1. Who we are and how to contact us
2. What this Notice covers
This Notice explains how we collect, use, store, disclose and otherwise process personal information when you:
Visit our website or submit an enquiry.
Request information about a programme or communicate with us.
Subscribe to programme updates.
Provide information through a programme application or related activity covered by this Notice.
Contact us as a parent or legal representative of a student.
Additional information may be provided at the point of collection where a particular programme involves different data, recipients or purposes.
Our student-facing website services are intended for people aged 13 and above. This Notice gives particular attention to students aged 13–18. People who have reached their eighteenth birthday are adults for the age-specific provisions described here.
This is a Privacy Notice. Our separate Child Safeguarding Policy addresses the prevention of abuse and other harm, standards of conduct, reporting channels, and responses to safeguarding concerns. This Notice explains how personal information associated with such concerns is handled.
3. The legal framework and its application
3.1 Vietnamese law
Our processing in Vietnam is governed by the Law on Personal Data Protection No. 91/2025/QH15, effective from 1 January 2026, and Decree No. 356/2025/NĐ-CP, which implements that Law.
In particular:
Article 5 requires processing consistent with specified purposes, an appropriate scope, data accuracy, security and appropriate retention.
Articles 9 and 11 govern consent and collection, including the requirement to obtain consent before collection unless the law provides otherwise.
Article 19 provides limited circumstances in which processing without consent is permitted.
Article 20 governs cross-border transfers.
Article 24 provides additional rules concerning children’s personal information.
Article 4 establishes the rights and obligations of personal data subjects.
For children under 16, the Law on Children No. 102/2016/QH13, as amended, also applies. Its Articles 1, 21 and 54 establish the relevant age definition, protect children’s privacy and address protection in the online environment. Article 33 of Decree No. 56/2017/NĐ-CP identifies protected private information, including children’s names, images, contact details, school information and learning results.
For young people aged 16 to under 18, Article 11 of the Youth Law No. 57/2020/QH14 provides for the State’s application of children’s-rights treaties to this age group in accordance with Vietnam’s conditions. The general personal-data protections continue to apply.
3.2 International children’s-rights principles
The United Nations Convention on the Rights of the Child (1989) informs our approach to people under 18, particularly:
Article 3: their best interests.
Article 12: consideration of their views.
Article 16: protection of their privacy.
Article 19: protection from violence, abuse and neglect.
The UN Committee on the Rights of the Child’s General Comment No. 25 (2021) on children’s rights in relation to the digital environment explains how the Convention should be implemented in digital contexts.
These instruments inform how we explain choices and assess effects on students. They do not, by themselves, authorise us to collect or use personal information.
3.3 EU and UK data-protection law
The EU General Data Protection Regulation - Regulation (EU) 2016/679 applies where its territorial conditions under Article 3 are met, including relevant processing connected with an EU establishment or offering goods or services to, or monitoring the behaviour of, people in the EU.
The UK General Data Protection Regulation, together with the Data Protection Act 2018, as amended including by the Data (Use and Access) Act 2025, applies where the corresponding UK territorial conditions are met.
A person’s nationality, or the fact that our website can be accessed from another country, does not alone determine whether these laws apply.
Where a GDPR regime applies, we must identify a lawful basis under Article 6 and provide the information required by Articles 12–14. Additional conditions apply to special-category information under Article 9.
The U.S. COPPA and FERPA rules have separate, limited scopes, explained in Sections 13 and 14 below.
4. What information we collect and where it comes from
Information you provide directly
Our student enquiry form requests:
First and last name.
Email address and telephone number.
Preferred contact method.
High school or university and year level.
Major, where supplied.
Internship field of interest.
Address information.
Additional questions or messages.
We use the contact method you select to respond. If you choose a third-party messaging service, such as WhatsApp or Zalo, that service also handles information under its own terms and privacy notice.
When you subscribe to programme updates, we collect your email address.
Please avoid including identity documents, medical information or other sensitive details in an ordinary enquiry unless we have explained why they are needed and provided an appropriate way to submit them.
Information associated with applications or programmes
When you apply for or participate in a Potenso programme, we may collect application documents, parent or legal-representative contact details, payment records, participation records and project submissions, as relevant to the programme. We use this information to assess applications, organise and administer participation, process payments and document programme outcomes.
