Privacy Policy

1. Scope and roles

This Policy explains how TEX Vietnam Technology JSC ("we", "us") handles personal data processed on CLASSQR. It is written in the style of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

• For the account data of the person who registers (a center owner or teacher), we are the data controller.
• For student and parent data that a center or teacher enters into the Platform, the center/teacher is the data controller; we are the data processor, acting only on the center's instructions and only to provide the service.

2. Data we collect

3. Purposes of processing

• Creating and managing accounts and classes; authenticating sign-in; attendance.
• For online classes in a room the Platform created: suggesting attendance from how long each student stayed in the meeting. The teacher always confirms attendance; nothing is marked automatically.
• Recording learning results, generating progress reports and sending them to parents by email or in-app notice as instructed by the center.
• Recording tuition the center collects; processing subscription payments; issuing invoices.
• Technical support, and service, security and policy-change notices.
• Keeping the system secure, detecting fraud and abuse; anonymized statistics to improve the product.
• Complying with legal obligations (accounting, tax, lawful requests from authorities).

We do not sell personal data and do not use student or parent data for advertising.

4. Legal basis and consent

• The person who registers an account agrees to this Policy when they sign up (performance of a contract).
• The center/teacher warrants that it has informed, and obtained the necessary consent of, parents or guardians before putting student data — especially data of children who are minors — and parent data on the Platform, and is responsible for the lawfulness of that data.

5. Sharing data with third parties (subprocessors)

Data is shared only to the minimum extent necessary, with the following recipients:

Gemini, Claude and OpenAI receive only what a teacher submits to write questions and tests (for example the subject, topics, question text or an uploaded document) and, for the Help chat, what center staff type there and the names, statuses and counts of their center's classes and exams, never student names or answers. Under the providers' API terms, this data is not used to train their models. Each provider acts under a contract that limits its use of the data. Because some providers are outside the European Economic Area and the United Kingdom, transfers to them rely on their standard contractual clauses or an equivalent safeguard. In our white-label model, each center's data is kept separate; one center cannot see another's data.

6. Cookies and browser storage

The Platform uses a session cookie to keep you signed in, a cookie to remember your language and interface preferences, and browser storage for brief offline behavior. We do not use third-party advertising tracking cookies. During checkout, Paddle may set its own cookies under Paddle's privacy policy. You can clear cookies in your browser, but you will need to sign in again.

7. Storage, security and retention

• Data is stored on servers we manage, transmitted over HTTPS, with passwords one-way hashed, role-based access control, and logging of administrative access.
• Daily backups are encrypted and kept for up to 30 days.
• Retention period: for the life of the service, plus 30 days after an account or center is deleted, after which it is removed from active systems. Transaction and invoice records are kept for the period required by accounting and tax law (up to 10 years). Technical logs are kept for up to 12 months.
• Online meeting data: participants who match no student of the class are deleted 90 days after the meeting; platform notifications (webhooks) are deleted after 14 days. Display names a teacher links to a student are remembered for that class and deleted with the class. Attendance a teacher confirmed is kept as an attendance record, like attendance taken by hand.
• Disconnecting a meeting platform: a teacher disconnects in Settings, Online meetings, or removes the app in their platform account (for Zoom: App Marketplace, Manage, Added Apps). When no center uses the connection any more, we revoke our access with the platform and delete the tokens at once, and we stop reading meetings. Rooms already created remain in the teacher's platform account. To have the remaining meeting data deleted, contact the center or write to us as described in section 8.

8. Your rights

Subject to applicable law, including the GDPR and UK GDPR, a data subject (or a student's parent or guardian) has the right to: be informed, give or withdraw consent, access their data, rectify it, erase it, restrict processing, object to processing, request a copy of their data (data portability), and lodge a complaint with a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office).

How to exercise these rights: students and parents should first contact their center or teacher (the data controller for their data); the account holder or center should send a request to [email protected]. We acknowledge within 72 hours and act on the request within 30 days, and may ask you to verify your identity first.

Residents of California and other US states with privacy laws: we do not sell or share personal data for advertising; the rights above cover your rights to know, delete and correct your data.

9. Data breach notification

If we discover an incident that exposes, loses or alters personal data without authorization, we will notify the affected center and, where required by law, the competent supervisory authority, without undue delay and in any case within 72 hours of becoming aware of it, together with the remedial steps taken.

10. Children's data

The Platform supports educational use, so it necessarily processes data about students who are minors. That processing always happens through a center, teacher, parent or guardian; only the minimum data needed for learning is collected; student profiles are not made public; and no advertising is sent to students. A parent or guardian may request access to or deletion of their child's data as described in section 8.

The center is responsible for obtaining verifiable parental consent where the law requires it before a child's data is put on the Platform or a child joins an online class whose meeting data the Platform reads, including under the US Children's Online Privacy Protection Act (COPPA) for children under 13 and under the GDPR and UK GDPR where a child is below the age of digital consent in their country. We process children's data, including the meeting data described in section 2, only on the center's instructions and only to provide the service.

11. Enregistrements de cours

Lorsqu’un enseignant utilise « Enregistrer la leçon », la Plateforme conserve la séance sous forme d’une suite d’événements du tableau : les pages et diapositives affichées, les traits, les formes, les tableaux annexes, les boîtes de dialogue, le pointeur laser et les étapes révélées de la correction en classe, avec une copie du document ou du test tel qu’il était au début. La voix de l’enseignant n’est enregistrée que lorsqu’il active l’enregistrement de la voix. L’application n’enregistre ni les caméras, ni les micros, ni les écrans des élèves ; un enregistrement de la voix peut capter ce que disent les élèves près du micro de l’enseignant.

Seuls les élèves inscrits dans la classe et les enseignants de la classe peuvent voir un enregistrement, après connexion ; les enregistrements n’ont pas de lien public. Nous enregistrons quels élèves ont vu un enregistrement et pendant combien de temps, afin que l’enseignant sache qui a revu le cours.

Un enregistrement est conservé 90 jours, puis supprimé automatiquement avec ses fichiers. Il est supprimé plus tôt si l’enseignant le supprime, ou supprime son activité, sa leçon ou sa classe.

Le centre ou l’enseignant qui enregistre est le responsable du traitement de l’enregistrement. Il lui revient d’informer les élèves, ainsi que leurs parents ou tuteurs, que les cours peuvent être enregistrés, et d’obtenir le consentement lorsque la loi l’exige, en particulier pour les mineurs : par exemple le consentement parental vérifiable prévu par la loi américaine COPPA pour les enfants de moins de 13 ans, et le consentement d’un parent ou tuteur prévu par le RGPD ou le RGPD britannique pour les enfants n’ayant pas atteint l’âge du consentement numérique de leur pays (16 ans, ou un âge inférieur fixé par la loi nationale).

Pour faire supprimer un enregistrement, l’élève, le parent ou le tuteur contacte le centre ou l’enseignant, qui peut le supprimer immédiatement depuis la liste des leçons. Vous pouvez aussi nous écrire comme indiqué à la section 8.

12. Changes to this Policy

When this Policy changes materially, we will notify you by email or in-app notice at least 7 days before the change takes effect. The effective date of the current version is shown at the top of the page.

13. Privacy contact

Our data protection contact handles all requests, questions and complaints at: