Privacy Policy

This Privacy Policy explains how Atlantic Five-Star English Joint Stock Company (“5S-IS”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you use the 5S-IS Parent mobile application (Android and iOS) and the 5S-IS web portal (together, the “Services”).

1. Who we are and our role

5S-IS is a school information system used by schools to manage academic records and to communicate with parents and guardians. The Services are provided by:

• Atlantic Five-Star English Joint Stock Company (CÔNG TY CỔ PHẦN ATLANTIC FIVE - STAR ENGLISH)
• Enterprise code: 0108173985
• Contact: admin@5sis.edu.vn

Accounts on the Services are issued by the school your child attends. For student and family records entered by the school, the school determines what data is collected and how it is used (the school acts as the data controller), and we process that data on the school’s instructions as its service provider. For information we need to operate and secure the Services themselves, such as authentication, security logs, and technical diagnostics, we act as the controller.

2. Information we collect

We only collect information needed to run the Services. We do not create accounts through the app; your school provides your login credentials.

2.1 Account and profile information

• Login identifier (username or email address) and password.
• Full name, email address, phone number, preferred language, and profile photo, where provided by you or by the school.
• Your relationship to the student or students linked to your account.

2.2 Student information made available to you

As a parent or guardian, the app shows you information about your own child, which the school records in 5S-IS. This may include:

• Student name, class, photo, and student identifier.
• Attendance, daily reports, and teacher comments.
• Scores, assessments, and academic summary reports.
• Timetables, calendars, school events, and announcements.
• Health, meal, or activity notes where the school records them.

This information is created and controlled by the school. We display it to you; we do not use it for our own purposes.

2.3 Device and technical information

• Device model, operating system and version, application version, and device language.
• IP address, connection timestamps, and authentication events (for example sign-in, sign-out, and failed sign-in attempts).
• Notification token, used solely to deliver notifications to your device.
• Diagnostic and error logs generated when the app encounters a problem.

2.4 Content you submit

• Messages, feedback, absence requests, or other forms you submit through the Services.
• Files or images you choose to upload, for example a profile photo or an attachment to a request. Files are only accessed when you explicitly select them.

2.5 Payment information

Where a school enables online payment of tuition or fees, payments are processed by a third-party payment provider. Card and payment credentials are entered on the provider’s systems; we do not collect or store full card numbers, CVV codes, or bank credentials. We retain only the transaction reference, amount, status, and date needed for school billing records.

3. Information we do not collect

• We do not collect precise or background location data. The mobile application does not request location permissions.
• We do not access your contacts, call logs, SMS messages, calendar, or microphone.
• We do not scan your photo library; images are only read when you explicitly pick a file to upload.
• We do not sell or rent personal information, and we do not share it with data brokers.
• We do not use personal information for advertising, ad targeting, or ad measurement. The Services contain no third-party advertising SDKs.
• We do not build marketing profiles from student data or use student data to train third-party artificial intelligence models.

4. How we use information

5. Legal basis for processing

Where data protection law requires a legal basis, we rely on one or more of the following:

• Performance of a contract — to provide the Services under our agreement with your school.
• Legitimate interests — to keep the Services secure, reliable, and free from abuse, balanced against your rights.
• Consent — for optional features such as push notifications, which you can withdraw at any time in your device settings.
• Legal obligation — where retention or disclosure is required by applicable law.

6. Push and in-app notifications

With your permission, we send notifications about your child’s school activity, such as new daily reports, published scores, or school announcements. To do this, the operating system assigns your app installation a notification token, which we store and use only to deliver these messages through the platform notification services operated by Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service).

You may turn notifications off at any time in your device settings. Turning them off does not delete your account or restrict access to the rest of the Services.

