Scope and Controller
This Policy applies to website visitors and representatives of prospective clients, clients and business partners who contact Workless Studio through the website, email, Zalo, WhatsApp or another business channel.
For inquiry, relationship-management and our own website data, the controller is WORKLESS STUDIO COMPANY LIMITED, enterprise and tax number 0312080038, registered at 73/1B Street 21, Quarter 5, Hiep Binh Ward, Ho Chi Minh City, Vietnam.
Where Workless Studio processes personal data inside a client website or system only on the client's instructions, the client will generally be the controller and Workless Studio the processor. That activity is governed by the service agreement and, where required, a Data Processing Agreement, not solely by this public Policy.
Personal Data We Collect
2.1. Data you provide
Our project-inquiry form may collect company name and contact information; business sector; intended audience and domestic or international target market; website objectives and desired visitor action; online-selling, payment and multilingual requirements; required pages; brand-identity status; preferred visual style; desired timeline; and information entered in the free-text field.
If discussions continue or you become a client, we may also collect your name, role, company details, project records, communications, supplied materials, contract details, invoices and payment records. Do not submit sensitive data, passwords, API secrets or unnecessary third-party personal data through the public form.
2.2. Technical and usage data
When you use the website, our server or infrastructure provider may receive your IP address, device and browser type, operating system, language, pages viewed, visit time, referring source, error information and performance events necessary to deliver and protect the service.
2.3. Data from other sources
We may receive data from referrals, partner platforms, public business profiles and fraud-prevention or security providers where permitted by applicable law.
How We Use Personal Data
We process personal data as reasonably necessary to:
- Receive, assess and respond to project inquiries.
- Understand requirements and prepare a demo, proposal, quotation, SOW or contract.
- Provide, manage, support and hand over services and send administrative project, payment, warranty or operations messages.
- Secure the website, prevent spam or fraud, troubleshoot and improve performance.
- Manage client relationships, accounting, tax, claims and disputes.
- Send marketing where you have consented or applicable law otherwise permits, with an opt-out.
- Comply with legal duties and valid requests from competent authorities.
- We do not sell personal data or use inquiry data for solely automated decisions that produce legal or similarly significant effects.
Legal Bases
Depending on the relationship and applicable law, we rely on consent; performance of a contract or requested pre-contract steps; compliance with legal obligations; our or a third party's recognised legitimate interests; or another lawful basis available in the circumstances.
You may decline to provide data, but we may then be unable to respond, quote or provide certain services. Withdrawing consent does not affect processing already carried out lawfully before withdrawal.
How We Share Personal Data
We share personal data only when reasonably necessary and with appropriate safeguards, including with:
- Server infrastructure, CDN, security, backup, form, email and work or client-management providers.
- Personnel, freelancers and subcontractors who need access to support a project and are subject to confidentiality obligations.
- Accountants, auditors, banks, payment providers, insurers and professional advisers.
- Public authorities, courts or arbitral tribunals where required by law or valid process.
- A recipient in a restructuring, merger or business-transfer transaction, subject to suitable confidentiality measures.
Cookies, Analytics and Third-Party Links
As of this version's effective date, the website does not set advertising or remarketing cookies and does not load a browser-side analytics tool. The website and its infrastructure may still process essential technical request logs to load pages, maintain security, prevent abuse and diagnose errors.
If we introduce analytics or non-essential cookies, we will update this Policy and provide notice or consent controls where required.
Links to Zalo, WhatsApp or other websites take you to third-party services. Those third parties are responsible for their own privacy practices.
International Transfers
Workless Studio is based in Vietnam and may use providers with servers or personnel in other countries. Personal data may therefore be accessed or processed outside your country of residence.
We apply applicable Vietnamese cross-border data rules and reasonable safeguards. Where the GDPR applies to a transfer from the EU or EEA, we use a valid transfer mechanism, which may include an adequacy decision, the European Commission's Standard Contractual Clauses and supplementary measures where needed.
Retention
We retain personal data only for as long as reasonably necessary for the stated purposes, a legal obligation, or the establishment, exercise or defence of legal claims.
- Inquiries that do not become engagements: 24 months after the last meaningful interaction.
- Client and project records: for the engagement and 5 years after it ends, unless longer retention is necessary.
- Invoices and tax or accounting records: for the period required by applicable law.
- Security and technical logs: up to 13 months or a shorter provider-configured period.
- Consent, marketing opt-out and privacy-request records: as long as reasonably needed to demonstrate compliance.
- After the relevant period, data is deleted, anonymised or isolated where legal retention applies. Backup copies may remain for a limited backup cycle and will not be restored for ordinary business use.
Security
We apply technical and organisational measures appropriate to the nature and risk of the data. These may include access controls, authentication, least-privilege permissions, suitable encryption, backups, logging, security updates, confidentiality commitments and incident-response procedures.
No transmission or storage method is completely secure. If a personal-data incident occurs, we will assess and contain it and notify affected individuals or competent authorities where applicable law requires.
Your Rights
Depending on applicable law and the circumstances, you may have rights to information; consent or withdrawal of consent; access; correction; deletion; restriction; objection; data portability; complaint; compensation; or other lawful protection. Individuals in the EU or EEA may object to direct marketing at any time and may complain to their local data-protection authority.
Send a request to [email protected]. We may need to verify your identity and authority. Rights may be limited by legal retention duties, the rights of others, trade secrets or another lawful exception.
Children
Our website and services are directed to businesses and representatives able to contract, not to children. We do not knowingly solicit children's data through the project-inquiry form. If you believe a child has submitted data inappropriately, please contact us.
Changes to This Policy
We may update this Policy to reflect changes in law, technology or our processing. Every published version is retained in a public history with its effective date and a concise change summary.
Where a change materially affects your rights, we will proactively provide notice or obtain fresh consent where required. A new version does not retroactively change processing lawfully completed before its effective date.
Contact Us
Privacy questions or requests can be directed to WORKLESS STUDIO COMPANY LIMITED at [email protected] or (+84) 398342407.