Privacy Policy

Last updated: September 9, 2026

1. Introduction

Hufr ("we", "us", "our") is a recruitment company registered in Vietnam at Số 4 Nguyễn Đình Chiểu, Ho Chi Minh City. We are committed to protecting your personal data in accordance with Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and its implementing regulations.

This Privacy Policy explains how we collect, use, store, share and protect the personal data of job applicants, employers, website visitors and other users of our services.

2. Data Controller & Data Protection Officer

Hufr is the data controller for the personal data described in this policy. If you have questions about how your data is processed or wish to exercise your rights, please contact our Data Protection Officer:

Email: dpo@hufr.io
Address: Số 4 Nguyễn Đình Chiểu, Ho Chi Minh City, Vietnam

3. Personal Data We Collect

3.1 Data you provide directly

Account information: name, email address, phone number, password
Employer information: company name, company logo, website, business address
Job applicant information: CV/resume, work experience, education, skills, city, address, salary expectations
Job posting information: job title, description, requirements, benefits, salary range, location
Contact form submissions: name, email, phone, message content

3.2 Data collected automatically

Device and browser data: IP address, browser type, operating system, device identifiers
Usage data: pages visited, time spent, clicks, referring URLs
Cookies: essential, analytics and marketing cookies (see Section 8)

3.3 Sensitive personal data

Under Vietnam's PDPL, the following data we process is classified as sensitive and is subject to additional protections:

Location data (city, address)
Online credentials (account passwords, stored in encrypted form)
Financial data (salary expectations and ranges)
Behavioral and usage data from our digital platform

We obtain explicit consent before processing sensitive data and apply additional security safeguards.

4. Legal Basis and Purposes of Processing

Purpose	Legal basis
Creating and managing your account	Consent, contractual necessity
Matching candidates with job openings	Consent, contractual necessity
Publishing job postings	Consent, contractual necessity
Sending transactional emails (account creation, password reset)	Contractual necessity
Responding to inquiries via contact form	Consent
Advertising and remarketing	Consent (via cookie banner)
Legal compliance and fraud prevention	Legal obligation

5. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary for the stated purposes:

Employers: when you apply for a job, your application data is shared with the hiring company
Service providers: hosting, email delivery, cloud storage, customer relationship management (CRM) systems
Advertising partners: Meta/Facebook (subject to your cookie consent)
Legal authorities: when required by Vietnamese law or court order

6. Cross-Border Data Transfers

Some of our service providers operate outside Vietnam. When your data is transferred internationally, we ensure appropriate safeguards are in place through contractual clauses and Transfer Impact Assessments as required by the PDPL. Data may be transferred to servers in:

United States (Google, Meta)
European Union (hosting providers)

Transfer Impact Assessments are filed with the Department of Cybersecurity and Hi-tech Crime Prevention (A05) of the Ministry of Public Security as required.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

Active accounts: data is retained for the duration of your account
Inactive accounts: deleted after 24 months of inactivity, following prior notification
Job applications: retained for 12 months after the position is filled, then anonymized or deleted
Contact form inquiries: retained for 12 months
Legal obligations: data required by law may be retained for the legally mandated period

When data is no longer needed, it is securely deleted or anonymized.

8. Cookies

Our website uses cookies. When you first visit, a consent banner allows you to accept or reject non-essential cookies. You can change your preferences at any time by clicking the cookie icon in the bottom-left corner of any page.

Essential cookies: required for the website to function (session, CSRF protection, locale). Cannot be disabled.
Marketing cookies: Meta/Facebook Pixel — used for advertising measurement. Disabled by default.

9. Your Rights

Under Vietnam's PDPL, you have the following rights regarding your personal data:

Right to know which organizations hold your data and the legal basis for processing
Right to give or withdraw consent at any time
Right to access a copy of your personal data
Right to request correction of inaccurate data
Right to request deletion of your personal data
Right to restrict processing of your data
Right to data portability (receive your data in a structured, commonly used format)
Right to object to processing of your data
Right to file a complaint with the competent authority
Right to claim damages for unlawful processing
Right to self-defense against unlawful data processing

To exercise any of these rights, please use our Data Rights request form or contact our Data Protection Officer at dpo@hufr.io. We will acknowledge your request within two (2) working days and provide a substantive response within seven (7) to ten (10) working days.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption of data in transit (HTTPS/TLS)
Passwords stored using one-way cryptographic hashing
Access controls limiting data access to authorized personnel
Regular security reviews and updates

11. Data Breach Notification

In the event of a personal data breach, we will:

Notify the Department of Cybersecurity and Hi-tech Crime Prevention (A05) within 72 hours of discovery
Notify affected individuals within 72 hours if sensitive personal data is involved
Document the breach, its effects and the remedial actions taken

12. Children

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately so we can delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when the latest revision was made. Material changes will be communicated via email or a prominent notice on our website. We encourage you to review this page periodically.

14. Contact & Complaints

If you have questions, concerns, or complaints about this policy or our data practices:

Data Protection Officer: dpo@hufr.io
General inquiries: info@hufr.io
Office: Số 4 Nguyễn Đình Chiểu, Ho Chi Minh City, Vietnam

You also have the right to file a complaint with the Department of Cybersecurity and Hi-tech Crime Prevention (A05) of Vietnam's Ministry of Public Security.