Privacy

Scope and Data Controller

This policy applies to all visitors, clients, and partners accessing this website or communicating with THIEN AN. CÔNG TY TNHH DỊCH VỤ KỸ THUẬT THIÊN AN OFFSHORE (located at 13 Binh Quy Street, Rach Dua Ward, Ho Chi Minh City, Viet Nam) acts as the Data Controller and Data Processor for all personal information collected through this platform.

Categories of personal data

We collect basic personal and business contact details including your full name, business email address, company name, telephone number, service area of interest, and the specific details of your project enquiry. Technical access logs (including IP address, browser user-agent, operating system, and timestamp data) are collected automatically for system operations. We do not solicit, require, or knowingly collect sensitive personal data (such as financial account details, health records, or personal biometric data); please do not transmit sensitive personal data through our website forms.

• Contact & business identity: Full name, business email address, company name, telephone number, and service area of interest.
• Project enquiry scope: Technical specifications, project descriptions, and optional enquiry attachments.
• Technical operational logs: IP address, browser user-agent, operating system, and timestamp data.
• Excluded sensitive data: Financial account numbers, health information, and personal biometrics are not collected.

Purposes and lawful basis

Your personal data is processed strictly for defined, legitimate purposes: responding to commercial and technical enquiries, preparing service proposals, coordinating engineering and project resource alignment, ensuring website integrity, preventing spam, and fulfilling statutory record-keeping obligations. Processing is conducted based on your affirmative, voluntary consent upon form submission, our legitimate commercial interests in B2B project coordination, and the legal grounds established under Decree No. 13/2023/ND-CP.

• Responding to commercial, engineering, and marine service enquiries.
• Preparing technical proposals and coordinating specialist project resource alignment.
• Maintaining website security, anti-bot verification, and spam prevention.
• Fulfilling statutory corporate record-keeping and administrative requirements.

Processing methods and retention

Processing operations include the collection, recording, digital organization, storage, retrieval, utilization, secure transfer, and deletion of data. Business enquiry records are retained only for the duration necessary to satisfy the commercial purpose of the enquiry, manage ongoing business relationships, or meet statutory administrative and accounting requirements. Upon expiry of the retention purpose or upon receipt of a valid erasure request, records are securely deleted or irreversibly anonymised.

Data sharing and cross-border transfers

THIEN AN does not sell, rent, or trade your personal information to third parties for independent commercial marketing. Information is accessed exclusively by authorized personnel on a strict need-to-know basis and trusted technical infrastructure providers supporting website hosting, edge security, and email dispatch under binding confidentiality and data protection terms. Transmission across global cloud networks (such as Cloudflare and enterprise mail systems) complies with statutory cross-border data transfer safeguards pursuant to Article 25 of Decree 13/2023/ND-CP.

Technical and organisational security

We enforce multi-layered security controls to protect personal data against unauthorized access, loss, alteration, or unlawful processing. Measures include Transport Layer Security (TLS/HTTPS) encryption for all data in transit, automated web application firewall and anti-bot rate limiting, access segmentation, and administrative safeguards. In the event of a verified data breach, THIEN AN will execute immediate containment protocols, notify the competent authorities (including the Department of Cybersecurity and High-Tech Crime Prevention - A05, Ministry of Public Security) within 72 hours where required, and inform affected individuals as required by law.

Your statutory data subject rights

Pursuant to Article 9 of Decree No. 13/2023/ND-CP, you have specific rights regarding your personal data: (1) Right to be informed of all processing activities; (2) Right to provide or decline consent; (3) Right to access, review, and request correction or copies of your data; (4) Right to withdraw consent at any time; (5) Right to request deletion of your personal data; (6) Right to request restriction of processing; (7) Right to receive personal data (data portability); (8) Right to object to processing; (9) Right to lodge complaints, denouncements, or initiate legal proceedings; (10) Right to claim compensation for lawful damages; and (11) Right to self-protection under law. To exercise any of these rights, contact us at quocan.vmu@gmail.com; valid requests will be addressed within 72 business hours.

• Right to be informed of processing activities, categories, and purposes.
• Right to provide, decline, or withdraw consent at any time.
• Right to access, review, and request correction or copies of your personal data.
• Right to request deletion or restriction of processing.
• Right to receive your data (data portability) and right to object to processing.
• Right to lodge complaints, denouncements, or claim lawful damages.

Obligations of data subjects

In accordance with Article 10 of Decree 13/2023/ND-CP, data subjects are obligated to protect their own personal information, provide accurate and complete information when consenting to processing, and refrain from providing personal data belonging to third parties without prior lawful authorization.

Cookies and technical tracking

This website employs only essential technical and session cookies strictly required for secure navigation, session integrity, and anti-spam verification. We do not use third-party behavioral profiling, advertising trackers, or cross-site tracking cookies.

• Essential session cookies: Route navigation, language preference, and session integrity.
• Security & verification: Automated anti-spam and request rate-limiting tokens.
• No third-party tracking: No behavioral profiling, advertising trackers, or external marketing cookies.

Privacy contact and policy updates

We review and update this Privacy Policy periodically to maintain compliance with evolving regulations and operational procedures. Revisions will be published on this page with the latest effective date. For any privacy requests, questions, or data protection matters, please use the privacy contact shown below.