Last updated: [June 1, 2026]
Operator: iWE Solutions Co., Ltd.
Website/App: iWE – Integrated Workforce & Wellness Ecosystem
Contact Email: hello@iwe.com.vn
Hotline: 0905073030

References:

Personal Data Protection Law No. 91/2025/QH15, effective from January 1, 2026.

Data Law No. 60/2024/QH15, effective from July 1, 2025.

Decree 13/2023/ND-CP on personal data protection.

Law on Protection of Consumer Rights 2023 and the e-commerce framework under Decree 85/2021/ND-CP.

1. Introduction

iWE respects privacy and is committed to protecting the personal data of users in accordance with Vietnamese laws on personal data protection, information security, digital data, electronic transactions, and other relevant legal regulations.

This Privacy Policy explains how iWE collects, uses, stores, shares, protects, and processes personal data when you access the website, use the application, register an account, participate in a campaign, or interact with iWE services.

2. Scope of Application

This policy applies to:

  • Individual users accessing the iWE website or application.
  • Workforce participants in programs implemented by businesses/organizations on iWE.
  • Business representatives, administrators, HR, partners, or providers using iWE dashboards, reports, or management tools.
  • Individuals contacting iWE via forms, email, hotline, social media, or other support channels.

3. Types of Personal Data Collected

Depending on the features and purpose of use, iWE may collect the following groups of data:

Identification and contact data: full name, phone number, email, employee ID, department, job title, business/organization, username, and profile picture if provided by the user.

Account and service usage data: login information, access history, in-app activities, completed tasks, reward points, badges, feedback, content submitted via forms, and support requests.

ESG/Wellness campaign data: step count, physical activities, hydration challenges, check-ins, waste sorting, carpooling, event participation, tree redemption, point accumulation, task results, or data actively entered by the user.

Technical and device data: IP address, device type, browser, operating system, device identifiers, cookies, system logs, access times, technical errors, and security information necessary for system operation.

Sensitive personal data: in certain wellness features, iWE may process data related to health, lifestyle habits, movement, physical status, or other information that may be considered sensitive personal data under the law. iWE only processes this data group when there is a legal basis and/or appropriate consent from the data subject.

iWE does not actively request users to provide unnecessary information such as identification documents, biometric data, financial information, medical records, or other sensitive data unless it directly serves the notified purposes.

4. Purposes of Data Processing

iWE processes personal data for the following purposes:

  • Creating, authenticating, and managing user accounts.
  • Providing, operating, personalizing, and improving services.
  • Recording campaign participation results, calculating points, issuing badges, confirming reward redemptions, or supporting internal programs.
  • Sending notifications related to accounts, campaigns, tasks, rewards, service changes, or technical support.
  • Providing aggregate reports to businesses/organizations regarding participation levels, campaign effectiveness, ESG metrics, wellness, and workforce engagement.
  • Detecting and preventing fraud, unauthorized access, system abuse, or violations of terms.
  • Ensuring information security, data privacy, and stable system operation.
  • Fulfilling legal obligations, resolving complaints, disputes, or requests from competent state authorities.
  • Analyzing, statistics, research, and product improvement based on aggregated, anonymous, or appropriately processed data.

5. Legal Basis for Data Processing

iWE processes personal data based on one or more of the following grounds:

  • User consent.
  • Performance of a contract, agreement, or terms of use between the user, the business/organization, and iWE.
  • Legal obligations of iWE.
  • Legitimate interests of iWE in operation, security, fraud prevention, and service improvement, provided that it does not unlawfully affect the rights and legitimate interests of users.
  • Other grounds permitted by Vietnamese law.

For sensitive personal data, iWE will provide clearer notification regarding the type of data, purpose, scope of processing, processing parties, processing duration, and the rights of the data subject before processing, except where the law allows processing without consent.

6. Data Collection Methods

iWE may collect data from:

  • Information provided directly by users when registering, updating profiles, participating in campaigns, or submitting support requests.
  • Data generated during the use of the website/application.
  • Data provided by businesses/organizations to set up internal programs, such as personnel lists, departments, employee IDs, or access permissions.
  • Data from devices, browsers, cookies, analytical tools, or security systems.
  • Data from legally integrated third parties, within the scope permitted by the user or business.

