we take every reasonable precaution, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@ementor.com.vn — we operate a responsible disclosure programme.

10. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13 without verifiable parental consent. For users aged 13–15, we require parental or guardian consent in accordance with Vietnamese Decree 13/2023/ND-CP.

If we learn that we have collected data from a child under 13 without proper consent, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data should contact us at privacy@ementor.com.vn.

11. International Transfers

Our primary servers are located in Vietnam. Some service providers (cloud hosting, email delivery) operate data centres outside Vietnam. When we transfer data internationally, we ensure:

• The receiving country has adequate data protection laws, or
• Standard contractual clauses are in place, or
• You have given explicit consent to the transfer

We maintain a register of all international data transfers and review it annually.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

We encourage you to review this Policy periodically. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact our Data Protection Officer:

• Email: privacy@ementor.com.vn
• Phone: +84 28 1234 5678
• Address: 123 Nguyen Hue, District 1, Ho Chi Minh City, Vietnam
• Data Protection Officer: dpo@ementor.com.vn