PRIVACY POLICY

VITOSA Website

VITOSA respects privacy and only receives and processes personal data to the extent necessary to receive and respond to requests, provide information and documents, conduct business communications, and ensure the secure operation of the website. This Policy is intended to provide transparency about how data is processed and to safeguard the rights of data subjects under Vietnamese law.

01. Scope and data protection principles

This Privacy Policy applies to personal data provided or generated when accessing and using the VITOSA website, including when submitting contact forms, requesting catalogues or documents, discussing products, solutions, quotations, projects, and using other online functions provided by VITOSA.

VITOSA processes data for clear and appropriate purposes and only to the extent necessary; respects the rights of data subjects; applies appropriate safeguards; never buys or sells personal data; and does not use data for unlawful purposes.

Providing information through the website is voluntary unless otherwise required by law or by a specific transaction. Only information genuinely necessary for each function is designated as mandatory.

02. Data received and collection methods

Depending on the nature of an enquiry, VITOSA may receive basic personal data voluntarily provided by a data subject, such as full name, telephone number, email address, organisation, job title, and the content of the request.

Information about a business, facility, technical requirement, or project is treated as personal data only when it is associated with or can identify a specific individual.

VITOSA does not request sensitive personal data through ordinary contact forms. If processing such data is genuinely necessary in an exceptional case, VITOSA will provide the required notice and apply the corresponding safeguards in accordance with applicable law.

In addition to data voluntarily provided, the website infrastructure may record technical data necessary for delivery, security, and incident diagnosis, such as IP address, access time, browser type, or system logs, depending on the actual configuration. This data is not used to expand an individual profile beyond the stated purposes without an appropriate legal basis.

03. Purposes of data processing

VITOSA processes data to the extent necessary to:

1. Receive, verify where necessary, and respond to enquiries;
2. Send requested catalogues, technical documents, or information;
3. Discuss products, solutions, quotations, orders, or project requirements;
4. Maintain contact information for ongoing work with customers, partners, and relevant parties;
5. Operate, protect, and troubleshoot the website;
6. Fulfil legal obligations or lawful requests from competent state authorities.

Information submitted to request a document or discuss a specific matter is not automatically used for advertising, direct marketing, or another independent purpose without an appropriate legal basis.

04. Consent and legal basis for processing

Where consent is required by law, VITOSA processes data only after the data subject has been given the necessary information about the type of data, the purpose of processing, the data controller, and the relevant rights and obligations, and has expressed consent through a clear and verifiable method.

Consent is obtained separately for each appropriate purpose. VITOSA does not use preselected consent or present choices in a way that creates confusion between consent and refusal. Silence or failure to respond is not treated as consent.

Data subjects have the right to refuse or withdraw consent in accordance with applicable law. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal takes effect.

Where the law permits processing without consent, VITOSA performs such processing only within the scope and conditions prescribed by law.

05. VITOSA's rights and responsibilities

To the extent necessary for the purposes described in this Policy, VITOSA may receive, retain, use, amend, disclose, or appoint a data processor to carry out appropriate processing activities where a lawful basis exists.

VITOSA is responsible for clearly identifying processing purposes; limiting data to what is necessary; maintaining accuracy to an appropriate extent; applying safeguards; controlling access; and receiving and handling valid requests from data subjects within the time limits prescribed by law.

Before disclosing, correcting, deleting, or otherwise acting on personal data, VITOSA may request information necessary to verify the identity or authority of the person making the request. Verification is used solely to protect data and prevent unauthorised requests.

VITOSA may refuse or limit a request where permitted by law or where the request does not meet legal requirements. Where appropriate, VITOSA will provide a suitable explanation to the requester.

06. Sharing, transfer, and parties involved in processing

Data may be accessed only to the extent necessary by responsible VITOSA personnel or service providers involved in website operation, hosting, email, security, and related technical functions.

The use of a processor or the transfer of data does not alter the original processing purpose. VITOSA selects providers, assigns access rights, and imposes data protection requirements appropriate to their role, scope of work, and applicable law.

VITOSA does not sell personal data. Data is disclosed to another party only where a lawful basis exists, consent has been obtained where required, disclosure is necessary to fulfil an appropriate request or transaction, or a lawful request is made by a competent state authority.

If the infrastructure configuration or a service provider results in a cross-border transfer of personal data, VITOSA will fulfil the corresponding legal obligations under applicable law.

07. Data retention and protection

Data is retained for as long as necessary to fulfil the identified purpose, support an active communication or transaction, and comply with statutory retention obligations. VITOSA does not retain personal data longer than necessary without an appropriate basis.

When the processing purpose has been completed, the retention period has expired, or deletion or destruction is otherwise required by law, VITOSA deletes, destroys, or otherwise handles the data appropriately, unless continued retention is permitted or required by law.

VITOSA applies organisational and technical measures appropriate to the nature of the data and website operations to limit unauthorised access, misuse, loss, alteration, or disclosure. If a personal data incident occurs, VITOSA takes remedial action and fulfils applicable notification and reporting obligations.

08. Cookies, technical data, and measurement tools

The website may use cookies or similar technologies necessary for operation, security, session maintenance, or remembering technical preferences. Cookies that are not necessary for essential functions, analytics tools, or tracking technologies are deployed only in accordance with the actual configuration and applicable legal requirements.

Where a tool involves personal data processing and consent is required by law, the website provides appropriate information and choices before activating the relevant processing purpose.

VITOSA does not treat continued use of the website as blanket consent to all cookies or tracking activities. Specific information about the tools in use will be updated to reflect the website's actual configuration.

09. Rights and obligations of data subjects

Under Article 4 of the Personal Data Protection Law No. 91/2025/QH15, data subjects have the right to be informed about the processing of their data; to consent or refuse consent and request its withdrawal; to access, correct, or request correction; to request provision, deletion, or restriction of processing, or to object to processing; to lodge complaints or denunciations, initiate legal proceedings, claim compensation, and request protective measures in accordance with law.

Data subjects are also responsible for protecting their own data, respecting the data of others, and providing complete and accurate data where required by law, contract, or consent.

Requests to exercise these rights may be submitted to VITOSA through the contact point published on the website. VITOSA receives, verifies where necessary, and handles requests in accordance with the procedures, conditions, and time limits prescribed by law.

Data subject rights are exercised to the extent permitted by law and must not adversely affect the lawful rights and interests of another party or obligations that VITOSA must fulfil under law.

10. Transparency, policy updates, and contact

VITOSA maintains this Policy so that data subjects can understand in advance how information is received and used. If there is a material change to processing purposes, data categories, technology, or parties involved in processing, VITOSA will update the Policy and provide notice or obtain renewed consent where required by law.

The latest revision date appears at the end of this page. An update to this Policy does not alter the legal basis of processing performed before the update takes effect.

Questions, requests to exercise rights, or concerns relating to personal data may be submitted to VITOSA through the contact point published on the website. VITOSA receives such requests to support transparency, data protection, and convenient and secure business communications.

Last updated: 10/2026