Scholarships to study in Australia

INTRODUCTION

Instulink appreciates your trust in providing information during the use of our services. Instulink is committed to protecting and using customer information for the right purposes, safely, and in compliance with the law, in order to protect your rights and ensure transparency in information processing.

This policy is developed and applied in accordance with the Law on Personal Data Protection, Government Decree No. 356/2025/ND-CP detailing some articles and guiding the implementation of the Law on Personal Data Protection, and other relevant legal documents.

 

Article 1: General Introduction to Instulink

Instulink International Co., Ltd. (hereinafter referred to as Instulink) was established in 2015 and is a leading reputable company in Vietnam specializing in study abroad consulting, career guidance, and introducing immigration opportunities to countries such as Canada, the USA, Australia, New Zealand, and the UK. With a team of experienced experts and international certifications, Instulink is committed to providing the young generation of Vietnam with a sustainable educational path, helping them realize their dreams of becoming global citizens.

 

Article 2: Instulink's Commitment to Protecting Personal Information

Instulink commits to fully comply with all current legal regulations on personal data protection during the collection, recording, establishment, structure, storage, adjustment, modification, retrieval, use, disclosure, combination, restriction, deletion, or destruction of customers' personal information provided during the conclusion and execution of contracts, use of services, access to websites, applications, or interaction with Instulink.

 

Specifically, Instulink commits to the following principles:

1. Customers' personal information is processed legally, fairly, transparently, and in accordance with applicable laws;

2. Personal information is collected and processed only for specific, clear, and legitimate purposes as notified by Instulink, and is not processed outside of those purposes, except where otherwise provided by law;

 

3. Personal information is stored only to the extent necessary and appropriate for the processing purposes as stipulated by applicable law;

4. Instulink ensures that the personal information processed is accurate and up-to-date; inaccurate or no longer necessary information for processing purposes will be modified or deleted in accordance with legal regulations;

5. Instulink applies appropriate technical, management, and organizational measures to ensure the safety and security of personal information, including preventing unauthorized access, unauthorized use, loss, damage, or unintentional disclosure of personal information.

Instulink also requires and ensures that its partners and service providers involved in processing personal information on behalf of Instulink comply with equivalent personal data protection standards through signed agreements and contracts.

In addition to the above, Instulink commits to fully comply with other principles and obligations under the law on personal data protection, including but not limited to ensuring the rights of data subjects and regulations related to the transfer of personal data abroad (if any).

 

Article 3: Types of Data Collected

1. Basic Personal Data

During your engagement, use of services, access to websites, applications, online platforms, or interaction with Instulink through various channels (including but not limited to websites, applications, customer support centers, and direct consultations), Instulink may collect and process the following types of personal data:

a. Personal identification information: full name, gender, date of birth, nationality, language; passport number, identity document number, or other personal identification information (including date of issue and place of issue);

b. Contact information and registration information: phone number, residential address, mailing address, email address, other contact information; account information for service registration; information related to your specific needs and requests during the use of services;

c. Account information and activity history: information reflecting your activity, access history, and use of services on Instulink's website, application, or online system;

d. Payment information: information related to payment methods such as cardholder name, card number, expiration date, verification code, or other payment information as required by law and applicable security standards;

c. Transaction and service usage information: information related to registration, purchase, use of services, transaction history, contracts, invoices, and information generated during the service delivery process;

f. Customer program information and promotions (if any): information related to your Instulink customer account, benefits, promotions, promotion usage history, and other information related to programs implemented by Instulink;

g. Information collected automatically: technical information when you access and use Instulink's website, application, or digital platform, such as IP address, cookies, login code, device type, browser, and access time;

h. Contact information: content exchanged between Instulink and you via telephone, email, online forms, social media, complaints, feedback, surveys, or other forms of contact;

i. Information from social media: in case you log in or use Instulink's services through a social media account, Instulink may receive certain information according to your settings and permissions on that social media platform, including basic profile information, contact information, or preferences.

2. Sensitive Personal Data

In certain necessary cases and in accordance with the purpose of providing services, Instulink may collect and process certain personal data classified as sensitive personal data according to Vietnamese law and relevant laws.

The collection, use, and sharing of sensitive personal data will only be carried out by Instulink after obtaining your explicit consent, and only for legitimate purposes as disclosed, including but not limited to supporting, advising, and providing services tailored to your specific needs. Sharing sensitive personal data with third parties (if any) will be done in accordance with legal regulations and only to the extent necessary to provide the service.

3. Cookies and Similar Technologies

When you access and use Instulink's website, applications, or other online services, Instulink may collect some of your information through cookies and similar technologies to ensure system stability, enhance user experience, analyze statistics, and improve service quality.

You can manage, accept, or reject cookies according to the instructions in this Policy or through your browser/device settings, in accordance with applicable laws.

