Chính sách bảo mật – Viện Công Nghệ FIRST

Viện Công Nghệ FIRST (“FIRST”, “we”, “us”) respects your privacy. This Privacy Policy explains what personal data we collect when you use the FIRST website, member accounts and services, how we use it, who we share it with, how long we keep it and what rights you have. It is prepared in line with Vietnamese personal data protection law and applies together with our Terms of Service.

1. Data we collect

Data you provide:

Account and profile: name, email, phone number, password (stored as a one-way hash that we cannot read), organisation, job title, areas of interest, profile picture.
Course, event and programme registrations: what you registered for, contact details entered in registration forms (including when you have no account), and any notes you add.
Learning and certificates: attendance, attendance rate, assessment results and certificates issued.
Content you submit: research papers, PDF files, cover images, co-author details, Sandbox proposals, comments.
Newsletter and communications: the email you subscribe with and what you exchange with us by email, phone or contact forms.
Questions to FIRST AI: the text you type into the assistant.

Data collected automatically:

Technical data: IP address, browser type, device, access time and system logs. For registration forms, the newsletter and the AI assistant, IP addresses are stored only as a one-way hash for spam prevention and rate limiting.
Email engagement: newsletters and learner-care emails may contain a tiny image and tracked links that tell us whether an email was opened or a link clicked, so we can measure effectiveness and avoid sending irrelevant content.
Cookies and browser storage: see section 8.

FIRST does not collect sensitive personal data such as national ID numbers, health or biometric data through the website. Please do not include such information in submissions, forms or FIRST AI conversations.

FIRST AI chat history and memory

When you are signed in, your questions and FIRST AI’s answers are saved to your account so you can review them and continue on another device. This history is deleted automatically after 180 days.

If you keep memory switched on, each night the system uses an AI model to extract up to 12 short points from your new conversations (for example your job, learning goals, topics of interest and preferred answer style) so FIRST AI can make more relevant suggestions. Memory never contains passwords, account numbers, identity documents, phone numbers, emails or sensitive data; the system filters these out automatically.

You can view or delete individual points, clear all memory, switch memory off or delete your chat history at any time in My account → FIRST AI. For guests who are not signed in, FIRST does not keep chat history; answers to common questions may be cached for up to 12 hours without being linked to the person who asked.

2. How we use your data

To create and manage your account, authenticate you and provide the member area;
To process registrations and send confirmations, reminders, materials and change notices for courses and events;
To track learning results and to issue and verify certificates;
To review, edit and publish research and proposals you submit;
To send newsletters and information about courses and events relevant to your interests (with your consent; you can unsubscribe at any time);
To answer questions and provide learner support;
To keep the system secure and prevent fraud, spam and unauthorised access;
To produce statistics and improve our programmes and platform;
To meet legal obligations (for example accounting, invoicing and requests from competent authorities).

3. Legal basis

We process your personal data based on: (a) your consent, for example when you create an account, subscribe to the newsletter or submit a form; (b) performance of a service or agreement you signed up for, such as a course; (c) FIRST’s legal obligations; and (d) other cases permitted by law. You may withdraw consent at any time; this does not affect processing lawfully carried out before withdrawal.

FIRST does not sell or rent your personal data. We share data only as far as necessary with:

Technical service providers processing data on FIRST’s behalf: hosting, email delivery, backups. They may use the data only to provide their services to FIRST and must keep it confidential.
AI model provider (currently Anthropic – Claude) to process questions you send to FIRST AI and automated summarising and drafting features. When you are signed in, FIRST AI may include your areas of interest and current courses to give more relevant suggestions; FIRST does not send your password or contact details to the AI provider.
Co-organising partners of a specific course or event, only for registrants of that programme and when stated on the programme page.
Certificate verifiers: anyone with a certificate’s code or verification link can see the holder’s name, programme, issue date and status.
Competent authorities when required by law, or when necessary to protect the rights, property or safety of FIRST, our users or the public.

5. Information shown publicly

When your research is published: your name, profile picture, job title, organisation and co-author names appear with it.
Your public profile and certificate list are shown only if you switch them on in the Certificates section of My account; you can switch them off at any time.
Comments you post appear with the name you entered.

