Privacy Policy
Last updated: September 9, 2026
1. Introduction
Hufr ("we", "us", "our") is a recruitment company registered in Vietnam at Số 4 Nguyễn Đình Chiểu, Ho Chi Minh City. We are committed to protecting your personal data in accordance with Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and its implementing regulations.
This Privacy Policy explains how we collect, use, store, share and protect the personal data of job applicants, employers, website visitors and other users of our services.
2. Data Controller & Data Protection Officer
Hufr is the data controller for the personal data described in this policy. If you have questions about how your data is processed or wish to exercise your rights, please contact our Data Protection Officer:
- Email: dpo@hufr.io
- Address: Số 4 Nguyễn Đình Chiểu, Ho Chi Minh City, Vietnam
3. Personal Data We Collect
3.1 Data you provide directly
- Account information: name, email address, phone number, password
- Employer information: company name, company logo, website, business address
- Job applicant information: CV/resume, work experience, education, skills, city, address, salary expectations
- Job posting information: job title, description, requirements, benefits, salary range, location
- Contact form submissions: name, email, phone, message content
3.2 Data collected automatically
- Device and browser data: IP address, browser type, operating system, device identifiers
- Usage data: pages visited, time spent, clicks, referring URLs
- Cookies: essential, analytics and marketing cookies (see Section 8)
3.3 Sensitive personal data
Under Vietnam's PDPL, the following data we process is classified as sensitive and is subject to additional protections:
- Location data (city, address)
- Online credentials (account passwords, stored in encrypted form)
- Financial data (salary expectations and ranges)
- Behavioral and usage data from our digital platform
We obtain explicit consent before processing sensitive data and apply additional security safeguards.
4. Legal Basis and Purposes of Processing
| Purpose |
Legal basis |
| Creating and managing your account | Consent, contractual necessity |
| Matching candidates with job openings | Consent, contractual necessity |
| Publishing job postings | Consent, contractual necessity |
| Sending transactional emails (account creation, password reset) | Contractual necessity |
| Responding to inquiries via contact form | Consent |
| Website analytics and improvement | Consent (via cookie banner) |
| Advertising and remarketing | Consent (via cookie banner) |
| Legal compliance and fraud prevention | Legal obligation |
5. Data Sharing and Third Parties
We do not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary for the stated purposes:
- Employers: when you apply for a job, your application data is shared with the hiring company
- Service providers: hosting, email delivery, cloud storage, customer relationship management (CRM) systems
- Analytics providers: Google Analytics, Google Tag Manager (subject to your cookie consent)
- Advertising partners: Meta/Facebook (subject to your cookie consent)
- Legal authorities: when required by Vietnamese law or court order
6. Cross-Border Data Transfers
Some of our service providers operate outside Vietnam. When your data is transferred internationally, we ensure appropriate safeguards are in place through contractual clauses and Transfer Impact Assessments as required by the PDPL. Data may be transferred to servers in:
- United States (Google, Meta)
- European Union (hosting providers)
Transfer Impact Assessments are filed with the Department of Cybersecurity and Hi-tech Crime Prevention (A05) of the Ministry of Public Security as required.
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:
- Active accounts: data is retained for the duration of your account
- Inactive accounts: deleted after 24 months of inactivity, following prior notification
- Job applications: retained for 12 months after the position is filled, then anonymized or deleted
- Contact form inquiries: retained for 12 months
- Analytics data: retained according to the analytics provider's policies (typically 14–26 months)
- Legal obligations: data required by law may be retained for the legally mandated period
When data is no longer needed, it is securely deleted or anonymized.
8. Cookies
Our website uses cookies. When you first visit, a consent banner allows you to accept or reject non-essential cookies. You can change your preferences at any time by clicking the cookie icon in the bottom-left corner of any page.
- Essential cookies: required for the website to function (session, CSRF protection, locale). Cannot be disabled.
- Analytics cookies: Google Analytics — help us understand how visitors use the site. Disabled by default.
- Marketing cookies: Meta/Facebook Pixel — used for advertising measurement. Disabled by default.
9. Your Rights
Under Vietnam's PDPL, you have the following rights regarding your personal data:
- Right to know which organizations hold your data and the legal basis for processing
- Right to give or withdraw consent at any time
- Right to access a copy of your personal data
- Right to request correction of inaccurate data
- Right to request deletion of your personal data
- Right to restrict processing of your data
- Right to data portability (receive your data in a structured, commonly used format)
- Right to object to processing of your data
- Right to file a complaint with the competent authority
- Right to claim damages for unlawful processing
- Right to self-defense against unlawful data processing
To exercise any of these rights, please use our Data Rights request form or contact our Data Protection Officer at dpo@hufr.io. We will acknowledge your request within two (2) working days and provide a substantive response within seven (7) to ten (10) working days.
10. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption of data in transit (HTTPS/TLS)
- Passwords stored using one-way cryptographic hashing
- Access controls limiting data access to authorized personnel
- Regular security reviews and updates
11. Data Breach Notification
In the event of a personal data breach, we will:
- Notify the Department of Cybersecurity and Hi-tech Crime Prevention (A05) within 72 hours of discovery
- Notify affected individuals within 72 hours if sensitive personal data is involved
- Document the breach, its effects and the remedial actions taken
12. Children
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately so we can delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when the latest revision was made. Material changes will be communicated via email or a prominent notice on our website. We encourage you to review this page periodically.
14. Contact & Complaints
If you have questions, concerns, or complaints about this policy or our data practices:
- Data Protection Officer: dpo@hufr.io
- General inquiries: info@hufr.io
- Office: Số 4 Nguyễn Đình Chiểu, Ho Chi Minh City, Vietnam
You also have the right to file a complaint with the Department of Cybersecurity and Hi-tech Crime Prevention (A05) of Vietnam's Ministry of Public Security.
