.png){kind=small}
Privacy Policy
Last updated: September 8th, 2026
Welcome and thank you for your interest in EveHR Company Limited ("EveHR", or "we/us"), the EveHR platform ("Website"), and other platforms, mobile applications, and services we provide (collectively, the "Services").
This Privacy Policy ("Policy") describes how your information is collected, used, shared, and protected when you use our Services, in strict compliance with the Personal Data Protection Law 2025 (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP of Vietnam.
EveHR acts as the Personal Data Controller and Processor as defined under Article 2(9) of Law No. 91/2025/QH15 — meaning EveHR both determines the purposes and means of processing and directly carries out the processing. Your Organization (the company/enterprise you work for) acts as the "Data Controller" with respect to the employee data it provides to EveHR.
I. Principles of Personal Data Collection and Processing
We adhere to the following core principles when processing personal data:
-
Lawfulness: We only collect information with voluntary, explicit, and transparent consent from you or your Organization through lawful agreements. Silence or non-response shall not be deemed as consent.
-
Purpose Limitation: Data is used solely for the purposes of providing and improving the Services as communicated at the time of collection.
-
Data Minimization: We only collect data that is strictly necessary for the stated purposes.
-
Accuracy: We ensure personal data remains up-to-date and accurate throughout the processing period.
II. What Information Is Collected?
Below is a classification of data we collect when you use the Services:
Important note on HR Admin data exports: When an HR Admin downloads reports containing personal data (including phone numbers) via the Admin Portal, the Organization (Data Controller) bears full responsibility for the security and handling of that data once it has been exported from the EveHR system.
III. Data Processing in the Rewards Redemption Service
3.1. What kinds of information is collected?
When you redeem rewards using gift codes (e-vouchers) from Suppliers, the EveHR system only provides the code. We do not automatically send or synchronize any of your personal information to the Supplier's system.
The sole exception is when you voluntarily provide information so that we can assist in resolving technical issues at the Supplier's request.
3.2. E-wallet Top-up Service (MoMo)
For the MoMo e-wallet top-up service, the data processing procedure is as follows:
-
Data processed: When you voluntarily enter your phone number on the transaction screen, the EveHR system will transmit that phone number to MoMo to process the wallet top-up. The phone number entered here is the one linked to your MoMo account — separate from your EveHR account phone number.
-
Limited retention: The phone number entered on the MoMo transaction screen is retained in an internal Operations log for the purpose of transaction reconciliation and supporting cases where users enter an incorrect phone number or raise a complaint. This log is accessible only by EveHR's internal Operations team and is not visible to your Organization's HR Admin. Within the internal Operations log, the phone number is stored in partially masked form (e.g. 090****123). Where the full phone number is needed to support a complaint, the Operations team looks it up directly through MoMo's system — the full phone number is not stored on EveHR's system. You must re-enter your phone number for each new transaction.
-
Scope of use: EveHR does not use this phone number for any commercial, marketing, or unrelated purposes.
-
Legal basis: This data transmission is carried out based on your explicit consent at the time you confirm the transaction.
IV. Information Sharing and Cross-border Data Transfer
We may share or transfer your information in the following cases:
-
Cross-border data transfer: Platform data is stored exclusively on AWS Cloud infrastructure in a single region located in Singapore (ap-southeast-1) and is not replicated to any other region. We are committed to ensuring that this cross-border data transfer fully complies with the requirements under Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.
-
Organization's HR Admin: Personal data of Users, including phone numbers, may be accessed and exported from the system by HR Admins through the Admin Portal. See Section II for details.
-
MoMo (e-wallet top-up): Your MoMo phone number is transmitted to MoMo only when you actively request a wallet top-up, as described in Section III.2.
-
Other third parties: We only share anonymized data (that cannot identify individuals) with analytics partners for service improvement. We do not sell or exchange personal data with any third party.
-
Legal compliance: When there is a lawful request from law enforcement, a search warrant, or a competent authority in Vietnam. We will endeavor to notify the Organization before providing data, unless prohibited by the relevant authority's order.
V. Data Subject Rights
Pursuant to the Personal Data Protection Law No. 91/2025/QH15, you (as a Data Subject) are guaranteed the following rights:
-
Right to Know & Access: View your personal information on the User Portal. To request data extraction as a file, please contact your Organization's Administrator or email security@evehr.vn.