7. How we share information

We share personal information only in the following situations:

• With your child’s school — teachers and administrators of the school that issued your account can access the records relevant to their role.
• With service providers who process data on our behalf under contract and only on our instructions, including cloud hosting and storage providers, notification delivery providers, and, where the school enables online payment, the payment provider.
• For legal reasons — where disclosure is required by law, court order, or a lawful request from a competent authority, or where necessary to protect the rights, safety, or property of students, users, or the public.
• In a business transfer — if all or part of our business is reorganised, merged, or acquired, information may transfer to the successor entity, which will remain bound by this policy or a policy that is at least as protective. We will notify affected schools before any such transfer takes effect.

8. Children’s and student privacy

The 5S-IS Parent application is intended for use by parents, guardians, and school staff who are adults. It is not directed to children, and we do not knowingly allow children to create accounts.

The Services do contain information about students, including students under the age of consent. That information is entered by the school in its capacity as the education provider and is displayed only to the student’s own parents or guardians and to authorised school staff. We process it strictly on the school’s instructions, we do not use it for advertising or profiling, and we do not disclose it to third parties except as described in Section 7.

If you believe a child’s information has been collected or shown incorrectly, contact your school directly or write to us at admin@5sis.edu.vn and we will work with the school to correct or remove it.

9. Data retention

• Student and academic records are retained for as long as the school requires them, in line with the school’s retention policy and applicable education record laws. The school decides when these records are deleted.
• Account information is retained while your account is active. When the school deactivates your account, it is disabled promptly and deleted or anonymised within 90 days, unless a longer period is required by law.
• Security and authentication logs are retained for up to 12 months.
• Diagnostic and error logs are retained for up to 90 days.
• Notification tokens are deleted when you sign out, uninstall the app, or disable notifications.

10. How we protect information

• All traffic between the app or browser and our servers is encrypted in transit using HTTPS/TLS.
• Authentication tokens are stored on your device using the operating system’s secure storage (Android Keystore and iOS Keychain).
• Passwords are stored only as salted one-way hashes; never in plain text.
• Access to production data is restricted to authorised personnel on a need-to-know basis and is logged.
• Data is backed up regularly, and backups are protected with the same controls as production data.

No method of transmission or storage is completely secure. If a personal data breach affects your information, we will notify the affected school and, where required by law, the relevant authority and affected individuals without undue delay.

11. Your rights and choices

Subject to applicable law, you may:

• Access the personal information we hold about you.
• Request correction of information that is inaccurate or incomplete.
• Request deletion of your personal information.
• Object to or request restriction of certain processing.
• Request a copy of your information in a portable format.
• Withdraw consent for optional features such as notifications.
• Lodge a complaint with your local data protection authority.

Because your account is issued by your school, the fastest route for requests about student or family records is to contact the school directly. You may also write to us at admin@5sis.edu.vn. We respond to verified requests within 30 days and will forward any request that must be decided by the school to the school without delay.

12. Account and data deletion

Accounts are created and managed by your school, so they cannot be deleted from within the app. To request deletion of your account and associated personal data:

• Contact your school administrator, or
• Email admin@5sis.edu.vn from the address registered to your account, with the subject “Account deletion request” and the name of the school.

We will verify the request with the school and, once approved, disable the account promptly and delete or anonymise the associated personal data within 90 days. Academic records the school is legally required to keep, and records we must retain to comply with law, are kept for the required period and then deleted.

13. Data location and transfers

Personal information processed through the Services is hosted on servers located in Vietnam. Some service providers, such as the platform notification services operated by Google and Apple, may process limited technical data outside Vietnam. Where information is transferred across borders, we use contractual and technical safeguards to require a level of protection consistent with this policy and applicable law.

14. Third-party links and services

Parts of the Services may display content from, or link to, websites operated by your school or by third parties, including pages opened in an in-app browser view. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policy of any third-party site you visit.

15. Changes to this policy

We may update this Privacy Policy to reflect changes to the Services or to legal requirements. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will notify you through the app, by email, or through your school before they take effect. Continuing to use the Services after the changes take effect means you accept the updated policy.

16. Contact us

If you have questions about this Privacy Policy or about how your personal information is handled, contact us at: