Privacy Policy

1. Introduction and Data Controller

This Privacy Policy applies to Vinh Phat, a business consulting firm operating from 45 Pham Ngu Lao Street, District 1, Ho Chi Minh City 700000, Vietnam. For questions regarding your data, please contact us at [email protected] or by telephone at +84 28 3618 4972.

We act as the data controller for personal information collected through our website and during the course of our consulting engagements. This policy covers data collected via our website contact forms, email correspondence, and telephone interactions.

We process personal data in accordance with the Law on Cybersecurity 2018 (No. 24/2018/QH14), Decree 13/2023/ND-CP on Personal Data Protection, and other applicable Vietnamese regulations.

2. Personal Data We Collect

We collect only the information that is necessary to respond to your enquiry or to deliver our consulting services. This includes:

• Contact details: Full name, email address, telephone number, and company name (where provided).
• Enquiry content: The message or description of business challenge you share through our contact form or by email.
• Technical data: IP address, browser type, device type, pages visited, and session duration — collected automatically through cookies and analytics tools.
• Communication records: Records of email exchanges and telephone conversations where relevant to a consulting engagement.

We do not collect sensitive personal data such as government identity numbers, financial account details, or health information through our website.

How We Collect Data

• Directly from you via the contact form on our website
• Through email or telephone communication you initiate
• Automatically via cookies and analytics tools when you browse our website
• Through referral from third-party platforms if you arrive via a linked advertisement

Legal Basis for Processing

• Consent: For marketing communications and non-essential cookies, where you have given explicit agreement.
• Legitimate interest: For website analytics that help us improve the quality of our content and services.
• Contractual necessity: For data required to deliver an agreed consulting engagement.
• Legal compliance: Where retention is required by Vietnamese tax, commercial, or regulatory law.

3. How We Use Your Data

Your personal data is used for the following purposes:

• Responding to enquiries submitted through our contact form or by email
• Preparing and delivering consulting proposals and engagement reports
• Communicating updates relevant to an active consulting engagement
• Sending occasional service-related information where you have consented
• Improving website content and user experience through aggregate analytics
• Complying with legal obligations under Vietnamese law

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

Data Retention

Enquiry data is retained for up to 24 months from the date of last contact. Data associated with a completed consulting engagement is retained for seven years to satisfy Vietnamese commercial record-keeping requirements, after which it is securely deleted. Analytics data is retained in aggregate form and is not linked to individual identifiers after 26 months.

4. Third-Party Services and Data Sharing

We use a limited set of third-party services to operate our website and measure its performance. Each service receives only the data necessary for its function:

• Google Analytics (Google LLC): Collects anonymised usage data such as pages visited and session duration. Data may be processed on servers outside Vietnam under Google's standard contractual clauses.
• Facebook Pixel (Meta Platforms, Inc.): Measures ad performance and may record page visit events. Activated only when you accept marketing cookies.
• Microsoft Bing Universal Event Tracking (Microsoft Corporation): Tracks ad-related conversions. Activated only when marketing cookies are accepted.

We may disclose your data to competent Vietnamese authorities where required by law, court order, or regulatory request. We will notify you of such disclosures where legally permitted to do so.

Sub-contractors engaged on a specific consulting project may receive anonymised or aggregated data only; individual contact details are not shared with sub-contractors without your prior knowledge.

5. Data Protection Measures

• All data in transit is encrypted using TLS (HTTPS) across our website and email systems.
• Access to client data is restricted to consultants directly involved in the relevant engagement.
• Internal systems are password-protected and access logs are reviewed periodically.
• Physical documents containing personal data are stored in locked premises at our Ho Chi Minh City office.
• In the event of a data breach that poses a significant risk to individuals, we will notify affected parties and the competent Vietnamese authority within the timeframe required by applicable law.

6. Cookies

Our website uses cookies to support basic functionality and to collect anonymised analytics data. Cookies are small text files stored in your browser. You may manage your cookie preferences at any time through our Cookie Policy page, which includes category-level controls.

Essential cookies are always active as they are necessary for the website to function. All other cookie categories — analytics, marketing, and preferences — require your consent before they are activated.

7. Your Rights

Under Vietnamese data protection law, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you believe your rights have not been upheld, you may lodge a complaint with the Ministry of Information and Communications or the relevant Vietnamese supervisory authority.

8. Children's Privacy

Our consulting services are directed exclusively at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data through our website, please contact us and we will delete it promptly.

9. External Links

Our website may contain links to external resources, research publications, or government portals. Once you leave our website, this Privacy Policy no longer applies. We encourage you to review the privacy policies of any external sites you visit.

10. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. Continued use of our website after an update constitutes acknowledgement of the revised policy.

11. Contact for Privacy Enquiries