Cadena's Roles: Data Controller vs. Data Processor
Depending on how you interact with us, Cadena operates in two distinct legal capacities:
Data Processor
When our corporate clients use the Cadena HRM Series 5 platform to manage their workforces, or when our team interacts with client data during Annual Customer Support Services, the client is the Data Controller. Cadena acts strictly as a Data Processor, handling that data solely on behalf of, and according to the instructions of, the client.
Data Controller
When individuals visit our website, complete an inquiry form, or call our sales hotline, Cadena acts as the Data Controller for that specific contact information.
Data Collected and Scopes of Processing
A. Client HRIS Platform Data (Cadena HRM Series 5)
For corporate clients deploying our HRIS system, the platform processes personal data belonging to the clients' employees and job candidates.
- Data Types: Employee and candidate profiles (names, contact details, identification numbers, national IDs, tax IDs, banking details for payroll), attendance records (time-in/time-out logs, shift schedules, leave requests), and basic employment histories.
- Purpose: Processing is entirely determined by the client for workforce management, payroll administration, attendance tracking, and regulatory labor reporting.
B. Annual Customer Support Services
When clients utilize our Annual Customer Support Services, Cadena support staff may temporarily come into contact with or access the client's database to troubleshoot, configure, or optimize Cadena HRM Series 5.
- Data Types: Intermittent access to the employee profiles, payroll variables, and attendance logs stored within the client's system.
- Purpose: Providing technical assistance, bug resolution, and system maintenance. Support staff access data strictly under confidentiality agreements and via secure protocols.
C. Website Visitors and Sales Inquiries
When individuals voluntarily engage with our marketing and sales channels:
- Data Types: Names, business email addresses, phone numbers, job titles, company names, and any message details provided via our website inquiry form or collected via our sales hotline.
- Purpose: To respond to sales inquiries, provide system demonstrations, and share commercial proposals regarding Cadena HRM Series 5.
Regulatory Framework: Singapore PDPA vs. Vietnam Data Privacy Regime
Because Cadena serves markets across Southeast Asia from Singapore and Vietnam, we balance compliance across both jurisdictions. The table below highlights the key differences between Singapore's PDPA and Vietnam's Data Privacy Act (Law No. 91/2025/QH15 & Decree 356/2025/ND-CP) as applied to our services:
| Feature / Obligation | Singapore PDPA | Vietnam Data Privacy Regime |
|---|---|---|
| Data Classification | Treats personal data uniformly; requires standard reasonable security protections based on data sensitivity. | Formally divides data into Basic and Sensitive. Financial, payroll, and health data are classified as Sensitive Data. |
| Legal Basis | Relies on Consent, as well as statutory exceptions like Legitimate Interests or Deemed Consent by Notification. | Highly Consent-Centric. Consent must be explicit, voluntary, and specific. No broad "legitimate interests" carve-out for commercial entities. |
| Data Protection Officer | Statutory mandate to appoint a DPO; contact details must be publicly accessible. | Mandates a dedicated Data Protection Department and Personnel for entities processing Sensitive Data. |
| Regulatory Filing | Internal accountability focus; no mandatory file-registry submission for standard corporate databases. | Requires organizations to proactively submit a Data Protection Impact Assessment (DPIA) to the Ministry of Public Security (MPS) within 60 days of starting processing. |
| Individual Rights Deadlines | Requires organizations to respond to access/correction requests within 30 days. | Mandates a strict 72-hour deadline to fulfill certain data subject requests (such as deletion or restriction). |
Purpose, Consent, and Retention Limits
Purpose Limitation
Personal data is never used or disclosed for purposes outside of the original scope — either the business fulfillment specified in our client contracts (for HRIS and support services) or the explicit follow-up requested by a sales prospect.
Consent Requirements
- For Corporate Systems (HRIS & Support): Our corporate clients are legally responsible for establishing the lawful basis and securing explicit, valid consent from their own employees and job candidates prior to importing their profiles into Cadena HRM Series 5.
- For Sales Channels: Prospects provide affirmative, voluntary consent when they click "Submit" on our website inquiry form or verbally share their details during a call to our sales hotline. Consent can be withdrawn at any time by contacting our DPO.
Retention and Storage Limits
Cadena does not hold personal data indefinitely. Data is preserved according to the following rules:
- Client Platform Data & Support Access: Data resides in the system for the duration of the commercial software license agreement. Upon contract termination or client request, Cadena completely purges or returns the database, subject to statutory tax, audit, and employment record retention laws in Singapore and Vietnam (typically up to 5 to 7 years for financial and payroll records).
- Sales Inquiry Data: Contact details of prospects are retained for up to 2 years following the last active communication, unless a commercial contract is initiated or a deletion request is submitted.
Information Security Measures
In accordance with Singapore's Protection Obligation and Vietnam's mandatory security principles for basic and sensitive information, Cadena enforces stringent technical and organizational measures:
- Access Control: Strict identity management limits access to client support databases only to authorized engineering personnel who require it to complete a support ticket.
- Data Segregation: Client databases hosted on our infrastructure are completely isolated to prevent cross-contamination.
- Audit Logging: Support sessions, system modifications, and administrative logins within Cadena HRM Series 5 generate immutable audit trails.
Data Breach Notification
In the event of a data breach involving unauthorized access, loss, disclosure, or destruction of personal data, Cadena will notify the relevant authorities and affected individuals in accordance with local laws:
Vietnam
Where a breach impacts data subject rights, national security, or public order, Cadena will notify the Ministry of Public Security (Cybersecurity Department – A05) within 72 hours of discovering the breach. Affected data subjects will be notified as required by law, particularly if sensitive data is compromised. If a force majeure event delays notification, it will be made as soon as reasonably possible, with Cadena retaining accountability for the delay.
Singapore
In accordance with the PDPA, if a breach is assessed as notifiable (i.e., it results in or is likely to result in significant harm to an individual, or is of a significant scale affecting 500 or more individuals), Cadena will notify the Personal Data Protection Commission (PDPC) within 3 calendar days (72 hours) of completing its assessment. Affected individuals will be notified concurrently or as soon as practicable if the breach poses a risk of significant harm.
Cross-Border Data Transfer
Because Cadena International Pte. Ltd. (Singapore) and Cadena Vietnam Co., Ltd. operate as a single corporate group, personal data processed through the Cadena HRM Series 5 and Annual Customer Support Services may be transferred across borders. This includes transfers for cloud hosting, backend infrastructure, or cross-entity support access.
Data Protection Officer
Questions about this Privacy Statement, or requests to access, correct, erase, or withdraw consent for your data, can be directed to our DPO.