This Privacy Policy (“Policy”) describes how JobTest Company Limited (“JobTest”, “we”, “us”, “our”) collects, receives, uses, stores, shares, protects, and processes personal data in the course of providing services, products, and conducting JobTest’s business activities, directly or through auxiliary platforms, systems, and service providers.
The scope of services covered by this Policy may include recruitment services, executive search and headhunting; human resource consulting and development; competency assessment and testing; training; AiHR software; websites, applications, online platforms, and other products and services provided by JobTest Company Limited (“JobTest” or the “Company”) from time to time.
This Policy applies in conjunction with service contracts, terms of use, personal data processing notices, data processing addenda, and related agreements between JobTest and customers/partners (if any). In the event of any conflict or inconsistency, the parties shall comply with mandatory legal provisions and specific written agreements applicable to the corresponding service.
This Policy is formulated in accordance with Vietnamese laws on personal data protection, including Personal Data Protection Law No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and relevant legal regulations in force from time to time.
1Scope of Application and Definition of Terms
1.1.
This Policy applies to personal data processing activities arising from services, products, and operations within the scope specified in the preamble, including but not limited to:
- Recruitment, headhunting, job posting, receipt, and management of candidate profiles;
- Human resource consulting, development, competency assessment, test administration, training, and other HR services within JobTest’s actual supply scope;
- AiHR software, websites, applications, online platforms, and other digital tools provided by JobTest;
- Receiving requests, communication, consulting, customer support, account management, and service provision via email, phone, web forms, events, in-person interactions, or other electronic means.
1.2.
In this Policy:
- “Customer” means an organization or individual that uses, requests, or executes a contract with JobTest to utilize one or more of JobTest’s services/products.
- “User” means an individual granted or permitted access by a Customer to software, platforms, systems, or service channels provided by JobTest.
- “Candidate” means an individual who submits a profile, is introduced, searched, screened, evaluated, or participates in recruitment processes conducted by JobTest or customers/partners.
- “Data Subject” means an individual reflected by personal data, including individual customers, users, candidates, employees, or contact persons of customers, partners, and other individuals whose personal data is processed by JobTest within the scope of this Policy.
- “Personal Data” means information under applicable laws associated with or helping identify a specific individual, including basic personal data and sensitive personal data.
- “Customer Data” means data, records, documents, content, and personal data provided, sent, uploaded, or processed by Customer or an authorized representative during the use of JobTest’s services.
- “Test Data” means data generated during testing or assessment, which may include answers, scores, reports, evaluation results, action logs, monitoring images, or video if corresponding features/services are provided and used.
- “Auxiliary Service Provider” means an organization or individual providing tech infrastructure, data storage, security, tech support, notifications, analytics, or other support services necessary for operating JobTest’s services.
1.3.
JobTest’s roles and responsibilities regarding personal data are determined based on actual purposes, processing methods, scope of assigned work, contracts, and applicable legal regulations.
For personal data provided or requested by customers to serve recruitment, candidate management, assessment, or other HR functions, Customer and JobTest fulfill corresponding responsibilities based on their actual roles. Where JobTest processes data under Customer’s lawful instructions, JobTest carries out processing within the agreed service scope and instructions.
For account data, system operation, security, customer support, or other activities where JobTest determines the purposes and methods of processing, JobTest fulfills corresponding obligations in accordance with the law.
Role determination under this Clause does not exclude or diminish mandatory legal obligations of any party.
Regarding candidate data, whether JobTest acts as a Data Controller, Data Processor, or Data Controller-cum-Processor is determined based on actual processing activities, including which party decides processing purposes and means, service scope, contracts, and applicable laws.
Where JobTest only processes data under lawful customer instructions, JobTest shall not use such data for independent purposes outside the service scope unless there is an appropriate legal basis. Where JobTest directly collects, searches, screens, stores, or introduces candidates for purposes decided by JobTest, JobTest fulfills obligations corresponding to its role.
A customer providing candidate data to JobTest does not automatically prove that candidates have been notified or consented to all subsequent processing activities. Parties are responsible for determining and retaining evidence of processing grounds prior to conducting activities within their scope of responsibility.
2Categories of Data That May Be Processed
2.1.
