Privacy Policy

PRIVACY POLICY - VIETNAM.TRAVEL

Last Updated: 2026

Welcome to Vietnam.travel, the official tourism portal of Vietnam. We are committed to protecting your privacy, ensuring the confidentiality of your personal information, and maintaining full transparency in how we collect, process, and safeguard your data.

This Privacy Policy applies to all visitors, users, and foreign travelers accessing our website ( vietnam.travel), mobile applications, and online tourism services (collectively, the "Platform").

1. LEGAL COMPLIANCE & FRAMEWORK

Our data processing activities are strictly conducted in compliance with applicable national and international privacy legal frameworks, including:

Vietnam Regulations:
- Law on Personal Data Protection (Law No. 91/2025/QH15).
- Decree No. 356/2025/NĐ-CP detailing the implementation of the Law on Personal Data Protection (replacing Decree 13/2023/NĐ-CP).
- Law on Cybersecurity (Law No. 24/2018/QH14), Law on Information Technology, and Law on Protection of Consumers' Rights.
International Standards: Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), California Consumer Privacy Act (CCPA/CPRA), and ePrivacy Directive.

2. TYPES OF DATA WE COLLECT

We categorize collected data into Basic Personal Data and Sensitive Personal Data in accordance with Decree No. 356/2025/NĐ-CP:

A. Basic Personal Data

Identity & Contact Details: Full name, date of birth, nationality, email address, phone number, passport number, and primary language preference.
Technical & Usage Identifiers: IP address, browser type and version, operating system, device identifiers, time zone setting, clickstream data, and interaction with interactive destination maps.

B. Sensitive Personal Data (Processed with Explicit High-Level Consent)

Precise Location Data: Real-time GPS location data when utilizing location-based destination guides or emergency medical assistance services.
Health/Access Requirements (Optional): Special medical or accessibility requirements voluntarily provided when requesting tailored travel support.

3. PURPOSES & LEGAL BASIS OF DATA PROCESSING

A. Purposes

Service Provision: Delivering destination guides, travel updates, e-Visa information, and interactive portal tools.
Personalization & Experience Enhancement: Tailoring travel recommendations, itinerary suggestions, and language settings to your preferences.
AI & Virtual Tourism Services: Utilizing automated systems to provide automated travel assistance while maintaining algorithmic transparency.
Communication & Emergency Support: Responding to inquiries, sending official travel advisories, and coordinating emergency medical/safety assistance.
Security & Regulatory Compliance: Preventing fraudulent activities, fulfilling Transfer Impact Assessments (TIA), and complying with statutory obligations.

B. Consent Mechanisms

Explicit Opt-In: Processing relies on voluntary, explicit, and unbundled consent for specified purposes. Inaction, silence, or pre-ticked check-boxes are never deemed as consent.
Sensitive Data Notification: Prior to processing sensitive personal data, users are explicitly informed of the sensitive nature of such data as mandated by Decree 356/2025/NĐ-CP.

4. COOKIES & TRACKING TECHNOLOGIES

We use cookies, web beacons, and analytical tags to distinguish you from other users and enhance your browsing experience.

Essential Cookies: Necessary for basic website functions, security, and network management.
Performance & Analytics Cookies: (e.g., Google Analytics) Help us measure traffic patterns, popular destinations, and site performance.
Functional Cookies: Remember your settings (e.g., selected language, interactive map filters).

Cookie Management: Upon your first visit, a Cookie Consent Banner allows you to accept, decline, or customize non-essential cookies. You can also modify your cookie preferences through your browser settings at any time.

5. EMERGING TECHNOLOGIES (AI & METAVERSE VISITATION)

In accordance with Article 10 of Decree No. 356/2025/NĐ-CP:

Algorithmic Transparency: Where automated algorithms or AI-driven recommendations are used, users are informed of automated data processing, the general principles of the algorithms, and their impact.
Inference Data Protection: Any user profile inferences generated by AI that can identify a specific individual are protected under standard personal data rules.
User Control over Digital Footprints: Users retain full rights to edit, obscure, or request erasure of their digital interaction logs and historical profile data across our virtual/AR/VR environments.

6. DATA SHARING & CROSS-BORDER TRANSFERS

A. Data Sharing

We do NOT sell, rent, or trade your personal data. Data may be shared only with:

Authorized Service Providers: Cloud infrastructure, email distribution platforms, and technical analytics providers operating under strict Data Processing Agreements (DPA).
Government Authorities: Ministry of Culture, Sports and Tourism, Ministry of Public Security (Department of Cybersecurity and Hi-Tech Crime Prevention - A05), or law enforcement agencies when mandated by law.

B. Cross-Border Data Transfers

Transfers of personal data outside Vietnam strictly adhere to the Law on Personal Data Protection 2025 and Decree No. 356/2025/NĐ-CP:

Impact Assessments: Cross-border transfer impact assessment dossiers (Form No. 09) are maintained, updated, and filed with the competent authority (A05).
International Transfer Safeguards: Standard Contractual Clauses (SCCs) are executed for data transfers involving EU/EEA residents under GDPR.

7. DATA RETENTION, INCIDENT RESPONSE & SECURITY

A. Retention & Disposal

Data is retained only as long as necessary to fulfill the stated processing purposes or satisfy legal requirements. Upon expiration, data is securely erased, destroyed, or irreversibly anonymized using certified deletion protocols.

B. Breach & Incident Notification

In the event of a personal data breach or security incident:

The competent data protection authority (A05 - Ministry of Public Security) will be notified within 72 hours of discovery.
Affected data subjects will be notified without undue delay, outlining potential risks and remedial measures taken.

8. YOUR LEGAL RIGHTS AS A DATA SUBJECT

Under the Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), Decree 356/2025/NĐ-CP, and international regulations (GDPR/CCPA), you hold the following rights:

Right to be Informed: Clear, transparent notice of data processing before collection.
Right to Consent & Withdraw Consent: Freedom to grant, refuse, or revoke processing authorization.
Right to Access & Rectification: Inspect, request electronic copies, or correct inaccurate personal data.
Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your data.
Right to Restriction of Processing: Request temporary limitation of data processing.
Right to Object: Object to processing for direct marketing, profiling, or analytical purposes.
Right to Data Portability: Obtain your data in a structured, standard electronic format.
Right to File Complaints & Seek Remedies: File formal complaints with regulatory bodies or seek legal redress for privacy violations.

Response Timeframe: Upon receiving a valid data subject request, we will respond and take action within 02 working days (or as mandated by applicable regulatory timeframes).

9. PROTECTION OF MINORS

Our Platform is not directed at children under 16 years of age. We do not knowingly process personal data of minors without verifiable consent from a parent or legal guardian. If we discover unauthorized collection of a minor's data, it will be deleted immediately.

10. CONTACT US & DATA COMPLIANCE

If you have questions, concerns, or wish to exercise your data subject rights, please contact our Data Protection Team:

Entity: Vietnam National Authority of Tourism / Portal Management Team
Data Protection Division: Legal & Compliance Department
Official Website: [https://vietnam.travel](https://vietnam.travel)
Email: privacy@vietnam.travel / info@vietnam.travel
Address: Hanoi, Vietnam.