Privacy policy
How Virtaforce collects, uses, protects and shares personal data, the rights you have over it wherever you live, and how to use them.
- Virtaforce Company Limited
- Vietnam, the EU and EEA, the United Kingdom, the United States, Singapore, Australia, the UAE, Saudi Arabia and the rest of Southeast Asia
In short
This website does not track you
No cookies, no analytics, no advertising tags. The contact form writes an email in your own mail app; nothing reaches us until you send it.
We never sell personal data
Not to anyone, for any price. We do not share it for advertising either.
Client data stays the client's
Data we handle while working for a client is used only on that client's instructions, and returned or deleted when the work ends.
The same rights for everyone
You can see, correct, delete or move your data and object to its use, whichever country you live in.
Fast, fixed response times
We confirm a request within 2 working days and complete it within 10 to 20 days, depending on what you ask.
Breaches reported in 72 hours
If a breach puts you at risk, we tell the regulator within 72 hours and tell you without delay.
01Who we are
Virtaforce Company Limited ("Virtaforce", "we", "us") is a company registered in Vietnam under enterprise registration number 0317708835, with its registered office at Office 9.14, 9th Floor, Golden King Tower, 15 Nguyen Luong Bang, Tan My Ward, Ho Chi Minh City, Vietnam. Our team works remotely from across Vietnam. We run virtual assistance and operations, customer service and executive assistance for companies in other countries, combining our people with AI tools.
For the personal data described in this policy we are the controller: we decide why and how it is used, and we are responsible for it. For questions or requests about your data, write to privacy@virtaforce.com. The person responsible for data protection at Virtaforce reads every message sent there.
02Whom this policy covers
This policy applies to personal data about:
- people who visit this website;
- people who contact us, by email, through the contact form or on WhatsApp, Zalo or LinkedIn;
- people who work for our clients, prospective clients, suppliers and partners, and deal with us on their behalf;
- people who apply to work with us.
It does not cover data we handle on a client's behalf while doing the work they hired us for. That is explained in "Data we handle for clients" below. Our own staff receive a separate notice.
03What this website collects
This website is built to collect as little as possible:
- It sets no cookies and stores nothing in your browser.
- It uses no analytics, advertising, social media or tracking tools. Its fonts, images and scripts all come from our own server, so your visit is not reported to anyone else.
- The contact form does not send anything. It writes an email in your own mail app, which you can read, change or discard before sending.
- The local time shown on the Contact page is worked out in your browser and is not sent to us.
This website is hosted by StableHost on a server in Singapore. Like every web server, it records technical details of each request: your IP address, browser type, the page asked for and the time. These records are kept to keep the site running and secure, and are not used to identify or profile visitors.
Because the site uses no cookies or trackers, it shows no cookie banner. If we ever add such tools, we will update this policy first and, where the law requires it, ask for your consent before they run. Signals such as Global Privacy Control will be respected.
The WhatsApp, Zalo and LinkedIn buttons take you to those services. What you do there is covered by their own privacy policies.
04Personal data we collect
| What | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, job title, company, email address, phone number, messaging handle | You, your colleagues, or public business sources such as your company's website or LinkedIn |
| Your enquiry and messages | What you want handled, your timing, anything you write to us | You |
| Business relationship | Contracts, orders, billing contacts, invoices, payment records, meeting notes | You and your company |
| Job applications | CV, work history, skills, references, test results, interview notes, expected start date | You, your referees, and recruitment platforms you applied through |
| Technical data | IP address, browser type, pages requested | Our hosting server, as described above |
We do not ask for sensitive personal data, such as health, religion, political views, biometric data or financial account details, from visitors, contacts or clients. Applicants we decide to hire are asked for identity documents and similar records only when the law requires them for an employment contract, and are told beforehand what is needed and why.