7. Sharing Personal Data

iWE does not sell user personal data.

iWE only shares personal data in necessary and appropriate cases, including:

  • With businesses/organizations implementing programs, within the scope notified to users.
  • With service providers for technical support, storage, security, email delivery, notifications, data analysis, customer care, or reward redemption.
  • With partners providing gifts/vouchers/reward programs, if necessary to confirm user benefits.
  • With competent state authorities upon legal request.
  • With transferees in the event of restructuring, merger, or business transfer, provided that the recipient continues to protect the data under an appropriate policy.

Data recipients must comply with confidentiality obligations and may only process data for the agreed purposes or as prescribed by law.

8. Reporting to Businesses/Organizations

For programs implemented for businesses, iWE prioritizes providing reports in aggregate, statistical, or anonymous forms, such as: participation rates, number of completed tasks, total points, estimated emission reductions, redeemed trees, or engagement levels by department.

In cases where a business requires detailed personal data of employees, iWE will only do so when there is a proper basis, clear notification has been provided to the user, and/or valid consent has been obtained in accordance with legal regulations.

iWE discourages the use of wellness data or individual behavioral data for disciplinary action, negative evaluation, discrimination, or any inappropriate disadvantage to employees.

9. International Data Transfer

In the course of operation, iWE may use technical infrastructure, cloud storage, software, analytical tools, or service providers with servers or personnel located outside the territory of Vietnam.

When transferring personal data abroad, iWE will take necessary measures in accordance with Vietnamese law, including risk assessment and control, record keeping, data protection agreements with recipients, and fulfilling notification or reporting obligations if required by law.

10. Data Retention Period

iWE stores personal data for the period necessary to fulfill the notified purposes, provide services, maintain accounts, operate campaigns, resolve complaints, protect legitimate rights, or comply with legal obligations.

When data is no longer necessary or a user makes a valid deletion request, iWE will delete, destroy, anonymize, or restrict the processing of data according to appropriate procedures, except where continued storage is required by law or to protect the legitimate rights of iWE, users, or relevant businesses/organizations.

11. Data Security

iWE applies reasonable technical and organizational measures to protect personal data, including:

  • Role-based access control.
  • Encryption or data masking in appropriate cases.
  • Logging system and access activities.
  • Data backup, system monitoring, and security risk control.
  • Training, limiting, and controlling personnel with data access rights.
  • Reviewing and updating security measures as necessary.

While iWE strives to protect data, no system is absolutely secure. Users should actively secure their accounts and not share passwords, OTP codes, or login information with others.

12. User Rights Regarding Personal Data

According to legal regulations, users may have the following rights:

  • The right to be informed about personal data processing activities.
  • The right to give or withdraw consent.
  • The right to access their personal data.
  • The right to correct inaccurate personal data.
  • The right to request data deletion in appropriate cases.
  • The right to restrict or object to data processing.
  • The right to request data provision within the scope permitted by law.
  • The right to complain, denounce, initiate lawsuits, or claim compensation if legitimate rights are violated.

To exercise these rights, users may contact iWE via email. iWE may require identity verification before processing requests to protect data from unauthorized access.

13. Withdrawal of Consent

Users may withdraw their consent for one or more data processing purposes. The withdrawal of consent does not affect the lawfulness of processing activities carried out prior to the withdrawal.

In some cases, withdrawing consent may result in iWE being unable to continue providing part or all of the related features, such as task recording, point calculation, reward redemption, account authentication, or participation reporting.

14. Children’s Data

iWE does not intend to collect children’s data without an appropriate purpose, program, and legal basis.

In cases where services involve children or minors, iWE will implement additional protective measures and require the consent of parents or guardians as prescribed by law.

The iWE website/application may use cookies or similar technologies to maintain login sessions, remember preferences, analyze traffic, improve user experience, and enhance security.

Users can adjust cookie settings in their browser. However, disabling certain necessary cookies may affect the ability to log in or use the services.

16. Data Breach Notification

If a personal data breach occurs that risks affecting the rights and legitimate interests of users, iWE will take necessary measures to prevent, remedy, assess the impact, and notify competent authorities, users, or relevant parties as prescribed by law.

17. Policy Updates

iWE may update this Privacy Policy to reflect changes in services, technology, operating models, or legal regulations. The new version will be published on the website/application with a clear update date.

Users should check the Privacy Policy periodically to understand how their personal data is protected.

18. Contact Information for Personal Data Protection

For any questions, requests to exercise personal data rights, complaints, or feedback regarding the Privacy Policy, please contact:

iWE Solutions Co., Ltd.
Address: 27th Floor, Tower A, Viettel Building, 285 CMT8, Hoa Hung Ward, Ho Chi Minh City
Email: hello@iwe.com.vn
Hotline: 0905073030