Privacy Policy
What we collect, why we collect it, who else sees it, and what you can require us to do about it. Written to be read, not to be survived.
1. Who we are
START-VIETNAM COMPANY LTD., trading as SkillTeam, operates the website at skillteam.io and the online courses sold through it. In this policy, “we”, “us” and “our” mean that company. “You” means anyone who visits the site, creates an account, buys a course or applies to something listed on our Opportunities board.
CÔNG TY TRÁCH NHIỆM HỮU HẠN START-VIETNAM
START-VIETNAM COMPANY LTD.
Enterprise Code: 0110996016
Head Office: 12B Ha Tri 1 Street, Ha Dong Ward, Hanoi City, Vietnam
Email: info@skillteam.asia
SkillTeam and Skillteam Asia are trading names of START-VIETNAM COMPANY LTD., which is the legal entity behind skillteam.io and the party you contract with when you buy a course.
For the purposes of Decree 13/2023/ND-CP on Personal Data Protection, we are the Personal Data Controller for the data described below. Where we use outside services to run the site, those services act as Personal Data Processors on our instructions.
2. What this policy covers
This policy explains what personal data we collect when you use skillteam.io, why we collect it, who else sees it, and what you can require us to do about it. It applies to the website, our courses, our emails and the Opportunities board.
We are based in Vietnam and this policy follows Vietnamese law, principally Decree 13/2023/ND-CP on Personal Data Protection, the Law on Cyber Security 2018, the Law on E-Transactions 2023 and the Law on Protection of Consumer Rights 2023. Many of our learners study or work outside Vietnam. Where the EU or UK General Data Protection Regulation applies to you because of where you are, we honour the rights it gives you as well, and this policy should be read as granting you whichever protection is stronger.
3. What we collect
We collect four kinds of information, and we collect very little that you do not hand us directly.
Information you give us when you create an account
- Your name and email address
- A password, which is stored only as a cryptographic hash and is never visible to us
- Anything else you choose to add to your profile, which is optional
Information you give us when you buy a course
- Billing name, billing address, email address and, where required by the payment method, a phone number
- The course purchased, the amount, the currency and the date
We never see your card. Card numbers, expiry dates and security codes are entered directly into our payment providers’ systems and are never transmitted to or stored on our servers. What we receive back is a confirmation that the payment succeeded, the last four digits and the card brand, so we can identify the transaction if you contact us about it.
Information created as you learn
- Which lessons and topics you have opened and completed
- Your quiz answers, scores and the number of attempts
- Written answers you submit in exercises and assessments
- Certificates issued to you, and the date of issue
- Points and achievements, where a course awards them
This is the data that makes the courses work: without it we cannot show you your progress, mark your quizzes or issue a certificate.
Information collected automatically
- Your IP address, browser type, operating system and screen size
- The pages you visited, when, and which page sent you to us
- Aggregate site statistics used to understand which courses and articles people read
If you apply through the Opportunities board
Some listings send you to an outside employer’s own application system, in which case that employer’s privacy policy governs what happens next and we receive nothing. Where a listing asks you to apply through us, we collect what the listing asks for, which normally means your name, email, CV and any covering note, and we pass it to the named organisation for that role only. We do not add applicants to a database, share applications with organisations you did not apply to, or sell candidate information to anyone at any price.
4. Why we use it, and on what basis
Under Decree 13/2023/ND-CP we must tell you the purpose of each use of your data. We use it for these purposes and no others.
| What we do | Data used | Basis |
|---|---|---|
| Create and run your account | Name, email, password hash | Performance of our contract with you |
| Give you the course you paid for and record your progress | Account data, learning data | Performance of our contract with you |
| Take payment and issue receipts | Billing details, transaction records | Performance of our contract, and legal obligation |
| Mark quizzes and issue certificates | Quiz answers, scores, name | Performance of our contract with you |
| Send you service emails about your account, purchase or course | Name, email | Performance of our contract with you |
| Send you marketing emails about new courses or opportunities | Name, email | Your consent, which you may withdraw at any time |
| Pass your application to an employer you applied to | Application data | Your consent, given per application |
| Understand which pages and courses are used, and keep the site secure | Technical and usage data | Our legitimate interest in running a working, safe site |
| Keep accounting records | Transaction records | Legal obligation |
We do not sell your personal data. We do not rent, trade or otherwise make it available to advertisers, data brokers or list resellers, and we do not use it to build advertising profiles. We do not make automated decisions about you that have a legal or similarly significant effect.