05How we use it, and on what legal basis
We use personal data only for the purposes below. Different laws name the grounds for using data differently; the table gives the ground under the EU and UK GDPR, and the same purposes rest on contract, consent or legal duty under Vietnamese law and on the equivalent grounds elsewhere.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and preparing a proposal | Steps you asked for before a contract; our legitimate interest in answering business enquiries |
| Setting up, running and managing work for clients | Performance of our contract with your company; our legitimate interest in working with its staff |
| Invoicing, accounting and tax | Legal obligation |
| Recruiting | Steps before an employment contract; your consent, where the law requires it |
| Keeping our systems, website and the data in them secure | Legitimate interest; legal obligation |
| Sending business news or updates | Your consent. Every message lets you stop them |
| Meeting legal duties and defending legal claims | Legal obligation; legitimate interest |
Where we rely on legitimate interest, we have weighed it against your rights and you can object at any time. Where we rely on consent, you can withdraw it at any time; this does not affect what was done before. We do not use personal data for a new purpose without telling you, and asking again where the law requires it.
We do not make decisions about you that have legal or similarly significant effects by automated means alone. People at Virtaforce make every hiring, client and contract decision.
06Data we handle for clients
Our work means our staff often use our clients' own systems: their help desk, inbox, calendar, files or customer records. That data belongs to the client. For it, the client is the controller and we act as its processor (called a service provider in some US states). This means we:
- use it only to do the work the client asked for, under a written agreement and the client's documented instructions;
- give access only to the staff assigned to that client, each bound by confidentiality;
- do not sell it, combine it with other data or use it for our own purposes;
- bring in another company to help with it only with the client's agreement;
- tell the client without undue delay if we become aware of a breach affecting it;
- help the client answer its customers' requests and meet its own legal duties;
- return or delete it when the work ends, as the client chooses, unless the law requires us to keep it.
These commitments are written into our data processing agreement, which clients sign with their service agreement and can ask for at any time.
If you are a customer of one of our clients and want to know how your data is used, please contact that company. Its privacy policy applies. If you contact us, we will pass your request to it promptly.
07Who we share it with
We share personal data only when we need to, and only as much as is needed:
- Companies that provide services to us, listed below, and our accounting firm, banks and payment providers, and recruitment platforms. They may use the data only to provide their service to us, under contract.
- Professional advisers, such as lawyers, auditors and accountants, who are bound by confidentiality.
- Courts, regulators, tax and other authorities, when the law requires it. We check that a request is lawful before answering it, and share no more than it requires.
- A buyer of or investor in our business, if that happens, under the same protections as this policy.
The main services that hold personal data for us are:
| Provider | What we use it for | Where the data is stored |
|---|---|---|
| Google Workspace | Email, calendars, documents and file storage | Google's data centres in the United States and other countries |
| Bubble | Our internal operations system: client, project, staffing and billing records | Amazon Web Services servers in the United States |
| StableHost | Hosting this website | Singapore |
We do not sell personal data, rent it, or share it for targeted advertising.
08International transfers
We are based in Vietnam and our clients are in many countries, so personal data moves between Vietnam, the country you are in, and the countries where our service providers keep their servers. Wherever it goes, it is protected as this policy describes.
- Data from the EU, EEA, United Kingdom or Switzerland is transferred under the European Commission's standard contractual clauses, with the UK addendum or Swiss changes where needed, or another safeguard those laws recognise. You can ask us for a copy.
- Data leaving Vietnam is transferred after the impact assessment Vietnamese law requires, filed with the Ministry of Public Security where the law requires that.
- Transfers from other countries, such as Singapore, Australia, the UAE and Saudi Arabia, are made under contracts that bind the recipient to protection comparable to the law of the country the data came from.
09How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that do not lead to work | 2 years after our last contact, then deleted |
| Client contracts and the business relationship | The length of the contract, then as long as needed for possible legal claims, normally up to 5 years |
| Invoices and accounting records | At least 10 years, as Vietnam's Law on Accounting requires |
| Applications that do not lead to a job | Deleted when the hiring process ends, unless you agree that we keep your application for future roles, for up to 12 months |
| Data handled for a client | As the client's contract sets out; returned or deleted when the work ends |
| Hosting server records | As long as the hosting company keeps them for security; see above |
When the time is up we delete the data or make it anonymous so that it can no longer identify anyone.
10How we protect it
We protect personal data with technical and organisational measures suited to the risk, including:
- access only for the people who need it for their work, removed when their role changes;
- confidentiality obligations for every member of staff;
- encrypted connections for this website and the services we use;
- services from established providers whose security is independently audited: Google Workspace (ISO/IEC 27001 and SOC 2) and Bubble (SOC 2 Type II, with data encrypted in transit and at rest).
