Privacy policy

• When you register a candidate account: full name, gender, date of birth, phone number, address, email and professional role.
• When you register an employer account: the contact person's name, the name of the clinic / dental lab / company, phone number, address and email.
• Passwords are only stored as a one-way hash (scrypt): nobody can read your password, not even administrators.
• When you use the service: your professional profile, CVs (PDF files and CVs built on Smile Work), a portrait photo if you upload one, job postings, applications and saved jobs.
• Access information when you register and log in: time, IP address, browser and device; see the Access information section for details.
• The interface language you choose; see the Languages and machine translation section.

To protect your account, Smile Work records some technical information each time you register and log in. You agree to this when you register (by ticking the consent box) and each time you log in.

What is recorded

• Login history: the time, IP address and browser identification string (User-Agent: browser name and version, operating system, device type) of each successful login.
• Attempt log: the email entered, IP address, time and result of each registration, login (including wrong passwords), verification email resend and password reset request.
• With your account: the time of your latest login; the versions of the Terms of use and Privacy policy and the time you agreed to them when registering.
• The login session cookie keeps you logged in for up to 7 days. The server only stores a hash of the cookie, not the cookie itself.
• For administrator accounts: every administrative action is written to an audit log (who did what, to which content, and when); this log cannot be edited or deleted.
• Our infrastructure provider's servers automatically record IP addresses and paths of visits for a short time, for operations and protection against attacks.

Smile Work does not collect GPS location, contacts or other data on your device, and does not use advertising cookies or third-party trackers.

What it is used for

• Detecting and blocking password guessing and fake account creation.
• Helping you check which devices have logged in to your account.
• Investigating when an account shows signs of being taken over, or when there is a complaint about it.
• Providing it to competent state authorities when they request it in accordance with the law.

Who can see it

• You, on the Login history page (in the account menu).
• Smile Work administrators, only when they need to help you or investigate unusual access. Editors cannot see it.
• Employers, candidates and other users can never see this information.

How long it is kept

• Login history: deleted automatically after 90 days.
• Attempt log: deleted automatically after 7 days.
• When an account is deleted, its login history and attempt log are deleted with it.

This information is needed to protect accounts, so it cannot be switched off separately. If you do not agree, you can stop using the service and ask for your account to be deleted (see Storage and deletion).

• To create, verify and protect your account.
• To connect candidates with employers: showing your profile exactly as you choose and passing your application to the employer of the job you applied for.
• To send emails your account needs, such as verification emails and password reset links. Smile Work does not send advertising without your consent.
• To review job postings and public profiles, keeping the hiring environment trustworthy.

• By default, a candidate's phone number, email, address, date of birth, gender and CV are not shown to employers.
• On your Profile page, you choose each item that is shown while your profile is public, and you can change this at any time.
• When you apply for a job, your name, email, phone number and the CV you choose are sent only to the employer of that job for assessment.
• The employer's organisation name, location and job content are shown publicly on approved job postings.

• The language you choose (Vietnamese, English or Chinese) is remembered with a cookie for 1 year, and saved with your account so that emails from Smile Work use the same language.
• When pages are shown in English or Chinese, public content written in Vietnamese (job postings, Career guide articles, the website's introductory content, category names) is sent to Google Cloud Translation to be translated. Only that text is sent, with no information about you or the person viewing; translations are stored on Smile Work's servers for reuse.
• Candidate profiles, CVs, applications, messages and contact details are never sent for translation.

• Smile Work does not sell, rent or share your personal data with third parties for any commercial purpose.
• Data is only provided when competent state authorities request it in accordance with the law.
• Infrastructure providers (servers, email delivery, machine translation) only process data on Smile Work's instructions and are bound by equivalent confidentiality obligations.

• Connections to the website are encrypted (HTTPS); the login session cookie cannot be read by JavaScript (HttpOnly).
• CV files and photos can only be downloaded after a permission check: by you, administrators, the employer of a job you applied for, or employers viewing your public profile when you allow your CV to be shown.
• Limits on wrong logins and on registrations from the same network protect against password guessing and fake accounts.
• Password reset links are only sent to the registered email, work once, expire after 1 hour and only work when the account's email is entered correctly (after 5 wrong attempts the link is cancelled).
• Administrators only access data when needed for content review and user support.

• Data is kept while your account is active; access information has its own retention periods (see Access information).
• You can edit your personal information, change visibility settings and delete CVs at any time on your Profile page.
• To delete your account, send a request to smilework@clab.vn from your registered email. When an account is deleted, its personal information, profile, CVs, photo and login history are deleted and every device is logged out; applications already sent have their contact details and attached CVs removed, and job postings are closed.

Under the Law on Personal Data Protection (No. 91/2025/QH15) and Decree 356/2025/ND-CP, you have the right to be informed about the processing of your personal data; to give or withdraw consent; to access, correct and request deletion of your data; to request restriction of or object to processing; and to lodge complaints in accordance with the law. Contact smilework@clab.vn to exercise these rights.

Smile Work only uses two essential cookies: the login session cookie and a cookie that remembers the language you choose. We do not use advertising cookies or third-party trackers.

When there are important changes, Smile Work announces them on the website before they apply. The effective date of the current version is shown at the top of the page.