MTK
VIEN
Book
Policy 1/4

Privacy & Data Protection Policy

We only collect the minimum data needed to hold your booking. We never sell your data and never collect card, ID or health information through the website.

  • Version 1.0
  • Effective: 25/10/2026
  • Legal check: 21/10/2026
Version history

Version 1.0

First release, effective 25/10/2026.

This English version is for reference. If there is any difference, the Vietnamese version prevails.

10-second summary

  • Name & phone only

    Plus your package, date/time and your own note.

  • No card, ID or health data

    The website never asks for these.

  • We never sell data

    Only the owner and reception see bookings.

  • Replies from 2 days

    Under Article 5, Decree 356/2025/ND-CP.

1.Data controller

The personal data controller is the following business (the "Business"):

Name
HỘ KINH DOANH MTK PRIVATE FITNESS
Type
Household business
Tax code / Business reg. no.
8525439916, issued 17/07/2025
Address
196-198 Do Ba Street, Ngu Hanh Son Ward, Ngu Hanh Son District, Da Nang
Phone / Zalo
0935 724 974

"Customer" means a person who books a service or contacts the Business via the website, Zalo or phone.

2.Data we collect and do not collect

Collected when you book online

  • Full name and phone number.
  • Email (optional) for confirmation.
  • Package or session, coach, date and time.
  • Any note you choose to add.

Never collected through the website

  • Bank card numbers, passwords, OTP codes.
  • ID card or passport numbers or images.
  • Health information.

3–4.Purposes and legal basis

Confirm and fulfil your booking
Contact you about your booking
Refunds and complaint handling
Legal and tax obligations

The Business does not use your data for any other purpose without your separate consent.

Legal basis & consent checkbox rules

  • We process the data in section 2 to perform the booking agreement with you, under Article 19(1) of the Personal Data Protection Law 2025.
  • The checkbox on the booking form confirms you have read this policy and the Booking Terms. It is never pre-ticked.
  • We only send promotions with your separate consent. Silence or no reply is not consent. You may withdraw consent at any time.

5.Retention period

  1. 1

    Booking data

    Kept from completion of the service until you ask us to delete it. On request, we delete or destroy the data within the time limits in section 7.

  2. 2

    Records required by law

    Data the law requires us to keep longer (payment records, contract data under the E-commerce Law 2025, tax records) is kept for the statutory period.

6.Who can access your data

Inside the Business

  • The owner.
  • Reception staff assigned to handle bookings.

Service providers (acting on our instructions)

  • Website hosting, domain and anti-spam: Cloudflare.
  • Booking database: Supabase; spreadsheet backup: Google; internal notification email: Resend.
  • Zalo messaging app to contact customers.
  • Our bank / payment provider, when you pay by card or QR at the counter.
  • Webiz, our website technical support, under a data processing agreement signed with the Business.
We never sell customer personal data

We only disclose data to state authorities when required by law.

Some providers host servers outside Vietnam.

7.Your rights and response times

Be informed

about the processing.

Consent / withdraw

give, refuse or withdraw consent.

Access & correct

view and correct your data.

Copy, delete, restrict

request a copy, deletion or restriction.

Object

object to the processing.

Complain & sue

and claim damages under the law.

Send requests by phone / Zalo 0935 724 974. Requests to withdraw consent or restrict processing must be sent by message or email so there is a written record.

  1. 02working days

    Acknowledge your request

  2. 10days

    Access, correct, provide data

  3. 15days

    Withdraw, restrict, object

  4. 20days

    Delete data

Time limits under Article 5, Decree 356/2025/ND-CP. If more time is needed, we will tell you why and extend once as permitted.

8–9.Security measures and incident response

Encrypted HTTPS connection

Across the whole website.

Restricted admin access

Only the owner account can sign in to the booking admin, with its own password.

Brute-force & bot protection

Auto-lock after repeated wrong passwords; Cloudflare Turnstile and rate limits on forms.

No card data stored

The website neither collects nor stores card numbers.

These measures reduce but cannot fully eliminate the risk of data exposure.

  1. 1
    Contain & assess

    Stop the incident and assess its impact.

  2. 272 HOURS
    Notify the authority

    If it may harm customers (Article 23, PDP Law 2025).

  3. 3
    Inform customers

    Notify those affected and explain how to protect themselves.

10–11.Contact, effect and changes

Personal data contact

For any question or complaint about personal data, call or message us on Zalo.

0935 724 974 Zalo

This policy applies from 25/10/2026. When it changes, we publish the new version on the website with its effective date. Bookings made before that date follow the version in force when they were made.

Template drafted by Webiz for reference; not a substitute for legal advice. Version 1.0, legal basis checked on 21/10/2026.