Information from other sources
We may receive information from your parent or legal representative, school or programme partners in connection with your application or participation. This may include contact details, relevant educational information, consent documentation and participation updates. We use it only for the purposes explained to you.
Where applicable, we inform you of the source, categories and intended use of this information in accordance with GDPR Article 14, within the applicable timeframe and subject to any lawful exception.
Website and technical information
Depending on the website features used, technical information may include your IP address, browser and device information, pages visited and access times. Such information is used to operate the website, maintain security and resolve technical issues. Where cookies, analytics or embedded services are used, we explain their purposes and the choices available to you and obtain consent where required.
We identify required and optional information at the point of collection. Where information is necessary to respond to your request or deliver a service, we explain the consequences of not providing it.
Legal foundation: Vietnam’s Law on Personal Data Protection No. 91/2025/QH15, Articles 5, 9 and 11; where applicable, GDPR Articles 13(2)(e), 14(1)(d) and 14(2)(f).
5. Why we use information and the grounds for doing so
We use personal information for specified purposes and identify the applicable legal ground for each activity. Information collected for one purpose is not automatically available for unrelated uses.
Responding to enquiries. We use your contact details, study information, interests and messages to answer your questions and provide the programme information you request. Under Articles 9 and 11 of Vietnam’s Law on Personal Data Protection No. 91/2025/QH15, we obtain consent before collection unless a statutory exception applies, and apply Article 24 where the information concerns a child. Where the EU GDPR or UK GDPR applies, we may rely on consent under Article 6(1)(a). If your request concerns objectively necessary steps before entering into a contract with you, Article 6(1)(b) may instead apply where its conditions are satisfied. The information provided at collection will identify the basis actually used.
Assessing applications and administering programmes. We use the application and participation information identified at collection to assess applications and organise the relevant programme. Under Vietnamese law, this requires consent or a specifically applicable exception under Article 19(1). Where the EU GDPR or UK GDPR applies, Article 6(1)(b) is available only where the processing is necessary for a contract with the individual or steps requested before entering into that contract. A contract with a parent does not automatically establish this basis for all processing of the child’s information.
Sending optional updates. We use your email address and subscription preferences to send newsletters and promotional updates when you separately agree to receive them. The Vietnamese consent requirements in Articles 9 and 11 apply. Where the EU GDPR or UK GDPR applies, the relevant basis is consent under Article 6(1)(a), together with applicable electronic-marketing rules. Submitting an enquiry does not automatically subscribe you to marketing.
Publishing photographs, testimonials and student stories. Before using identifiable student material for publicity, we explain the intended content, purpose and publication channels and obtain specific consent. For the publication or disclosure of a child’s private information, we also apply Article 24 of Vietnam’s Law on Personal Data Protection and Article 6(11) of the Law on Children. Where the EU GDPR or UK GDPR applies, we rely on consent under Article 6(1)(a) for this optional use.
Meeting legal obligations. We may process information to meet a specific statutory obligation or respond to a legally binding request. In each case, we identify the relevant legal requirement and any applicable exception under Article 19 of Vietnam’s Law on Personal Data Protection. Where the EU GDPR or UK GDPR applies, Article 6(1)(c) is used only where the obligation qualifies under that regime. A general reference to “legal compliance” does not itself authorise processing.
Handling safeguarding concerns. We may need to process information to assess and respond to a concern about a student’s safety. The applicable ground depends on the circumstances and may involve consent, a specific statutory duty or an exception under Article 19(1) of Vietnam’s Law on Personal Data Protection. Where the EU GDPR or UK GDPR applies, we identify an appropriate Article 6 basis and, if special-category information is involved, an additional condition under Article 9. A safeguarding purpose does not automatically permit unrestricted collection or disclosure.
An EU or UK “legitimate interests” basis does not automatically create a corresponding exception to Vietnamese consent requirements. If we propose to use information for a different purpose, we provide the required information and obtain further consent where necessary before beginning that use.
6. How long we keep information and how we protect it
6.1 How long we keep your information
We retain identifiable personal information for the period necessary to fulfil the purpose for which it was collected, taking account of applicable legal obligations, unresolved requests and justified preservation needs. Potenso maintains a permanent academic register for the ongoing verification of programme participation, completion and certificates issued. This register is limited to essential identification details, programme information, participation or completion status, and certification details, subject to applicable data-protection requirements and periodic review of continued necessity.
