Data Processing Agreement

This English version is provided for convenience. If there is any inconsistency, the Vietnamese version prevails.

This Agreement applies when the Customer, whether a school, training center, business or integration partner, uses OMeet under a contract or order form with OWS. It forms part of that contract or order form.

If the Customer and OWS have signed a separate data processing agreement, the signed agreement prevails. For data in Workspaces and classes, this Agreement prevails over the Privacy Policy.

The Customer is the personal data controller for data generated in its Workspaces and classes. OWS is the personal data processor and processes that data for the Customer.

OWS is the personal data controller for data used to manage the contractual relationship, including representative, contact, billing and support data, and for system security data, as described in the Privacy Policy.

OWS processes data only on the Customer's instructions, as expressed in the contract and Workspace configuration and commands submitted through the API. OWS will notify the Customer if OWS believes an instruction violates applicable law.

OWS does not use class data for its own purposes, does not use it for advertising and does not buy or sell personal data.

• Ensure a lawful basis for processing, including giving notice and obtaining any consent required from participants. Where a learner is a child, obtain consent from a parent or legal representative as required by Article 24 of the Personal Data Protection Law.
• Give notice and obtain any consent required before recording a class.
• Obtain the consent required before live-streaming a class; for students who are children, comply with Article 24 of the Personal Data Protection Law; and comply with the streaming platform's terms.
• Submit to OMeet only the data necessary for teaching and learning, and do not submit sensitive personal data unless necessary.
• Manage accounts and Workspace permissions and protect API keys.
• Receive and resolve data-subject requests in the Customer's role as controller.

• Allow access to data only by personnel who need it and are subject to confidentiality obligations.
• Apply the safeguards described under "Data protection" in the Privacy Policy.
• Assist the Customer with data-subject requests by using OWS's pending internal operational target to forward a request received by OWS within 2 business days and by providing tools or support to access, export, correct or delete data. This forwarding target is not the statutory time limit applicable to a third party.
• Provide the information the Customer needs to prepare a personal data processing impact assessment when the Customer is required to do so.
• Notify the Customer within 24 hours after detecting a breach involving Customer data and provide the information needed for the Customer to notify the competent authority within the statutory 72-hour period.

The Customer authorizes OWS to use the providers listed under Subprocessors. OWS enters into a written agreement with each subprocessor containing data protection obligations no less protective than this Agreement and remains responsible to the Customer for the subprocessor's performance.

OWS will notify Workspace administrators at least 15 days before adding or replacing a subprocessor. The Customer may raise a reasoned objection during that period, and the parties will discuss an appropriate solution.

[confirmation required: whether Customer data is transferred outside Vietnam]

• During the contract term, the Customer may export or delete data in its Workspace.
• When the contract ends, the Customer has 30 days to export its data.
• After that period, OWS deletes the data within 90 days, except for data that must be retained by law. Backups are deleted on a 30-day cycle.
• At the Customer's request, OWS will confirm deletion in writing.

OWS provides the information necessary to demonstrate compliance with this Agreement. An audit or assessment will be conducted at a time, within a scope and under confidentiality conditions agreed by the parties in advance, or as required by a competent state authority.

This Agreement takes effect with the service contract. Confidentiality obligations continue after the contract ends. Each party's liability is determined under the service contract and applicable law.

If the Customer needs a signed and sealed copy to attach to its contract, contact privacy@omeet.vn.