Depending on the service, product, or feature used and information provided by data subjects or customers, JobTest may process the following personal data categories:
a)Customer and contact person information: full name, job title, work contact info, communication content, transaction info, and info necessary to execute contracts.
b)User account information: full name, username, email, phone number, role, permissions, login history, and operation logs necessary to manage accounts and secure systems.
c)Candidate data: identification info, contact info, resumes/CVs, education, work experience, skills, application history, applied positions, recruitment communication, and relevant details.
d)Consulting, training, and assessment data: registration info, attendance, answers, test scores, evaluation reports, and data generated from actual services used.
e)Technical and service usage data: IP address, device type, operating system, browser, access time, system logs, technical errors, cookies, and usage data within necessary scope.
f)Other data provided by data subjects: info sent via forms, email, phone, surveys, support requests, or other communication channels.
2.2.
JobTest only processes personal data within the necessary scope for specific purposes with a lawful processing basis. Sensitive personal data or high-risk data is processed only when strictly necessary, meeting legal conditions and protection measures.
2.3.
Customers are responsible for ensuring rights and lawful grounds when providing data to JobTest. Customers shall not provide unnecessary data, unlawfully collected data, or data they lack authority to supply.
3Purposes and Legal Grounds for Data Processing
3.1.
Purposes of Processing. JobTest processes personal data within necessary limits to:
a)Receive requests, advise, quote, sign, perform, and manage contracts with customers and partners;
b)Provide recruitment, executive search, HR consulting, training, assessment, test administration, and other services within the Policy scope;
c)Provide, operate, maintain, technically support, and improve software, websites, platforms, or tools provided by JobTest;
d)Manage accounts, access permissions, authenticate users, ensure system safety, and prevent unauthorized access, fraud, or abuse;
e)Receive and resolve feedback, complaints, requests from data subjects, and arising disputes;
f)Perform legal obligations, meet valid requests from competent state authorities, and protect legitimate rights/interests of JobTest or related parties as permitted by law;
g)Conduct statistics, performance measurement, error diagnostics, and service quality improvements. If personal data is used for purposes outside the original scope, JobTest must establish an appropriate legal basis, notify, obtain consent, or follow required procedures if legally mandated;
h)Send transactional, operational, maintenance, cybersecurity, and service change notices. Marketing/advertising activities comply with applicable laws and offer opting-in/out mechanisms.
3.2.
Legal Grounds for Processing. JobTest determines appropriate legal grounds for each purpose and data category, including valid consent of data subjects or other grounds permitted by law.
This Policy does not replace specific personal data processing notices, data processing agreements, or separate consent required by law. Signing contracts, using services, or supplying data does not automatically imply consent for all data processing purposes.
For candidate personal data, prior to receiving or conducting processing activities requiring lawful grounds, JobTest must determine the applicable legal basis. Where consent is required by law, processing occurs only after valid consent is obtained in line with the specified purpose and scope.
When data is supplied by customers, JobTest may require customer confirmation or proof of fulfilling notification, consent, or legal processing obligations. Such confirmation does not relieve JobTest of its independent responsibility for processing activities it decides or executes directly.
3.3.
Customer Responsibilities. For candidate data or data supplied by customers for JobTest’s service execution, customers are responsible for establishing processing purposes within their domain, ensuring lawful legal grounds, fulfilling notice obligations, and obtaining consent when required by law.
JobTest processes data under contract and lawful instructions within the service scope. If instructions appear non-compliant with law or exceed service scope, JobTest reserves the right to request clarification, adjustment, or temporarily suspend relevant processing to ensure compliance.
3.4.
Automated Processing and AI Tools. Where services utilize automated tools or artificial intelligence to assist in screening, scoring, analyzing, or evaluating, data processing must align with notified purposes, service scope, system configurations, and applicable regulations.
JobTest and customers carry out responsibilities based on their actual roles. Customers bear responsibility for recruitment or business decisions made based on service results within their decision-making domain; this does not exclude JobTest’s liability for violations directly caused by JobTest.
4Candidate, Customer, Employee, and Assessment Data
4.1.Depending on services, JobTest may directly or via its platform assist Customers in receiving, managing, and evaluating candidate profiles, organizing online tests, and accessing result reports. Processed data depends on actual features, Customer configurations, and candidate inputs.
4.2.Candidate and Test Data are provided solely to Customers and authorized Users, alongside JobTest personnel or Auxiliary Service Providers requiring access for operational, support, or security needs.
4.3.JobTest does not sell personal data of candidates or customer-supplied personal data to third parties for commercial gain. Data sharing is executed only as necessary for service delivery, lawful instructions, appropriate agreements, or permitted legal grounds.
4.4.Where services involve proctoring, recording, video monitoring, behavioral analysis, or high-risk data processing, implementation must be reviewed beforehand regarding necessity, purpose, data types, authorized personnel, retention period, protective measures, and legal grounds. The party responsible for notification and purpose determination must ensure data subjects receive required information and grant consent. JobTest provides technical details under its control to assist in fulfilling obligations.
