Effective date: August 12, 2026
This Privacy Policy explains how Savvycom Joint Stock Company (“Savvycom”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal information when authorized employees use the MY SAVVY mobile application (the “App”). The App is an internal employee application distributed under the identifiers com.savvycom.mysavvy on Android and com.savvycom.mysavvy on iOS.
1. Scope and intended users
MY SAVVY is intended only for Savvycom employees and other users expressly authorized by Savvycom. It provides access to internal human-resources and employee-service features, including attendance, employee requests, company news, notifications, and the Ruby recognition program. It is not intended for children or for general consumer use.
2. Information we collect and process
Depending on the features you use and the information available in Savvycom’s internal systems, the App may process the following categories of information:
- Identity and account information: name, work email address, Microsoft Entra ID account identifiers, employee ID, biometric/attendance identifier, company, role, department, and profile information.
- Authentication and session information: Microsoft OAuth access, ID, and refresh tokens, token expiry information, and the Odoo session cookie used to access Savvycom’s employee portal. The App does not collect or store your Microsoft password.
- Attendance information: planned working hours, check-in and check-out times, attendance status, attendance history, remote-working status, and attendance adjustment details.
- Employee request information: leave, remote-working, missing check-in/check-out, late-arrival/early-leaving, schedule-change, and other attendance applications; selected dates or times; request reasons or notes; approval status; approver information; and leave balance.
- Company content and engagement information: company news and blog content, whether an article was read, and whether it was liked. In the current App version, read and like state is stored locally on the device and is not synchronized with non-App platforms. When you use Share, the App opens the operating system’s share interface; the selected third-party application then handles the shared content under its own privacy policy.
- Ruby recognition information: current Ruby balance, ranking, transaction history, reason for an award or deduction, related employee names, and transaction amounts.
- Technical information: information necessary to establish and maintain a secure session, such as app version, device/platform information made available by the operating system, request timestamps, and server response or error information.
The current App version does not integrate third-party advertising or advertising analytics and does not sell personal information.
3. How we obtain information
Information is obtained from:
- your Savvycom Microsoft account when you authenticate;
- Savvycom’s employee portal and Odoo-based internal systems;
- information you enter or actions you perform in the App; and
- approved internal administrators and business processes.
4. How we use information
We use the information described above to:
- authenticate authorized users and maintain a secure App session;
- display and manage attendance, working-time, leave, and employee requests;
- submit check-in/check-out actions and requests to Savvycom’s internal systems;
- provide company news, notifications, and employee communications;
- operate the Ruby recognition and ranking features;
- protect the security, integrity, availability, and appropriate use of Savvycom systems;
- support users, investigate errors, and improve the App; and
- comply with employment, accounting, security, and other legal obligations.
We process employee information as necessary to administer the employment relationship, operate legitimate internal business systems, meet contractual or legal obligations, and, where applicable, on the basis of consent or another lawful basis recognized by applicable law.
5. Authentication and local storage
The App uses Microsoft Entra ID OAuth 2.0/OpenID Connect for authentication. Authentication tokens are stored in the device’s protected secure-storage facility. A background web session exchanges the authenticated Microsoft session for an Odoo session cookie so the App can call Savvycom’s employee-portal services. The App stores the Odoo session identifier in protected storage and sends it only to Savvycom’s configured portal.
When you sign out of MY SAVVY, the App deletes the stored Odoo session cookie. Microsoft credentials are managed through Microsoft authentication and the device’s protected storage and may remain until they expire, are replaced, access is revoked, the App’s data is cleared, or the App is removed.
6. Sharing and disclosure
We do not sell, rent, or trade employee personal information. Information may be accessible to or shared with:
- authorized Savvycom HR, management, approvers, IT, security, finance, and system-administration personnel, according to their roles;
- Microsoft, for account authentication and identity services;
- Savvycom’s Odoo-based portal and authorized infrastructure or service providers that host, maintain, secure, or support Savvycom systems;
- Apple and Google, as necessary for App distribution and platform operation; and
- government authorities or other parties where required by law, regulation, legal process, or to protect rights, safety, and security.
If you deliberately share an article through another application, information is transmitted to the application and recipient you select.
7. Data retention
Employee, attendance, request, approval, and Ruby records are retained in Savvycom’s internal systems for the period required by Savvycom’s employment, HR, accounting, audit, security, and legal-retention policies. Local App data is retained while needed to provide the App and may remain until you sign out, clear the App’s data, or uninstall the App. Some records cannot be deleted immediately where Savvycom must retain them for legal, employment, audit, security, or dispute-resolution purposes.
8. Security
We use administrative, technical, and organizational safeguards designed to protect personal information. These include authenticated role-based access, encrypted network connections, protected device storage for authentication material, and controlled access to internal systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. International processing
Microsoft, mobile-platform providers, or Savvycom’s authorized service providers may process information in countries other than the country where you work. Where required, Savvycom applies appropriate contractual, organizational, and legal safeguards to such processing.
10. Your rights and choices
Subject to applicable law and Savvycom’s employment and record-retention obligations, you may request access to, correction of, or deletion or restriction of your personal information, or raise a concern about its processing. You may also contact Savvycom HR or IT regarding inaccurate employee, attendance, request, or Ruby records.
To submit a privacy request, email [email protected] or use our Contact Us page. We may need to verify your identity and employment authorization before completing a request.
11. Children’s privacy
MY SAVVY is an internal workforce application and is not directed to children. We do not knowingly collect personal information from children through the App.
12. Changes to this policy
We may update this Policy to reflect changes to the App, our internal systems, or legal requirements. The current version will be posted on this page with an updated effective date. Material changes may also be communicated through the App or internal company channels.
13. Contact us
Savvycom Joint Stock Company
Level 7, Sky Park Tower B, No. 3 Ton That Thuyet, Cau Giay, Hanoi, Vietnam
Email: [email protected]
Phone: +84 24 3202 9222