- multi-factor sign-in on accounts that hold personal data;
- regular training for staff on handling personal data and client systems;
- a written plan for responding to incidents.
If a breach is likely to put people's rights at risk, we report it to the relevant regulator within 72 hours of finding it, as Vietnamese, EU and UK law require, and tell the people affected without undue delay when the risk to them is high, saying what happened and what they can do. Where a client's data is involved, we tell the client without undue delay so that it can do the same.
11Your rights
We give the following rights to everyone, wherever they live, even where local law gives fewer. You can ask us to:
- tell you whether we hold personal data about you, and how we use it;
- give you a copy of it, in a common electronic format if you want to move it elsewhere;
- correct it if it is wrong or incomplete;
- delete it, unless we must keep it by law;
- stop or limit how we use it, or stop using it for a particular purpose;
- stop sending you business news, at any time and without giving a reason;
- withdraw a consent you gave us.
You also have the right to complain to us, and to the data protection authority where you live or work. Below are the main laws that may apply to you, and what each adds.
Vietnam
- Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP
- Ministry of Public Security, Department of Cybersecurity and High-tech Crime Prevention (A05)
The response times in "How to make a request" are the ones this law sets. Withdrawing consent is done in writing, by email for example.
European Union and EEA
- General Data Protection Regulation (GDPR)
- The data protection authority in your country
You can object at any time to use based on our legitimate interests, and ask for a copy of the transfer safeguards described above.
United Kingdom
- UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025
- Information Commissioner's Office (ICO)
You can complain to us first. We acknowledge a complaint within 30 days and tell you the outcome without undue delay.
United States
- California Consumer Privacy Act and other state privacy laws, where they apply to us
- California Privacy Protection Agency, or your state's attorney general
In the last 12 months we have collected identifiers, professional details, commercial records and server records, for the purposes above. We have not sold or shared personal information or used sensitive personal information to infer anything about you. You can act through an authorised agent, and you will not be treated differently for using your rights.
Singapore
- Personal Data Protection Act 2012
- Personal Data Protection Commission (PDPC)
Our privacy contact above acts as our data protection officer for Singapore.
Australia
- Privacy Act 1988 and the Australian Privacy Principles
- Office of the Australian Information Commissioner (OAIC)
Your data may be held in Vietnam and in the countries of our service providers. Complain to us first; if you are not satisfied with our answer within 30 days, you can go to the OAIC.
United Arab Emirates and Saudi Arabia
- UAE Federal Decree-Law No. 45 of 2021; Saudi Personal Data Protection Law
- UAE Data Office; Saudi Data and Artificial Intelligence Authority (SDAIA). Companies in the DIFC or ADGM have their own data protection offices
The rights listed above apply in full.
Rest of Southeast Asia
- Including Thailand's PDPA, the Philippines' Data Privacy Act, Malaysia's PDPA and Indonesia's PDP Law
- The data protection authority in your country
The rights listed above apply in full.
12How to make a request
Email privacy@virtaforce.com and tell us what you want. You can write in English or Vietnamese. Using your rights is free; we may refuse or charge a fair fee only for requests that are plainly unfounded or excessive, as the law allows, and will explain why.
- 2We confirm we have your request, and ask for anything we need to check it is really you.
- 10To see, copy or correct your data.
- 15To stop or limit use of your data, or withdraw a consent.
- 20To delete your data.
If a request is complex, or a service provider of ours must act on it too, we may need longer, once, by up to the same period again. If so, we will tell you why before the first deadline.
13Children
Our website and services are for businesses and are not meant for children. We do not knowingly collect personal data from anyone under 18. If you believe we hold a child's data, tell us and we will delete it.
14Changes to this policy
When we change this policy, we publish the new version here with a new date at the top. If a change materially affects how we use your data, we will tell clients and the people we are in contact with before it takes effect, and ask for consent again where the law requires it.
This policy is published in English and Vietnamese. If the two versions differ, the Vietnamese version applies to matters governed by Vietnamese law, and the English version applies to everything else.
Questions about your data?
Write to us. We confirm every privacy request within 2 working days.
Email us