4.5.Customers are responsible for limiting access to profiles and assessment reports strictly on a need-to-know basis, ensuring recruitment decisions comply with non-discrimination laws.
4.6.If a candidate requests access, correction, erasure, restriction, or exercises other rights regarding data controlled by Customer, JobTest may forward the request to Customer and offer reasonable technical support. JobTest handles directly data for which it is legally responsible.
4.7.JobTest accesses, reviews, copies, downloads, modifies, stores, analyzes, transfers, or processes candidate data solely to deliver contract services under lawful grounds. Access is granted under strict need-to-know principles. JobTest does not use candidate data provided by customers to build separate databases, introduce candidates to other clients, advertise, train AI models, or supply third parties for independent purposes unless valid legal grounds and required notice/consent procedures are met. Using AI tools or auxiliary providers to process candidate data requires prior review of purpose, scope, access rights, location, and cross-border data transfer.
5Roles and Responsibilities of Customer and JobTest
5.1.
Customer Responsibilities:
- Ensure legal authority and lawful grounds to collect, provide, upload, and request JobTest to process personal data.
- Notify data subjects regarding processing (purpose, data types, processors/recipients, retention, rights) as required by law.
- Collect and retain evidence of valid consent or legal grounds; do not treat candidate job submissions as blanket consent for all purposes.
- Set up and review account permissions; protect login credentials; notify JobTest immediately upon detecting suspected security incidents.
- Provide only necessary, accurate, and relevant data to JobTest platforms; refrain from uploading unlawful data.
- Collaborate with JobTest to resolve data subject requests, security incidents, and legal obligations.
5.2.
JobTest Responsibilities:
- Process data according to contract, Policy, and lawful Customer instructions within service scope.
- Implement appropriate technical and organizational security measures to protect data and restrict unauthorized access.
- Ensure authorized personnel are bound by strict confidentiality obligations.
- Engage Auxiliary Service Providers only as necessary and bind them to contractual data protection and confidentiality obligations.
- Support Customer within reasonable limits regarding data export, editing, deletion, incident handling, and subject rights fulfillment.
- Do not use Customer Data for independent, incompatible purposes without legal grounds.
5.3.Each party is responsible for acts, omissions, and obligations under its control according to contract and law. Nothing herein excludes mandatory statutory liability caused directly by a party’s own breach.
5.4.Customers shall not request JobTest to process personal data unlawfully or beyond service scope. Upon receiving suspicious requests, JobTest may request clarifying evidence or adjustments prior to processing.
5.5.JobTest is under no obligation to independently verify accuracy of all customer-supplied data unless agreed contractually or required by law. Customer remains responsible for data legality and accuracy.
5.6.Allocation of liability between parties under this Policy does not prejudice statutory rights of data subjects or mandatory legal liabilities.
5.7.Customer must confirm that candidate data provided to JobTest was lawfully collected and compliant with legal requirements. When reasonable grounds exist to suspect non-compliance, JobTest may request clarification, supplementary documents, or suspend processing as necessary.
6Data Sharing and Provision
6.1.
JobTest shares or provides personal data strictly within necessary limits for:
- Customer and authorized Users according to account roles and privileges;
- Auxiliary Service Providers required for storage, operation, security, notifications, tech support, or functionality;
- Professional advisors, auditors, lawyers, or dispute resolution personnel under confidentiality obligations;
- Valid requests from competent state agencies or statutory mandates;
- Investigating, detecting, or preventing fraud, security incidents, unlawful acts, or protecting safety/rights of JobTest, Customer, or others;
- Valid consent or lawful instructions from authorized decision-makers.
6.2.Data sharing with recipients or auxiliary providers must be limited to necessary scope under lawful grounds. JobTest enforces appropriate contractual measures to maintain data confidentiality. Auxiliary providers do not relieve JobTest of its statutory obligations.
6.3.Where not prohibited by law, JobTest will endeavor to notify Customer before disclosing data to authorities. If notification is legally prohibited or impractical, disclosure may proceed without prior notice.
6.4.In case of cross-border data transfer (including platforms/systems outside Vietnam processing data collected in Vietnam), JobTest will review activities, roles, and legal duties prior to execution. Parties shall cooperate to prepare impact assessments, notifications, or filings as legally required. Customers may request reasonable details regarding auxiliary provider categories without compromising trade secrets or system security.
