Privacy Policy

DearPulse (hereinafter referred to as “We,” “DearPulse,” or the “Provider”) is committed to protecting the privacy and personal data security of Customers, end users, and any data subject who interacts with the DearPulse system.

This Privacy Policy applies to all products, services, websites, and applications under the DearPulse brand, including the DearPulse Dashboard, DearAgent (the data-collection software installed on workstations), the API, and official support channels.

By using DearPulse, Customers and end users confirm that they have read, understood, and agreed to the contents of this Policy, and that they will comply with Vietnamese law — in particular Decree 13/2023/ND-CP on personal data protection.

• “Personal data” means information in the form of symbols, letters, numbers, images, sound, or similar formats in an electronic environment that is associated with, or helps identify, a specific individual.
• “Data subject” means the individual reflected by the personal data.
• “Data Controller” means the Customer (the enterprise) — the party that determines the purposes and means of processing the personal data of its employees/end users through DearPulse.
• “Data Processor” means DearPulse — the party that processes data on behalf of the Data Controller under contract.
• “Consent” means a clear, voluntary, and demonstrable expression by the Data Subject permitting the processing of their personal data.

DearPulse collects the following categories of data, strictly limited to the scope configured by the Data Controller:

• Providing features under the service contract between DearPulse and the Data Controller
• Performance analysis, time and attendance tracking, and periodic reporting to meet the enterprise's operational needs
• Detecting security violations, alerting on unrecognized USB devices, and flagging anomalous behavior
• Providing technical support when Customers report issues
• Improving product quality using anonymized data that is not linked to any specific individual
• Complying with legal obligations under Vietnamese law

DearPulse processes personal data on the following legal bases under Decree 13/2023/ND-CP:

• The demonstrable consent of the Data Subject (Article 9)
• Performance of the contract between DearPulse and the Data Controller
• Performance of the employment contract or agreement between the Data Controller and the Data Subject (employee)
• The legitimate interest of the Data Controller in ensuring information security and operational management
• Compliance with the Data Controller's legal obligations

• All data is encrypted with AES-256 at rest and TLS 1.3 in transit
• Servers are located in Vietnam (for Cloud customers) or on the Customer's own infrastructure (on-premise)
• Access is governed by the principle of least privilege
• All access to sensitive data is recorded in an immutable audit log
• Encrypted daily backups, with point-in-time recovery of 7/30/90 days depending on the service plan
• Default retention period: 6–12 months as configured by the Data Controller, after which data is automatically deleted

Under Decree 13/2023/ND-CP, Data Subjects have the following rights:

• The right to be informed about the processing of their personal data
• The right to consent or withhold consent to data processing
• The right to access and view their personal data
• The right to request correction or updating of inaccurate data
• The right to request deletion of data (the right to be forgotten)
• The right to restrict data processing
• The right to request provision of their personal data
• The right to object and to withdraw consent
• The right to lodge complaints, file reports, or initiate legal proceedings
• The right to claim damages
• The right to self-protection

DearPulse commits to NEVER selling, renting, or trading personal data with any third party for advertising or commercial purposes.

DearPulse shares data only in the following limited circumstances:

• At the lawful request of a competent state authority
• With infrastructure providers that have signed a data processing agreement (DPA)
• In emergencies involving the safety of life or property
• With the explicit consent of the Data Subject or the Data Controller

For Cloud customers, data is stored in Vietnam by default.

Where a Customer requires storage in another country or relies on a service dependent on a foreign provider, DearPulse will conduct a Data Protection Impact Assessment (DPIA) and provide notification in accordance with Article 25 of Decree 13/2023.

DearPulse does not proactively collect data from individuals under 16 years of age. The product is designed for enterprise environments.

If a Data Controller uses DearPulse in an environment with users under 16 years of age (for example, a vocational training institution), the Data Controller must obtain parental or guardian consent in accordance with Article 11 of Decree 13/2023.

DearPulse reserves the right to update this Policy in response to changes in the law or updates to the product.

Any material change will be communicated by email to administrator accounts at least 30 days before it takes effect.

For any privacy-related questions or requests, please contact:

• Email: privacy@dearpulse.net
• Data Protection Officer (DPO): dpo@dearpulse.net
• Legal entity: DEARTECH SOFTWARE COMPANY LIMITED (CÔNG TY TNHH DEARTECH SOFTWARE) — Vietnam