 

Article 4. Methods of Collecting Personal Data

Instulink collects the personal data mentioned in Article 3 of this Policy through the following methods:

1. When you register for and use services provided by Instulink; sign and execute contracts; submit documents and provide information during the consultation and service processing;

2. When you access and use Instulink's website, application (if any), or other online platforms;

3. When you interact and communicate with Instulink through communication channels such as phone, email, social media, forms, or other forms of contact;

4. When you subscribe to newsletters, participate in programs, events, surveys, media activities, or promotional programs organized by Instulink (if any);

5. Through cookies and similar technologies during your access and use of Instulink's website, application, or online services;

6. From relevant third parties such as partners, affiliates, and service providers of Instulink (including but not limited to consulting firms, educational partners, immigration partners, financial institutions, and technology platform providers), in cases where you have consented to the sharing of such personal data in accordance with the law:

7. From competent state agencies, public administration agencies, or other organizations as prescribed by law.

 

Article 5: Collection and Processing of Personal Information

Instulink collects and processes your personal information for the following legitimate, specific, and transparent purposes:

1. Providing and performing services, consulting, evaluating applications, processing and performing services provided by Instulink; concluding, managing, and executing contracts; supporting you throughout the service usage process;

2. Verifying information and identity: checking and verifying your personal information and legal status as required by business operations, partners, or competent authorities;

3. Contacting and supporting customers: contacting, responding to requests, answering questions, handling complaints, providing information related to services, application progress, and any arising issues;

4. Fulfilling legal obligations: meeting the requirements of competent state authorities; Comply with relevant legal regulations regarding accounting, taxation, record keeping, fraud prevention, and other legal obligations;

5. System management, operation, and improvement: managing internal operations, operating the website, applications, and technology platform; analyzing, statistically evaluating, and assessing to improve service quality, system security, and user experience;

6. Payment and financial management: processing payments, reconciliation, invoicing, managing accounts receivable, and related adjustments in accordance with legal regulations;

7. Communication and marketing (if any): sending information about products, services, promotional programs, and events organized by Instulink, provided that you have agreed or the law permits;

8. Sharing data with relevant third parties: providing personal information to partners, service providers, or related parties to perform services for you, in compliance with legal regulations and confidentiality commitments.

9. Protecting legitimate rights and interests: preventing, detecting, and handling fraudulent and infringing acts; protecting the legitimate rights and interests of Instulink, you, and related parties.

 

Article 6. Legal Basis for Processing Personal Data

Instulink processes your personal data on one or more of the following legal bases:

1. Your consent: You express your consent through signing a document, electronic confirmation, marking your consent, responding via email/message, setting up technical settings, or other actions demonstrating your consent as prescribed by law;

2. Fulfilling the contract and your requests: Serving the conclusion and execution of the service contract, processing documents, and carrying out the steps as requested by you before signing the contract;

3. Compliance with legal obligations: Fulfilling obligations as prescribed by Vietnamese law and relevant laws, including but not limited to obligations regarding accounting, taxes, record keeping, reporting, and requests from competent state agencies;

4. Protection of legal rights and interests: ensuring the legal rights and interests of Instulink, our customers, and related parties during the service provision process.

According to Decree 13/2023/ND-CP, Instulink has the right to process personal data without your consent in cases permitted by law, including but not limited to emergency situations to protect life and health; fulfilling contractual obligations; meeting the requirements of competent state agencies; or other cases as prescribed by law.

 

Article 7: Personal Data Retention Period

Instulink will store the personal data you provide on Instulink's internal system during the provision of services or until the purpose of collection is fulfilled or until compliance with legal obligations permits and disputes are resolved or until you request the deletion of the provided information.

 

Article 8: Agencies and Units Receiving Personal Data

To the extent necessary to fulfill the purposes of collecting and processing personal data as stated in this Policy, Instulink may share or transfer your personal data to the following agencies and units:

1. Instulink's internal units: for management, operation, service provision and compliance with legal obligations;

2. Partners and service providers: including but not limited to educational partners, immigration partners, financial institutions, consulting firms, technology platform providers, data storage service providers, accounting and auditing firms, to the extent necessary to provide services to you;

3. Competent State Agencies: In cases where Instulink is obligated to provide data at the legitimate request of state agencies in accordance with the law.

4. Other relevant third parties: In cases where you have given your consent or the law permits it.

5. During the provision of study abroad consulting services, career guidance, introduction of immigration opportunities in various countries, and related services, your personal data may be transferred, stored, or accessed from abroad to educational partners, immigration partners, organizations, and individuals involved in providing services as requested by you. Instulink transfers personal data abroad in compliance with Vietnamese law on personal data protection, ensuring appropriate security measures and only to the extent necessary for the stated processing purpose. Instulink is committed to sharing personal data only to the extent necessary, on a basis consistent with the purpose of processing and requiring the agencies and units receiving the data to comply with their obligations regarding the confidentiality and protection of personal data as prescribed by law.

