Studio Galileo Co., Ltd. (hereinafter the "Company") processes personal data lawfully and manages it securely in compliance with the Vietnamese Personal Data Protection Law (Law No. 91/2025/QH15), its implementing Decree (Decree No. 356/2025/ND-CP) and other applicable laws and regulations, in order to protect the freedoms and rights of data subjects. Accordingly, the Company establishes and publishes this Privacy Policy as follows, so as to inform data subjects of the procedures and standards for the processing and protection of personal data and to handle related grievances promptly and smoothly.
Article 1 (Personal Data Handlers and Division of Roles)
- UEH, as the original holder and provider of student and faculty/staff account information, is the Personal Data Controller.
- UEH provides the Company with only the minimum information necessary to use the Service (such as membership verification information), and the Company provides the Service based on the minimum information received from UEH.
- The Company is a Processor, or a Controller-Processor, that processes the information received from UEH and the information generated in the course of using the Service for the purpose of providing the DRT service.
- The detailed rights and obligations of the Company and UEH regarding the processing of personal data are governed by the Non-Disclosure Agreement (NDA) between the two institutions.
Article 2 (Items Collected, Purposes and Retention Period of Personal Data)
- The Company collects only the minimum personal data necessary to provide the Service, and the mandatory items consist only of information necessary to use the Service. Even if a user does not consent to the optional items, there is no restriction on use of the basic Service.
- The items processed with the consent of the data subject are as follows:
| Time of collection | Items | Purpose | Retention period |
|---|---|---|---|
| Upon eligibility verification | UEH member identification token | Verification of UEH member eligibility, Personal identification and authentication, management of service access | Until the end of the Demonstration Project |
| Upon membership registration | Name, email address (provided through Google account login and stored after passing the UEH member authentication API), pseudonymous ID (internal UUID for member identification) | [Membership registration and management] - Confirmation of intent to register, maintenance and management of eligibility, various notices and notifications, restriction measures against members who violate the Terms of Service, prevention of and sanctions against acts that hinder the smooth operation of the Service, including improper use, and confirmation of intent to withdraw [Service provision] - Provision of the Service and resolution of issues such as member verification related to use of the Service [Service improvement] - Analysis of usage records and access frequency, and statistics on use of the Service [Handling of complaints] - Verification of the complainant's identity, confirmation of the complaint, contact and notification for fact-finding, notification of results, resolution of issues arising from or investigated in connection with use of the Service, and satisfaction surveys on use of the Service | Upon member withdrawal or the end of the Demonstration Project, whichever comes first, destroyed without delay |
| Upon use of the Service | Location data (from the start to the end of use) | Provision of location-based transport service and information guidance; analysis for service improvement and performance evaluation | Destroyed without delay upon member withdrawal or the end of the Demonstration Project, whichever comes first |
- The optional items processed with the consent of the data subject are as follows:
| Items | Purpose | Retention period |
|---|---|---|
| (Optional) Nickname | Setting of display name within the Service | Upon member withdrawal or the end of the Demonstration Project, whichever comes first |
| (Optional) Usage patterns (pseudonymized/statistical processing) | Service improvement and demand analysis | Until the end of the Demonstration Project |
| (Optional) Survey responses, notification receipt information | Satisfaction surveys and service announcements | Until consent is withdrawn |
- In the course of using the Service, the following information may be automatically generated or collected for purposes such as ensuring service stability, providing a safe service, and restricting unlawful acts:
- Service usage records, access logs, IP information, cookies, push tokens, records of defective or improper use, mobile device information (model name, OS information, language and country information, advertising ID, device identification information, etc.)
- Unlawful or improper access to the Service application and related records, and information necessary to verify a safe operating environment
- Feedback and rating information generated or registered in the course of using the Service
- In the following cases, information is retained until the relevant reason ends:
- Where consumer complaint handling, dispute resolution, accident investigation or the like is in progress, until the end of that investigation
- Where there is a retention obligation under applicable laws and regulations, until the period prescribed by those laws and regulations
Article 3 (Processing of Location Data (Sensitive Data))
- Real-time location data and movement route information processed by the Company constitute sensitive data under the Vietnamese Personal Data Protection Law, and the Company processes them on the basis of the user's separate, explicit consent.
- Location data is used only for DRT vehicle dispatch, real-time route guidance and verification of pick-up/drop-off points, and is not used for any other purpose.
- Real-time location data is processed only while the Service is in use (dispatch and guidance), and is deleted without delay when guidance ends or, where used for statistical or analytical purposes, is pseudonymized or de-identified.
- Users may withdraw their consent to the collection of location data or restrict background collection through the device operating system settings and the functions within the Application, and the Company provides a location-tracking preference setting.
- The Company minimizes access privileges to location data and applies enhanced safeguards such as encryption and access control to prevent unauthorized third-party access.
