Privacy Policy & Personal Data Protection

2. Information We Collect

We collect 5 main data categories:

• A.
  Account information — full name, email, phone number, company, tax ID, shipping address, password (bcrypt hashed).
• B.
  Transaction information — RFQ, orders, favorite products, payment history (status only, no card numbers — handled by payment processor), tracking number, dispute history.
• C.
  Device & log information — IP address, user agent, OS, browser, language, access time, pages visited (stored 90 days for analytics + security audit).
• D.
  Communication content — chat with supplier on platform, video call transcript (only saved when user confirms), emails sent through system, comments on reviews.
• E.
  Third-party information — when logging in via Google/Apple/Facebook, Huayue receives: email, name, avatar (only fields you consent to share via OAuth consent screen). We do NOT collect: national ID/passport (unless KYC required for transactions ≥$10K), biometric data, medical data, religion, political views (as defined as 'sensitive personal data' under Article 2.4 of Decree 13/2023).

3. Purpose & Legal Basis for Processing

Huayue processes data based on 4 legal bases under Article 11 of Decree 13/2023:

• 1.
  Consent — you check 'I agree' when registering, you can withdraw at any time.
• 2.
  Contract performance — processing necessary to provide agreed B2B services (RFQ, ordering, shipping, after-sales).
• 3.
  Legal obligation — storing tax documents for 10 years per Vietnam Tax Management Law, storing e-invoices per Decree 123/2020/ND-CP.
• 4.
  Legitimate interest — fraud prevention, system security, product improvement (only when not infringing your fundamental rights). Specific purposes: provide & personalize services, connect Buyer–Supplier, process payment & shipping, send transaction notifications, prevent fraud/abuse, improve products through aggregate data analysis, marketing (only with Buyer opt-in), comply with laws + authorities' requests.

4. Cookies & Tracking Technologies

Huayuesc uses 4 cookie categories with a clear policy and cookie management table at /info/quan-ly-cookies:

• a.
  Essential cookies — maintain login, RFQ cart, language, no consent required per Article 6 of Decree 13/2023 (necessary for service). Examples: csr_session, csr_locale, csr_csrf.
• b.
  Analytical cookies — Google Analytics 4 (anonymized IP), Hotjar session replay (mask sensitive fields), Mixpanel funnel. Require opt-in. Stored 24 months.
• c.
  Marketing cookies — Facebook Pixel, Google Ads, LinkedIn Insight, TikTok Pixel. Require opt-in. Stored 12 months.
• d.
  NCC partner cookies — only activated when you click on a Supplier's product page (per partner). Cookie consent banner appears on first visit, with 3 choices: Accept All / Essential Only / Customize. You can change choice anytime at /buyer-center/settings/privacy.

5. Sharing with Third Parties

Huayue shares data with 5 third-party groups, each with a Data Processing Agreement (DPA) binding compliance with Decree 13/2023 + GDPR-equivalent:

• 1.
  Suppliers/NCC — only share minimum information necessary to complete the order (contact person name, company, shipping address, requested SKU); do NOT share direct email/phone — all communication goes through Huayue's relay.
• 2.
  Partner banks in Vietnam and China for Escrow Service; payment processors for international payments — they only see minimum information to process transactions + comply with KYC.
• 3.
  Logistics partners + customs brokers at Hai Phong port — share shipping address + tracking number + customs declaration content.
• 4.
  Service providers — AWS Singapore (hosting), Cloudflare (CDN, anti-DDoS), Twilio (SMS OTP), SendGrid (transactional email), Sentry (error tracking, scrubs PII).
• 5.
  Government authorities — only upon lawful written request (search warrant, prosecution document), Huayue publishes an annual Transparency Report on the number of requests received. We NEVER sell data to data brokers or third parties for marketing.

6. Cross-Border Data Transfer VN–CN

Huayue operates cross-border between Vietnam and China: Vietnamese Buyer data may be transferred to the Guangzhou sourcing office for Huayue team to assist with sourcing, factory audits, inspection, and dispute handling. Cross-border data transfer is protected by 3 layers:

• i.
  Standard Contractual Clauses (SCCs) — internal document between Hanoi headquarters and Guangzhou representative office of HUAYUE VIETNAM SUPPLY CHAIN COMPANY LIMITED, compliant with the reference template of Vietnam's Ministry of Justice.
• ii.
  Encryption-in-transit — all VN↔CN traffic via TLS 1.3, certificate pinning, non-interceptable.
• iii.
  Cross-border data transfer registration with the Authority of Information Security under Article 25 of Decree 13/2023 — Huayue is completing the registration process. You have the right to request Huayue NOT to transfer data to China — we will respect it but may limit on-site factory audit services (performed by the Guangzhou team).