6. Sending data outside Vietnam
Some of the services above store or process data outside Vietnam. Stripe operates from the United States and Ireland; Automattic operates from the United States. This means that some of your personal data is transferred abroad, which Decree 13/2023/ND-CP treats as a regulated activity.
Where we transfer personal data outside Vietnam we do so only to established providers that contractually commit to protecting it, and we limit the transfer to what the service actually needs. We maintain the transfer impact assessment dossier that Article 25 of the Decree requires, and we will provide it to the Department of Cyber Security and High-Tech Crime Prevention on request.
If you would like to know where a specific piece of your data is held, ask us and we will tell you.
7. How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Account and profile data | While your account is open, then 12 months | So you can come back, and so we can resolve any late dispute |
| Course progress, quiz answers and certificates | While your account is open, then 12 months | Course access does not expire, so your record has to persist |
| Transaction and invoice records | 10 years | Required by the Law on Accounting 2015 |
| Marketing consent records | 3 years after you withdraw consent | To prove we had permission to contact you |
| Job applications submitted through us | 6 months | Long enough for the employer’s process, no longer |
| Server and security logs | 90 days | Diagnosing faults and abuse |
When a retention period ends we delete the data or anonymise it so that it can no longer be connected to you. Note that if you ask us to delete your account we must still keep transaction records for the ten years accounting law requires; we will delete everything else.
8. Your rights
Decree 13/2023/ND-CP gives you the following rights over your personal data. They are real and we will act on them.
- To know what data we hold about you and what we do with it
- To access that data and receive a copy of it
- To correct anything inaccurate, which you can do yourself for most fields in your account settings
- To withdraw consent at any time, for anything you consented to
- To delete your data, subject to the accounting records we are legally required to keep
- To restrict or object to what we do with your data
- To receive your data in a usable form so you can take it elsewhere
- To complain, to denounce, or to bring legal proceedings
- To claim compensation if our handling of your data caused you loss
How to use them: email info@skillteam.asia with what you want. We will respond within 72 hours, which is the deadline the Decree sets. If a request is complicated and will take longer to complete, we will tell you inside those 72 hours what we are doing and when it will be finished.
We do not charge for any of this, and we will never make you justify a request.
9. Learners under 16
Some of our courses are aimed at students preparing to study abroad, and some of those students are under 16. Article 20 of Decree 13/2023/ND-CP requires the consent of a parent or legal guardian before the personal data of a child under 16 is processed.
If you are under 16, please do not create an account without your parent or guardian’s agreement, and ask them to complete the purchase. If we learn that we hold data about a child under 16 without that consent, we will delete it and refund any purchase in full.
A parent or guardian may at any time see what we hold about their child, correct it or have it deleted, by writing to us from the email address on the account.
11. How we protect your data
- The whole site is served over HTTPS, so traffic between you and us is encrypted
- Passwords are stored only as salted hashes and cannot be read, by us or by anyone else
- Card details never reach our servers
- Administrative access is limited to the people who need it, and is protected by strong, unique credentials
- Backups are encrypted and held off-site
- Software is kept up to date, because most breaches exploit known, already-patched flaws
No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can promise is that we hold as little as we can, we do not keep what we do not need, and we have thought about what happens if we are wrong.
12. Changes to this policy
When we change this policy we will update the date at the top of the page. If a change materially affects how we use your data, we will email everyone with an account before it takes effect, and where the change requires your consent we will ask for it rather than assume it.
We do not make changes retroactive.
13. Contact and complaints
Questions about this policy, or about anything we hold on you, go to info@skillteam.asia. A person reads that address, and we aim to reply within two business days for general questions and within 72 hours for anything that is a formal data request.
If you are not satisfied with how we have handled a data protection matter, you have the right to complain to the Department of Cyber Security and High-Tech Crime Prevention (A05) of the Ministry of Public Security, which supervises personal data protection in Vietnam. If you are in the EU or the UK, you may instead complain to your national supervisory authority.
We would much rather you told us first, and we will take a complaint seriously whether or not you escalate it.
Still not sure about something?
Privacy policies are written to be complete, which does not always make them clear. If any part of this affects a decision you are trying to make, write to us and ask in plain words.