Article 4 (Destruction of Personal Data)
- The Company destroys a data subject's personal data without delay when the purposes of collection and use have been achieved or the retention period has elapsed. However, where the data must be retained for a certain period under other laws and regulations, it is stored securely for that period and then destroyed immediately.
- Information in the form of electronic files is deleted by a method that makes recovery and reproduction impossible, and paper documents and the like are destroyed by shredding or incineration.
Article 5 (Provision of Personal Data to Third Parties)
- The Company does not provide personal data to third parties without the consent of the data subject, and provides it within the scope of the processing purpose only where there is a special provision in law or where applicable laws and regulations permit.
- In an emergency such as a disaster or infectious disease outbreak in which there is a serious danger to life, body or property, personal data may be provided to the relevant authorities, to the minimum extent necessary, without the data subject's consent.
- The items provided with the consent of the data subject are as follows:
| Recipient | Purpose | Items | Retention period |
|---|---|---|---|
| UEH | Support for verifying member usage status at UEH's request | Minimum usage information requested by UEH (such as de-identified usage records) | Until the end of the Demonstration Project |
| Transport Partner | Provision of dispatch and operation services through the dedicated driver app; filing of insurance claims in the event of an accident | Call information (pick-up/drop-off stops, passenger ID, seat information) | Until the end of the Demonstration Project (until processing is completed, where related to accident handling) |
- In the course of providing the Service, the Company provides the user's call information (pick-up/drop-off stops, passenger ID, seat information) through the dedicated driver application used by the Transport Partner.
- The Company provides minimum information such as members' usage status to UEH only where UEH so requests.
Article 6 (Entrustment of Personal Data Processing)
- The Company may entrust part of the work necessary to provide the Service to external specialist companies, and discloses the entrusted parties, the entrusted tasks and the retention period in this Policy.
- When entering into an entrustment contract, the Company specifies in the document, in accordance with applicable laws and regulations, matters such as the prohibition of processing personal data for purposes other than performing the entrusted work, technical and administrative protective measures, restrictions on sub-entrustment, management and supervision of the entrusted party, and liability such as compensation for damages, and supervises whether the entrusted party processes personal data securely.
- If the content of the entrusted work or the entrusted party changes, the Company will disclose this without delay through this Privacy Policy.
Article 7 (Security Measures for Personal Data)
- The Company takes the following measures to ensure the security of personal data:
- Establishment and implementation of an internal management plan
- Minimizing the designation of, and providing training to, personal data handlers
- Restriction of access to personal data and control of access privileges
- Retention of access records and prevention of forgery or alteration
- Encryption of personal data (in particular, sensitive data such as location data)
- Technical countermeasures against hacking and the like
- In the event of a personal data breach, the Company will notify the competent authority and take necessary measures in accordance with applicable laws and regulations.
- In connection with the processing of sensitive data such as location data, the Company operates servers using a cloud located in Vietnam (Viettel IDC), and matters such as risk management and implementation of safeguards relating to the cross-border transfer and processing of personal data are governed by the Non-Disclosure Agreement (NDA) between the Company and UEH.
Article 8 (Rights and Obligations of Data Subjects and How to Exercise Them)
- Data subjects may exercise the following rights against the Company at any time: the right to be informed, to give and withdraw consent, to access, correct and delete, to restrict processing, to object to processing, to request provision of data, to lodge complaints and objections, and to claim compensation for damages.
- Rights may be exercised through the functions in the Application or by writing, email or the like using the contact details below, and the Company will take action without delay within the period prescribed by applicable laws and regulations.
- Rights may also be exercised through the data subject's legal representative or an authorized agent, in which case a power of attorney must be submitted.
- Rights concerning information held and managed by UEH as the controller may be exercised through UEH, and the Company will cooperate in this regard.
Article 9 (Personal Data Protection Officers and Complaint-Handling Departments)
- UEH and the Company bear overall responsibility for matters concerning the processing of personal data, and have designated the following Personal Data Protection Officers and responsible departments for each country in order to handle complaints and provide remedies for data subjects.
| Category | Details |
|---|---|
| (Republic of Korea) Personal Data Protection Officer | Jin Hyeong-min, CIO / +82-31-299-2133 |
| (Vietnam) Personal Data Protection Officer | Trinh Dang Thai / UEH DSA (Department of Student Affairs) |
Article 10 (Remedies for Infringement of Data Subjects' Rights)
- Data subjects may contact the UEH DSA if a situation such as a personal data infringement occurs.
- The specific reporting and consultation channels and contact details are as guided by the relevant UEH DSA, and the Company provides this information through the Application.
Article 11 (Changes to the Privacy Policy)
This Privacy Policy takes effect on October 19, 2026. If the contents of this Policy change, the changes and their effective date will be announced through the Application.