隐私声明背后的协议。

This agreement is between the agency using Visatory (the customer, acting as data controller) and VNIS Vietnam Company Limited (Visatory, acting as data processor). It forms part of, and is governed by, the terms of service.

The customer decides what personal data is collected, why, who may see it and how long it is kept. Visatory processes that data only to provide the service, and only on the customer’s documented instructions — of which using the product is one.

Subject matter. Providing a customer relationship and records system for education and immigration recruitment.

Duration. For as long as the customer holds a workspace, and for the deletion period in clause 9 after that.

Nature and purpose. Storing, organising, retrieving and exporting records the customer creates; sending email the customer initiates; and, where the customer enables it, submitting text to an AI model at the moment a counselling or essay-feedback session runs.

Data subjects. Prospective and current students; parents and guardians, including of students under eighteen; the customer’s own staff; and contacts at partner institutions and sub-agents.

Personal data. Identity and contact details; passport and travel document details; education history and English test results; financial evidence supporting a visa application; counselling notes; application, offer and visa milestone records; consent and disclosure records; and commission records naming a student.

Special categories. None is required by the service and none is asked for. If a customer uploads a document containing Article 9 data — a medical certificate attached to a deferral, for example — it is processed as an ordinary file under the same controls, and the customer remains responsible for having a lawful basis for it.

Visatory processes personal data only on the customer’s instructions, including for transfers, unless required otherwise by law — in which case the customer is told before processing, unless that law forbids it.

Personnel with access are bound by confidentiality and have access only where a task requires it. Support access to a workspace is not implicit: it needs a time-boxed grant, the grant expires, and every use is written to an audit log the customer can be shown.

Each of the following is a property of the system rather than a policy statement, and can be demonstrated on request.

• Each customer's data is held in a separate database, not as rows in a shared table. There is no query that can return two customers' records.
• Database connection credentials are encrypted at rest and are never rendered into a page or a log.
• Sign-in is a single-use code sent by email, valid for ten minutes. No passwords are stored, so none can be leaked or reused.
• Access within a workspace is governed by per-area roles the customer administers, with branch-level visibility limits.
• Every uploaded document records where it came from, who checked it, and a checksum. Marking a document verified is a distinct act attributed to a named person.
• Compliance mutations are written to an append-only audit log that outlives the record it describes.
• Retention is a clock the product enforces: deletion of a record still inside the customer's retention window is refused, and the date it becomes eligible is shown.
• Error reporting is configured to capture no request bodies, no user identifiers and no IP addresses, and session replay is not enabled.
• Data in transit is encrypted with TLS; data at rest is encrypted by the database and storage providers named in clause 6.

No certification is claimed. Visatory holds no ISO 27001 or SOC 2 report and has not commissioned an independent penetration test; saying so is more useful than a badge nobody can verify.

The current sub-processors, and what each receives, are named on the privacy notice, which is updated when the list changes. The customer authorises their use.

Visatory imposes on each sub-processor obligations no less protective than those in this agreement and remains liable for their performance. Customers are given notice of an addition or replacement before it takes effect, by email to workspace owners and in the changelog, and may object on reasonable data-protection grounds — in which case the customer may terminate the affected service without penalty for the remainder of the paid period.

VNIS Vietnam Company Limited is established in Vietnam. The sub-processors operate globally, and databases are provisioned in the region nearest the customer.

Where personal data originating in the EEA, the United Kingdom or Switzerland is transferred outside it, the transfer relies on the European Commission’s Standard Contractual Clauses, or the UK Addendum where applicable, which are incorporated into this agreement by reference. A customer requiring the clauses as a signed annex should ask; they will be provided.

Data subject rights. A student asking for a copy of their record, or its deletion, asks their agency. Both are actions the customer performs in the product without needing Visatory. Where a request reaches data only Visatory holds, it is actioned on request and the customer is told what was done.

Breach notification. Visatory notifies the customer without undue delay, and in any case within 48 hours of becoming aware, with the nature of the breach, the categories and approximate number of records affected, the likely consequences and the measures taken. Notifying a supervisory authority is the customer’s obligation as controller; Visatory provides what is needed for it.

Impact assessments. Reasonable assistance is provided with data protection impact assessments and prior consultations, taking account of the information available.

Export is a feature and not a request: the customer’s data leaves in a readable format at any time, including on the last day of a trial, without asking.

On termination, the customer may export at any point during the notice period. On request, the workspace database and its stored documents are deleted and the customer is told when it is done. Backups held by the infrastructure and database providers expire on their own schedules and are not searched record by record.

A lapsed subscription does not delete anything. The workspace becomes read-only and every record stays readable and exportable.

Visatory makes available the information needed to demonstrate compliance with Article 28 and allows for and contributes to audits, including inspections, by the customer or an auditor they mandate. In practice that means answering a security questionnaire, evidencing the controls in clause 5, and providing the support-access audit log for the customer’s own workspace.

Audits are at reasonable intervals and on reasonable notice, and must not require access to another customer’s data — which the architecture in clause 5 makes impossible in any case.

Data protection correspondence: office@vnisgroup.com. Product and account questions: support@visatory.com.

Accepting the terms of service accepts this agreement. A customer whose procurement requires a countersigned copy on their own paper should write to the address above and one will be executed.

Version 2026-08-18. Changes are announced in the changelog and by email to workspace owners before they take effect.