7. Data Storage & Lifecycle

Personal data lifecycle at Huayue follows the 'minimum necessary' principle:

• a.
  Active account — stored continuously, updated on your request.
• b.
  Inactive account for ≥18 months — send warning email + auto-delete if no response within following 90 days.
• c.
  Completed orders — store details for 7 years per Vietnamese tax obligations, then anonymize.
• d.
  Transaction documents + invoices — stored 10 years per Tax Management Law.
• e.
  Communication logs (chat, email) — stored 24 months for dispute resolution, then permanently deleted.
• f.
  Server logs — 90 days, then aggregated into analytics reports (no PII).
• g.
  Cookies — per time-to-live stated in Section 4. When you request account deletion (right under Section 9), Huayue performs hard-delete within 30 days + confirmation via email + provides 'Certificate of Erasure' upon request (for businesses needing audit trail).

8. Technical & Organizational Security Measures

Technical security measures:

• 1.
  Transmission encryption — TLS 1.3 with forward secrecy, HSTS preload, certificate transparency monitoring.
• 2.
  Storage encryption — AES-256-GCM for database at rest, key management via AWS KMS with 90-day key rotation.
• 3.
  Password hashing — bcrypt with work factor 12 + per-user salt + pepper.
• 4.
  Intrusion detection — Cloudflare WAF layer 7, AI anomaly detection for login patterns, automatic rate limiting to block brute-force.
• 5.
  Internal access control — principle of least privilege, role-based access control (RBAC), mandatory 2FA for all Huayue employees with production access.
• 6.
  Audit logging — every data access logged with timestamp, IP, user, action; logs stored on write-once system for 12 months.
• 7.
  Penetration testing — 2 times/year by independent security partner.
• 8.
  Bug bounty program — report vulnerabilities to mcy@huayuesc.com + bounty $100-5,000 depending on severity. Organizational measures: Huayue employees sign NDA + attend security training quarterly; data centers AWS Singapore + Vietnam certified ISO 27001; incident response process with RTO 4h, RPO 1h; automatic hourly backup + daily offsite backup.

9. 11 Rights under Decree 13/2023

Under Articles 9–22 of Decree 13/2023, you have 11 basic rights regarding your personal data:

• 1.
  Right to be informed — know what data is collected, purpose, retention period.
• 2.
  Right to consent — approve or refuse processing.
• 3.
  Right to access — request to view your data (export JSON/CSV file within 30 days).
• 4.
  Right to withdraw consent — at any time, no explanation needed.
• 5.
  Right to erasure — 'right to erasure', delete account + all data within 30 days (except records required by tax law).
• 6.
  Right to restrict processing — request Huayue to temporarily stop processing data while resolving a complaint.
• 7.
  Right to data portability — request transfer of data to another provider (data portability).
• 8.
  Right to object — object to processing for marketing, profiling purposes.
• 9.
  Right to complain — file a complaint with the Authority of Information Security (Ministry of Information and Communications) or with us.
• 10.
  Right to claim damages — if Huayue's violation causes damage.
• 11.
  Right to self-protection — implement data protection measures yourself (change password, enable 2FA, opt-out cookies). To exercise any right, send email to mcy@huayuesc.com — response within 7 business days, processing completed within 30 days.

10. Protection of Children Under 16

Huayuesc is a B2B platform for businesses, NOT intended for children under 16. When registering, users must confirm they are at least 18 years old (or the age of majority under the law of their country of residence). If a child's account is detected, Huayue will immediately disable it and delete all data within 7 days. Parents who discover their child has created an account can contact mcy@huayuesc.com — we will verify and prioritize deletion at no charge.

11. Data Incidents & Notification Procedure

Data Breach Response Plan complying with Article 23 of Decree 13/2023: (Step 1) Detection — 24/7 Security team monitors 365/365, or receives report from Bug Bounty / employees / partners. (Step 2) Containment — within 4 hours, identify scope, stop leak, lock affected systems. (Step 3) Assessment — security forensic determines how many users affected, what data, severity level. (Step 4) Notify authorities — within 72 hours of detection, send report to the Authority of Information Security (Ministry of Information and Communications) using standard template. (Step 5) Notify users — send email/SMS to all affected users within 72 hours, describing incident + exposed data + remediation measures + recommendations (change password, enable 2FA, monitor account). (Step 6) Remediation — fix vulnerability, audit entire system, make post-mortem report public within 30 days. (Step 7) Compensation — if user proves direct damages, Huayue has a transparent compensation policy.

12. Policy Updates & DPO Contact

This policy is reviewed by Huayue at least once a year and updated when there are changes in law, technology, or services. The current version is v1.0, effective January 1, 2026. Previous versions are archived at /info/privacy-policy/lich-su for reference. When material changes occur (affecting user rights), Huayue will notify via:

• a.
  Email to all active users at least 30 days before implementation.
• b.
  Banner displayed on website/app for 60 days.
• c.
  Request user re-consent if processing purpose changes. Contact DPO (Data Protection Officer): Email mcy@huayuesc.com (response <72h), hotline 000-000-000 (business hours), postal mail 'DPO — Huayue Supply Chain Vietnam Company Limited', Ecolife Building, 58 To Huu, Dai Mo Ward, Nam Tu Liem District, Hanoi City, Vietnam. Competent authority for independent complaints: Authority of Information Security (Ministry of Information and Communications), 18 Nguyen Du, Hanoi — website ais.gov.vn.