Who is responsible and how to contact us
Márió Széles, trading as ChemistryTutor.vn, controls the personal data described in this policy. Privacy questions, incident reports and requests to exercise a data right can be sent to info@chemistrytutor.vn. Business-address, telephone and tax-identification details required for a remote contract are provided in the written offer before payment.
Information collected
- Enquiries: primary-contact name, chosen contact details, requester role, student name, programme, syllabus version, current level, examination year, selected course or cohort, delivery mode, preferred service area, timetable constraints and the message supplied.
- Accounts and learning: profile details, enrolments, attendance, assignments, uploaded work, attempts, tutor feedback, discussion messages and progress records.
- Recordings: lesson audio, video, screen sharing and tutor annotations when a catch-up recording is agreed and the required notice and consent have been provided.
- Operations and security: consent and policy records, request reference, source page, essential device or network security signals, authentication events and administrative audit records.
- Communications and payment administration: messages, confirmed terms, invoices, payment references and records required for accounting, complaints or legal claims. ChemistryTutor.vn does not collect card PINs, passwords or one-time verification codes.
Purposes and limits of processing
Only data reasonably necessary for a stated purpose is collected. Consent is requested where the law requires it and may be refused or withdrawn. Processing without consent occurs only in a case permitted by Vietnamese law. Withdrawal does not invalidate processing already lawfully completed.
- Answer an enquiry, assess suitability, confirm availability and take steps requested before enrolment.
- Deliver lessons, assignments, feedback, progress tracking, account support and appropriate communication with a parent or legal representative.
- Provide restricted catch-up access after an enrolled student reports an absence.
- Secure accounts and student work, prevent abuse, keep necessary teaching and consent records, and meet accounting, safeguarding and legal duties.
- Improve reliability using limited operational analytics. Personal data is not sold and is not used for unrelated advertising. Any optional marketing requires the notice and consent required by law and a way to opt out.
Students who are minors
A parent or legal representative is normally the primary contact and may exercise the student’s data rights. The enquiry form does not require a minor’s personal email, phone number or precise home address. When processing would publish or disclose the private life or personal secrets of a child aged seven or older, consent is obtained from both the child and the legal representative. Data is not used to profile a child for advertising, and processing stops when the law requires it after consent is withdrawn or an authority determines that the child’s rights may be harmed.
Recordings, student work and AI-assisted feedback
A lesson or catch-up recording is made only after participants receive clear information about its purpose, audience and access period and any legally required consent is obtained. It is shared only with the relevant enrolled student or cohort and is not published.
When AI-assisted feedback is enabled, the minimum necessary response, independently authored question context and assessment criteria may be sent securely to OpenAI to prepare a draft. Account contact details are excluded, provider storage is disabled where supported, and a student may request human tutor review. Official IB or Cambridge copyrighted materials are not submitted to a generative-AI service without the rights holder’s permission.
Recipients and service providers
Access is limited to Márió Széles and authorised providers that need the data to deliver the service: Supabase for database, private storage and authentication; Vercel for website hosting and limited operational analytics; OpenAI for the optional draft-feedback workflow; Resend or the configured email provider for service email; and Zalo when a user chooses that channel. An authorised venue contact receives only meeting information necessary for an agreed in-person service.
Data may also be disclosed to professional advisers, insurers, payment or accounting providers, or a competent authority when necessary and lawful. Providers act under applicable confidentiality, security and data-processing obligations. ChemistryTutor.vn does not rent or sell personal data.
Cross-border processing
Some providers may process data outside Vietnam. Before and while such processing is used, ChemistryTutor.vn maintains the contracts, processing-impact records, cross-border transfer assessment and updates required by the Law on Personal Data Protection and Decree 356/2025/NĐ-CP. A transfer is limited to the stated purpose and must stop if it cannot meet applicable safeguards or a competent authority requires suspension.
Retention
- Enquiries that do not become a service are reviewed for deletion within 12 months after the last contact.
- Learning and progress records are kept while the account is active, then normally deleted or de-identified within 24 months after tuition ends.
- Catch-up recordings are retained only for the access period communicated to the relevant student or cohort, then deleted unless a longer period is specifically agreed and lawful.
- Security and audit records are normally kept for up to 12 months unless an incident requires a longer investigation.
- Payment, tax and accounting records are kept for the legally required period. A legal hold, complaint or active dispute may extend an otherwise applicable period.
Your rights and how to make a request
Subject to Vietnamese law, a data subject may be informed about processing; consent or refuse and withdraw consent; view, obtain or correct data; request deletion or restriction; object to processing; and complain, report a violation, bring a claim or seek compensation. Email info@chemistrytutor.vn and describe the request. ChemistryTutor.vn may verify identity and, for a minor, the representative’s authority, then responds within the periods required by law. If a request is refused or limited because another legal duty or another person’s rights apply, the response will explain the reason where permitted.
Security and incidents
Controls include role-based access, protected private storage, encryption in transit, abuse limits on public forms and authentication, audit trails, backups and provider access controls. No online service can promise absolute security. Where a personal-data violation reaches the statutory threshold, ChemistryTutor.vn records and contains it, notifies the specialist personal-data protection authority within 72 hours of discovery, and informs affected people when required by law. Suspected incidents should be reported promptly to info@chemistrytutor.vn.
Official Vietnamese references
The principal current instruments are the Law on Personal Data Protection No. 91/2025/QH15 and its implementing Decree 356/2025/NĐ-CP, both effective from 1 January 2026. Decree 356 replaced Decree 13/2023/NĐ-CP.