Personal Data Policy
On this page
Data and purposes
Your email, message and optional name are used to receive, categorize and respond to your enquiry. The consent record includes the notice, version, language and time and is stored with the request as evidence of your choice. The form does not request identity documents, sensitive data or consent to advertising. Server logs and administrative authentication data are used separately for operation, access control and system protection.
Processing basis and choices
The contact form uses separate consent for responding to your enquiry, without a preselected checkbox or bundled marketing consent. You may decline and choose not to submit the form. Continuing to browse is not treated as consent to advertising or other optional purposes. Other processing may take place only on an appropriate legal basis and within the actual scope of the activity.
Recipients and use
Requests can be accessed by authorized personnel responsible for responding and administering the system. Assigned hosting/email providers may process information within their service scope. The website does not publish contact messages or use them to create a marketing list. If further processing is needed for a separate contract or service, the relevant scope and information must be addressed for that activity.
Retention and deletion
Contact requests and their consent records are retained in the website database for 90 days from successful submission. A daily task deletes expired requests; deletion occurs at the next scheduled run. Automatic notification emails contain no form contents. Emails you send directly, separately created service records, infrastructure logs and backups follow their respective operating procedures; necessary retention is reviewed when handling your request.
Backups are not used as an active contact database, and deletion requests must be reapplied after restoration.
Requested data exports
When processing a verified access or copy request, website tools may create a data file and send its download link to the verified email address. The link is difficult to guess, but anyone holding it may download the file while it remains available; do not forward or publish it. The file has a retention period of 3 days from creation and is deleted at the next cleanup run. An export contains data found by website tools; email, backups and other systems are reviewed separately if included in the request.
Exercising your rights
You may request information, access or provision of data; correction, deletion, restriction or objection; withdrawal of consent; and exercise complaints, proceedings and compensation rights under applicable rules. Email [email protected] with the email address you used and the right you wish to exercise. Verification must be proportionate, minimal and necessary to avoid disclosing or deleting another person's information.
Outcomes, requests for further information and legal limitations will be communicated in accordance with applicable requirements.
Submitting a request and verification
Email [email protected] with the subject “Personal data request”, the email address you used, the right you want to exercise and the scope of your request. If you write from a different address, explain how you can be contacted for appropriate verification. Do not send passwords, verification codes or copies of identity documents without a necessary and explained request. We review the request, verify your entitlement to the data to the extent necessary, and communicate the procedure and outcome through a verified channel.
Requests involving providers or separate service records are referred to the responsible personnel; entering an email address alone does not automatically disclose or delete data.
Time limits for personal data requests
Under Article 5 of Decree 356/2025/NĐ-CP, a request made through the proper procedure must receive a response and information about the procedure within 2 working days. The ordinary implementation limits are 10 days for viewing, correcting or obtaining data; 15 days for withdrawing consent, restricting or objecting to processing; and 20 days for deletion. Where processors or third parties must act, and where an extension is necessary, the corresponding conditions and limits in Article 5 apply.
An extension may be used only once where necessary, with reasons notified and its necessity substantiated. Applicable legal exceptions and limitations are explained when the request is handled and are not assumed to apply to every request.
Withdrawing consent
You may ask to withdraw consent for a contact request at [email protected]. Once verified, further processing based on that consent is stopped and deletion is handled to the extent permitted by law. Withdrawal does not invalidate processing lawfully carried out before withdrawal. Cookie choices can be changed separately through Cookie settings; this does not replace a request concerning form contents already submitted.
Protection and updates
Han Gia Group uses administrative access controls and technical measures appropriate to the system. No absolute promise is made that all risks can be eliminated. Do not provide another person's data without an appropriate basis. This policy is updated when website functions or processing change; consent for a new purpose is not inferred from an earlier choice.