-
Right to Rectification: Correct inaccurate personal information through your personal account or by notifying your Organization's Administrator.
-
Right to Withdraw Consent: You may withdraw your consent to personal data processing at any time via Privacy Settings or by emailing security@evehr.vn. Withdrawal of consent may result in your inability to continue using part or all of the Services.
-
Right to Erasure and Destruction: You may request data deletion by contacting your Organization (Data Controller) for them to instruct us to carry out the request.
-
Right to De-identification: You may request de-identification of your personal data so that it can no longer be associated with you.
-
Right to Restrict and Object to Processing: In cases where you believe your data is being used for purposes other than those stated.
-
Right to Data Portability: You may request a copy of your personal data in a commonly used, structured, and machine-readable format (CSV/JSON).
Response timeline: We commit to acknowledging receipt of your request within 2 business days and completing the action within 10 business days from receipt of a valid request. Complex cases may be extended by up to an additional 10 business days, with prior notice to you.
How to exercise your rights: Contact your Organization's Administrator or email security@evehr.vn.
VI. Data Retention and Deletion
We apply a strict data lifecycle retention policy:
-
Closed individual accounts: Information will be kept in a deactivated state in the system and deleted upon the Organization's request.
-
Contract termination: If your Organization terminates its service agreement with EveHR, all personal data of users belonging to that Organization will be permanently deleted from the system (including backups) after exactly 6 months (180 days) from the date of contract termination. Organizations may request a full data export (CSV/JSON) prior to deletion.
-
MoMo transaction data: MoMo phone numbers are retained in an internal Operations log for reconciliation and complaint support purposes, accessible only by EveHR's internal Ops team. Transaction history (transaction ID, amount, timestamp) is retained for the duration of the contract with the Organization and deleted together with all Organization data 180 days after contract termination.
VII. Data Breach Notification
In the event of a personal data protection breach or incident, EveHR commits to the following two mandatory milestones:
-
Within 72 hours of discovery: Send an initial notification to Department A05 — Ministry of Public Security, and notify the Organization (Data Controller) to coordinate response.
-
Within 15 days of the initial notification: Submit a full report to A05 covering the scope of the incident, root cause, number of affected data subjects, and remediation measures taken.
-
Maintain incident records for a minimum of 5 years after full resolution.
VIII. Limitation of Liability
The Platform shall be exempt from liability in the following cases:
-
Data breaches caused directly by the user (e.g., sharing passwords, using infected devices).
-
Cyber Force Majeure: Incidents caused by large-scale cyberattacks or zero-day exploits that exceed the reasonable defense capabilities of current-standard protection systems.
-
Data that users voluntarily provide directly to third parties (e-voucher Suppliers) outside the scope of the EveHR system.
-
Data breaches occurring after HR Admins have exported data out of the EveHR system.
IX. Data Protection Officer (DPO)
EveHR has designated a Data Protection Officer pursuant to internal Decision No. 25082603 /QD-TM.
If you have any questions about Privacy or wish to exercise your rights, please contact:
-
Department: Data Protection Officer — EveHR Company Limited
-
Security & Privacy Email: security@evehr.vn
-
User Support Email: help@evehr.vn
-
Hotline: 0326 257 070
You may also contact your Organization's Administrator for assistance in exercising your data subject rights.
X. Policy Updates
We may update this Policy to comply with new legal requirements or changes in our business operations.
-
Non-material changes (wording adjustments, updated contact information): Will be communicated via the Admin Portal or Website.
-
Material changes (changes to data processing purposes, types of data collected, third-party data recipients, or cross-border data transfer mechanisms): We distinguish between two cases:
-
Changes made at EveHR's discretion (e.g. new partner integrations, additional data collection features): We will provide clear notification via email and/or the Admin Portal and will require renewed consent from you or your Organization before applying the changes. If you do not consent, you may continue using the Service within its current scope or terminate the agreement under the terms of your contract.
-
Changes required by law or regulation (e.g. compliance with the Personal Data Protection Law, requirements from competent authorities): We will clearly notify you of the nature and reason for the change, but cannot seek consent as these are mandatory legal obligations binding on all parties. Continued use of the Service constitutes acceptance of such changes.
-