7Cookies, Tracking Technologies, and Analytics
7.1.JobTest websites or online platforms may use cookies or similar technologies to maintain sessions, remember preferences, secure systems, measure traffic, and improve user experience. Users can manage cookie preferences via browser settings; disabling cookies may impact functionality.
7.2.JobTest uses third-party analytics and marketing tools, including Google Analytics, Google Tag Manager, and Meta Pixel. These tools collect technical usage data per actual configuration and provider policies.
7.3.JobTest does not use advertising or marketing tools to collect candidate profile data, HR data, or test results, unless there are legal grounds and appropriate control mechanisms.
7.4.Cookie banners or separate consent mechanisms are provided as legally required based on technology and data processed.
8Security and Incident Handling
8.1.JobTest applies technical and organizational security measures appropriate to the nature, scope, risk level, and technical capabilities to safeguard personal data against unauthorized access, disclosure, alteration, loss, or processing. Measures include access controls, user authentication, system logging, backups, and security monitoring.
8.2.No system is absolute in security. JobTest does not guarantee complete elimination of all risks but takes reasonable measures to prevent, detect, respond to, and mitigate incident impacts.
8.3.Upon detecting a security incident affecting personal data, JobTest takes prompt action to assess, contain, and remediate the incident. If customer-controlled data is impacted, JobTest notifies customer contacts as soon as practicable to assist in timely compliance with statutory duties. Information provided will be updated as details emerge.
8.4.Each party carries out its statutory notification duties to state authorities or data subjects. Parties cooperate promptly and retain incident-related documentation.
8.5.Customer must notify JobTest immediately upon suspecting account compromise or credential leaks. JobTest may temporarily limit access to safeguard system security.
9Retention, Return, and Deletion of Data
9.1.JobTest retains personal data for the duration necessary to fulfill processing purposes, perform contracts, satisfy statutory record-keeping, or resolve disputes and defend legal claims.
9.2.Upon contract termination or expiration, customer data export, transfer, deletion, or anonymization is conducted per agreement. Unless agreed otherwise or required by law, JobTest deletes or anonymizes data in its control after completing handover.
Unless agreed otherwise or required by law, JobTest will delete or anonymize data under its control after completing handover and the determined retention period.
9.3.Backup and disaster recovery data are handled per standard retention cycles. Access during retention is restricted to system recovery, cybersecurity, legal obligations, or incident resolution.
9.4.Where statutory obligations require continued storage, data is restricted and erased once the legal retention basis expires.
9.5.Customer is responsible for proactively exporting data prior to service termination. Custom formatting or non-standard extraction may involve separate scope and fee agreements.
9.6.For candidate data processed for a specific job opening, parties define retention/deletion duties upon process completion. Unsuccessful candidate data must be erased or destroyed unless valid separate consent or legal grounds exist for talent pooling or future openings.
10Data Subject Rights and Request Procedure
10.1.Data subjects possess rights under applicable laws, including rights to be informed, consent/withdraw consent, access, rectify, request erasure, restrict processing, object to processing, lodge complaints, or seek compensation.
10.2.For data where Customer decides processing purposes, data subjects may submit requests directly to Customer. JobTest assists Customer within technical capabilities and lawful instructions.
10.3.For data directly controlled by JobTest, requests may be sent using contact info in Article 13. JobTest may verify identity and authority prior to processing.
10.4.JobTest handles requests within statutory timelines and procedures. If full or immediate fulfillment is restricted by law, JobTest informs the subject and records legal grounds.
11Account Security and Limitation of Liability
11.1.Users must safeguard credentials, refrain from unauthorized sharing, use strong passwords, and report suspected compromise promptly.
11.2.Customer is responsible for user privilege management and revoking access upon employee offboarding.
11.3.To the extent permitted by law, JobTest is not liable for damages directly resulting from credential leaks, improper access setup, or unlawful acts of customers/users where JobTest caused no fault or breach.
11.4.Nothing herein limits liability that cannot be legally excluded.
12Policy Amendments
12.1.JobTest may update this Policy to reflect service, tech, regulatory, or processing changes.
12.2.Updated versions will be posted on the website or communicated via appropriate channels, indicating effective date and version.
12.3.Material changes to purposes, data categories, or sharing scope will be notified, and consent re-obtained if legally mandated.
12.4.Continued service usage after updates does not imply automatic consent if separate consent is legally required.
14Effectiveness
14.1.This Policy takes effect from the time it is published on the Website and applies to all services, products, and activities within the preamble scope.
14.2.This Policy applies in conjunction with service contracts, terms of use, privacy notices, and data processing addenda.
14.3.JobTest conducts periodic reviews to maintain ongoing regulatory and operational compliance.