FIRST’s official channels: FIRST connects the platform to the Institute’s official Facebook Page, Zalo Official Account and TikTok account through APIs provided by Meta, Zalo and TikTok, in order to publish posts and images about FIRST research, courses and events to those channels. Through these connections FIRST accesses only data of FIRST’s own accounts (for example page name, page ID, and basic info of the FIRST TikTok account such as open_id, display name and avatar) and the permission to publish content. FIRST does not collect social-media account data of visitors or followers through these APIs.
Access tokens for these connections are stored in the admin system, accessible to administrators only, and can be revoked at any time by FIRST or in the Meta, Zalo or TikTok settings.
Embedded content: YouTube, Facebook and TikTok videos embedded on the website are served by those platforms, which may set cookies and collect data under their own policies when you watch them.
Sharing: when you share a certificate to LinkedIn or content to social media, you are taken to that platform and the post is made by you on your own account.

7. International transfers

Some of FIRST’s service providers (for example servers, email services and the AI model provider) may host data outside Vietnam. In that case we transfer only the data that is necessary, choose providers with appropriate security commitments, and complete the procedures required by Vietnamese law for cross-border transfer of personal data.

8. Cookies and browser storage

Essential cookies: keep you signed in and protect forms against forgery. Without them you cannot sign in.
Display preferences: your light/dark theme choice and dismissed notice bars are kept in your browser’s local storage on your device and are not sent to our servers.
FIRST does not use advertising cookies. Embedded third-party content may set its own cookies (see section 6).

You can delete or block cookies in your browser settings; some features such as signing in may then stop working.

9. How long we keep data

Account and profile: while your account is active and up to 12 months after your last activity unless you ask for earlier deletion, except data kept under the points below.
Registrations and learning results: for as long as needed to run the programme and handle complaints, and for the retention period the law requires for records of fees paid.
Certificates: kept long-term so that holders and third parties can verify them, unless you ask us to cancel the certificate or it is revoked.
Newsletter: until you unsubscribe.
Technical logs: for the short period needed for security purposes.

When the period ends, the data is deleted or anonymised.

10. Security

FIRST applies appropriate technical and organisational measures: HTTPS encryption, one-way hashed passwords, role-based access (members cannot access the admin area), rate limiting, regular backups, and access limited to staff who need it. No system is completely secure; if an incident affects your data, we will notify you and the competent authorities as required by law.

11. Your rights

Under Vietnamese law you have the right to:

Be informed about the processing of your data;
Give or refuse consent, and withdraw it;
Access, view and obtain a copy of your data;
Correct inaccurate data — most of it you can edit yourself in My account;
Request deletion, restriction of processing, or object to processing;
Unsubscribe from the newsletter using the link at the bottom of every email or in the Profile section of your account;
Complain, report or take legal action as provided by law.

To exercise these rights, contact us as described in section 14. We may ask you to verify your identity before acting on a request and will respond within the time limits set by law.

12. Data deletion requests

You can ask us to delete your account and personal data at any time:

Email daotao@first.edu.vn from your registered email address with the subject “Data deletion request”, stating your name and the account to delete.
We will acknowledge your request within 3 working days, complete the deletion within the time limits set by law and email you the result.
Data the law requires us to keep (for example accounting records of fees paid) is kept until the mandatory period ends and then deleted. For certificates already issued, you can choose to cancel them or keep a minimal record so they remain verifiable.
Published research will be removed or anonymised according to your choice and that of your co-authors.

FIRST does not store visitors’ Facebook, Zalo or TikTok account data. If you believe we hold any of your data originating from these platforms, send a request as above and we will delete it.

13. Children

FIRST services are intended for people aged 16 and over. People under 16 may register only with the consent of a parent or guardian. If we learn that we have collected a child’s data without valid consent, we will delete it.

14. Contact for personal data matters

Organisation: Viện Công Nghệ FIRST
Address: Tầng 12, 48 Lê Văn Lương, Yên Hoà, Hà Nội
Email: daotao@first.edu.vn
Phone: 0969555188 - 0968933279

15. Changes to this policy

We may update this Policy when our services or the law change. The date of the latest update is shown at the top of this page; for material changes we will notify you by email or on the website before they take effect. The Vietnamese version prevails if there is any inconsistency with this English version.

Privacy Policy