For individuals who enquire about a programme but do not enrol, we retain enquiry information and associated contact details for a maximum of two years from their most recent enquiry submission, unless earlier deletion is required. After this period, the information is deleted or anonymised. Marketing use requires appropriate consent and stops earlier if that consent is withdrawn.
We retain enquiry, application and programme records for as long as necessary to respond to requests, administer participation, provide participation records and meet applicable legal obligations.
With appropriate consent, we retain names, email addresses and telephone numbers for newsletters and marketing until consent is withdrawn or the information is no longer needed, whichever occurs first. After an unsubscribe request, we stop the relevant marketing and may retain a limited record to respect that preference.
Student Audio-Visual Likeness
We retain and process video recordings containing students’ images, voices and visual appearances captured in presentation clips exclusively for internal educational instruction, educator training and academic research. Access is restricted to authorised persons for these purposes. These recordings are not published or used for marketing without separate, appropriate consent.
Academic Presentation Deliverables & Results
Final presentation videos, project deliverables and associated performance evaluations are stored as official educational artifacts to support curriculum development, academic benchmarking and institutional research. Students’ identifiable academic information is treated as strictly confidential and accessible only to authorised persons who need it for the stated purposes.
Sharing with Training Partners
Potenso shares only the personal information necessary to organise, deliver and assess its training programmes with partner institutes, laboratories and lecturers. Sharing is subject to applicable consent requirements and confidentiality obligations. Partners may use the information only for the agreed programme purposes and must not disclose it or use it for unrelated purposes without appropriate authorisation.
Verification of Academic Results
Outside authorised programme delivery and internal educational use, Potenso discloses students’ academic results, evaluations or project deliverables to third parties only upon a documented request or authorisation from the student or a parent or legal representative legally authorised to act on the student’s behalf, unless disclosure is required by law. Such verification may support scholarship, university admission or employment applications. Disclosure is limited to the information necessary for the specified verification and provided only to the designated recipient.
We retain and use identifiable photographs, videos, testimonials and other student materials for internal training, curriculum development, educational research and marketing, only to the extent that each purpose has been explained to and agreed to by the student and, for students under 18, their parent or legal representative. Consent for marketing is obtained separately from consent for educational purposes. We maintain documented evidence of consent, including when and how it was obtained, the purposes agreed to, and any subsequent changes or withdrawals. These records are retained throughout the relevant processing activities and for any additional period required to meet applicable legal obligations or substantiate compliance.
We periodically review retained information and delete or anonymise it when it is no longer needed and no lawful retention requirement remains.
6.2 How we protect your information
We apply organisational and technical safeguards appropriate to the nature of the information and the risks associated with its processing. Access is limited according to the responsibilities of the people who need the information for an authorised purpose.
Access to personal information is restricted to authorised personnel who need it to perform their duties. We use password-protected accounts and access controls to limit unauthorized access. Personnel handling personal information are required to maintain confidentiality and use it only for authorised purposes.
Potenso shares the information necessary to organise, deliver and assess its training programmes with partner institutes, laboratories and lecturers, subject to applicable consent requirements. These partners must maintain confidentiality and use the information solely for the agreed programme purposes.
Students’ academic results and performance evaluations are treated as strictly confidential. Beyond authorised access necessary for programme delivery and assessment, these records are disclosed to third parties only upon a documented request or authorisation from the student or a parent or legal representative legally authorised to act on their behalf, unless disclosure is required by law. Such disclosure may support verification for scholarship, university admission or employment applications and is limited to the information necessary for the specified purpose and the designated recipient.
Information requiring additional protection, including sensitive information and safeguarding records, is subject to safeguards appropriate to its sensitivity. Where service providers handle information on our behalf, the relevant arrangements must address confidentiality, permitted uses and security responsibilities.
If a personal-data breach occurs, we assess the incident, take appropriate containment and remedial action, and make the notifications required by applicable law.
Legal foundation: Articles 5, 23 and 37 of Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 address relevant protection principles, breach notification and responsibilities. Where applicable, EU GDPR and UK GDPR Articles 5(1)(e)–(f) and 32–34 address storage limitation, security and breach notification.