 

Article 9: Customer Rights Regarding Collected Data

1. Customers have the following rights regarding their personal data as prescribed by law:

a. Right of access: to know and request Instulink to confirm the processing of personal data, to request information about the type of data, the purpose of processing, and the recipient of the data, except where the law provides otherwise.

b. Right to correct, update, or request correction or supplementation of inaccurate or incomplete personal data.

c. Right to request data deletion: to request the deletion or destruction of personal data in cases permitted by law. Instulink has the right to refuse data deletion requests in cases where the law does not permit it, or for reasons of national defense, security, public order and safety, at the request of competent state agencies, or to protect the life and health of the data subject or others;

d. Right to restrict processing: request to restrict the processing of personal data without deleting the data as prescribed by law;

e. Right to transfer data: request to provide one's personal data for private use or transfer to other organizations or individuals as prescribed by law;

f. Right to object: object to the processing of one's personal data for direct marketing purposes;

g. Right to withdraw consent: withdraw consent to the processing of personal data at any time. Withdrawing consent does not affect the legality of the previously performed data processing, however, it may affect the provision of services;

h. Right to complain: to file a complaint with Instulink or the competent state authority when believing that personal data rights have been violated;

i. Right to claim compensation for damages: to claim compensation in accordance with the law if a violation of personal data protection occurs, unless otherwise agreed or stipulated by law.

 

2. Data controller and contact point:

The data controller is Instulink International Co., Ltd., established under Vietnamese law and headquartered at 24 Truong Son Street, Ward 2, Tan Son Hoa Ward, Ho Chi Minh City.

 

Contact point for receiving and processing personal data requests:

Department: Legal

Email: phapche@instulink.edu.vn | info@instulink.edu.vn

3. Methods for Exercising Customer Rights:

Customers can exercise the rights mentioned in Clause 1 of this Article using one of the following methods:

a. Sending a written request by mail; or

b. Sending an email to the contact address above.

When submitting a request, please provide:

a. Necessary identification information (full name, email address, registered phone number);

b. The content of the right requested;

c. Relevant documents or information (if any) for Instulink to verify identity and process the request.

Instulink may request additional reasonable information to verify the Customer's identity, ensuring that the request is made to the correct data subject and complies with legal regulations.

4. Response and Processing Time for Customer Requests:

Instulink receives and responds to requests for the exercise of Customer rights regarding personal data within 02 (two) working days from the date of receipt of a valid request.

The time for fulfilling Customer requests is applied accordingly to each type of right and does not exceed the maximum time limit stipulated in the law on personal data protection.

In cases of complex requests, Instulink may extend the processing time a maximum of 01 (one) time in accordance with legal regulations and notify the Customer of the reason for the extension.

During the processing, when necessary, Instulink will coordinate with the data processing party or relevant third parties to fulfill the Customer's request, ensuring that the time limit permitted by law is not exceeded.

 

Article 10: Children's Personal Information

Instulink only collects and processes the personal information of children (individuals under 16 years of age as defined by Vietnamese law) when such collection and processing is necessary to provide services and with the lawful consent of the child's parents or legal guardians as stipulated by law.

The parents or legal guardians of children have rights to their children's personal data similar to those of data subjects as stipulated in this Policy and applicable law, including the right to access, modify, withdraw consent, request deletion, or restrict the processing of personal data.

 

Article 11. Technical and Management Measures for Protecting Personal Data

Instulink applies appropriate technical and management measures to protect Customers' personal data from the risk of loss, unauthorized access, leakage, misuse, or other risks, including:

1. Access control: personal data is stored and managed with a permission mechanism, restricting access to authorized individuals and departments;

2. System security: implementing technical measures to prevent cyber attacks, malware, and unauthorized external access;

3. Data protection: applying measures such as encryption, anonymization (where appropriate), and data backup to ensure the confidentiality, integrity, and availability of personal data;

4. Data recovery: ensuring the ability to recover data and timely access to personal data in the event of technical or physical incidents;

5. Internal Assessment and Control: Periodically review and evaluate the effectiveness of security measures and upgrade them as needed;

6. Personnel Management and Responsibility: Train and raise awareness of personal data protection for relevant personnel and assign a focal point responsible for protecting personal data in accordance with legal regulations.

 

Article 12. Notification and Handling of Personal Data Violations

In the event of detecting a personal data violation, Instulink commits to promptly applying necessary measures to prevent, mitigate, and remedy the consequences of the violation.

Instulink will notify the Customer and the competent state authorities in accordance with legal regulations if the personal data violation is likely to affect the Customer's legitimate rights and interests. The notification content includes, to the extent appropriate:

1. The nature and scope of the violation;

2. Possible consequences;

3. Measures Instulink has implemented and is implementing to address and mitigate risks.

Instulink may not be required to directly notify the Customer where permitted by law, including but not limited to:

1. Effective security measures (e.g., encryption) have been applied to the compromised data to prevent unauthorized access;

2. Instulink has implemented remedial measures to ensure that the risk of serious damage no longer exists;

3. Direct notification is not feasible; in this case, Instulink will provide notification through appropriate public means as required by law.

 

Article 13. Effective Date

This Privacy Policy is effective from February 11, 2026, and replaces any previous versions of Instulink's Privacy Policy (if any).

Instulink is committed to fully implementing the contents of this Policy and ensuring that its personnel and relevant departments comply with regulations on personal data protection in accordance with the Policy and current laws.

Instulink reserves the right to amend or supplement this Privacy Policy as needed. The updated version will be published on Instulink's website and/or official information channels from the date of update for customers to be aware of and monitor.