Privacy Policy

HD Global Consulting Co.,Ltd. ("we", "us") sets out this Privacy Policy ("Policy") to explain how we handle personal information in the One Sapo web service and mobile app (together, the "Service").

1. Scope

This Policy applies to the One Sapo website (one-sapo.com), the web management console, and the One Sapo mobile app for iOS and Android.

The Service is a business tool that client companies (\"Client Companies\") use to manage their own employees and operations. Client Companies are responsible for the personal information of employees they register in the Service, and we process that information on their behalf. If you are an employee and wish to access, correct or delete your data, please contact the administrator of your company first.

2. Information we collect

To provide the Service, we collect the following information.

• Account information: name, email address, phone number, company, department, position, employee number, login ID, password (stored only as an irreversible hash), profile picture, display language
• Attendance and HR information: clock-in/out times; leave, overtime, absence and compensatory-leave requests; approval history; contract type
• Payroll information: salary, allowances and deductions, social insurance and tax information, dependant information, payslips (when the Client Company uses the payroll feature)
• Expense information: expense claims and attached receipts
• Business data: tasks and issues, chat messages and attachments, quotes and invoices including the business partner information they contain, and any other content you enter or upload
• Location: only when the Client Company enables GPS clock-in, the location (latitude, longitude, accuracy) at the moment you clock in from a web browser. The mobile app does not collect location data.
• Device and notification information: push notification device token, OS type, app version
• Access logs: IP address, browser and device type, access time, operation history
• Inquiry information: name, company, email, phone number and message entered in the contact form
• Contract and billing information: Client Company name, address, contact person, billing details and payment status. Card numbers and other payment details are collected directly by our payment service provider; we do not store them.

3. How we use information

We use the information we collect to:

• Provide the Service (authentication; attendance, leave, expense, payroll, task, chat and document features)
• Send push and email notifications about requests, approvals, chat and similar events
• Bill for the Service, manage contracts, and send notices about free trials
• Respond to inquiries and provide support
• Prevent unauthorized access and misuse and keep the Service secure
• Investigate failures, maintain and improve the Service, and develop new features
• Respond to violations of our terms and comply with legal obligations

4. Disclosure to third parties

We do not provide personal information to third parties without the consent of the individual or the Client Company, except:

• When required by law
• When necessary to protect life, body or property and it is difficult to obtain consent
• When necessary to cooperate with public authorities performing duties prescribed by law
• When we outsource work to the extent necessary for the purposes above (Section 5)
• In connection with a merger, business transfer or similar transaction

We do not sell personal information, and we do not share it with third parties for advertising purposes.

5. Third-party services

The Service uses the following third-party services, and information is sent to them as needed. Their handling of information is governed by their own privacy policies.

• Firebase Cloud Messaging (Google LLC): delivery of push notifications (device token, notification content)
• Google / Microsoft account integration: sign-in, file storage on Google Drive or OneDrive, and Google Calendar integration, when you choose to use them
• OnePay and other payment service providers: online payment of service fees
• Google Tag Manager / Google Analytics (Google LLC): website analytics (Section 6)
• Hosting and email delivery providers: data storage and sending email

6. Cookies

The website uses cookies and sessions to keep you signed in and remember your language. The public website also uses Google Analytics, which collects anonymous usage data through cookies. You can disable cookies in your browser, but some features such as sign-in will then be unavailable.

The mobile app stores an authentication token on your device to keep you signed in. The app does not track you for advertising or behavioural targeting.

7. Device permissions

The mobile app uses the following permissions. You can change them at any time in your device settings.

• Notifications: to show alerts about requests, approvals, chat and similar events
• Files and photos: only when you choose a profile picture, receipt or chat attachment to upload
• Internet: to communicate with the Service's servers

8. International transfers

The Service is provided mainly in Vietnam and Japan. Information may be stored and processed in Vietnam, Japan, and the countries where the third-party providers in Section 5 operate servers (such as the United States). We take appropriate measures to ensure a level of protection equivalent to this Policy.

9. Security

We take security measures to prevent leakage, loss or damage of personal information, including:

• Encrypted communication (HTTPS/TLS)
• Hashed password storage
• Logical separation of each Client Company's data and role-based access control
• Protection against CSRF and other unauthorized operations, and access logging
• Limiting and training the staff who handle personal information

10. Retention

We keep personal information for as long as needed for the purposes above or for the term of the contract with the Client Company. After the contract ends, we delete or anonymize it within a reasonable period, except for information we are legally required to keep (such as payroll and attendance records).

11. Account and data deletion

Accounts are issued and managed by the administrator of each Client Company. To delete your account or personal data, ask your company administrator or contact us at the address in Section 13. After verifying your identity and consulting with the Client Company, we will delete the data, except for information we are legally required to keep.

Uninstalling the mobile app removes the authentication token and other data stored on your device.

12. Your rights

Subject to applicable law, you may request notification of the purposes of use, access, correction, addition or deletion, suspension of use or erasure, and suspension of disclosure to third parties of your personal information that we hold. Please send requests to the contact in Section 13; we will respond without delay after verifying your identity. For information we process on behalf of a Client Company, we may respond through that company.

13. Company information and contact

For questions about this Policy or our handling of personal information, please contact:
Company: HD Global Consulting Co.,Ltd.
Address: 14B Chu Văn An, Phường Thuận Hóa, Thành phố Huế, Việt Nam
Enterprise registration number: 3301683323
Contact: One Sapo Privacy Contact
Email: info@hd-global-consulting.com

14. Children

The Service is a business service and is not directed at anyone under 16.

15. Applicable law and changes

We comply with the Act on the Protection of Personal Information of Japan, the personal data protection laws of Vietnam, and other applicable laws.

We may revise this Policy in response to changes in law or in the Service. We will announce material changes in the Service or by other means. The revised Policy takes effect when it is posted on this page.