Privacy policy

1. Scope

This policy covers personal data of website visitors, customers ordering on tranhungthinhphat.com, people submitting a contact/consultation request, and affiliates registering at /tiep-thi. It does not cover the company's internal staff data.

2. Personal data we collect

• When placing an order or a consultation request: full name, phone number, email, delivery address, and the content of your request/note.
• Automatically while browsing: traffic source (utm_source/medium/campaign), referrer, and affiliate referral codes (?ref=, ?lid=) — kept in a cookie for up to 30 days to attribute orders to a source, never used to identify you beyond that purpose.
• When registering as an affiliate: email, password, bank details for commission payout, ID card number and two ID photos (stored privately, viewable only by admin staff to verify identity before payout).
• Payment: bank transfer/QR payments happen inside your own banking app or VNPAY's gateway — we never collect or store card numbers or banking passwords.

3. Why we process this data

• Processing, confirming, and delivering orders; contacting you to clarify order details when needed.
• Customer care, answering consultation requests, handling complaints/returns.
• Attributing orders to their source and calculating affiliate commissions accurately.
• Sending order confirmations, delivery status updates, and — with consent — promotional information.
• Complying with legal obligations on accounting, invoicing, and e-commerce.

4. Sharing data with third parties

We do not sell, rent, or trade customer personal data for commercial purposes. Data is shared only to the minimum extent necessary with:

• Shipping carriers (ViettelPost, or our own delivery) — name, phone, delivery address, to deliver the order.
• The VNPAY payment gateway — only the order code and amount, to confirm payment; VNPAY processes it under its own privacy policy.
• Google (Google Analytics, and Google Ads / Google Merchant Center if we run ads) — browsing data (pages viewed, products viewed/added to cart, order value, transaction ID) tied to a browser identifier; no name, phone number or address is sent in analytics data. For advertising, only if you consent to advertising cookies.
• Meta (Facebook/Instagram) and TikTok — only if you consent to advertising cookies: product view, add-to-cart and purchase events plus ad-click identifiers, to measure ads and show relevant ones.
• Competent state authorities, when lawfully required to do so.
• Note: these analytics/advertising services run on servers abroad, so the minimal data above may leave Vietnam; we only transfer it once you have agreed (for advertising cookies) or as non-directly-identifying analytics data.

5. Retention and security

Order data is kept as long as needed for the transaction, accounting, and complaint resolution (at minimum the legally required accounting-record retention period), then deleted or anonymized once no longer required. Data lives on access-controlled servers with encrypted (scrypt) passwords and role-based staff permissions; affiliate ID photos are stored in a private area with no public access.

6. Your rights over your personal data

Under the Personal Data Protection Law, you have the right to:

• Know how your personal data is being processed.
• Give or refuse consent to processing, except where the law provides otherwise.
• Access, view, and correct your stored personal data.
• Withdraw consent previously given.
• Request deletion of your personal data, except where the law requires it to be kept.
• File a complaint, report, or lawsuit under the law if your rights are violated.

7. How to exercise these rights

Send a request through the Contact page form, hotline 0979 205 644, or the company email, with enough information to verify you are the data subject (e.g. the phone/email used when ordering). We respond within 24 working hours and process requests within the legally required timeframe.

8. Cookies and tracking

The site uses four groups of cookies: (1) Essential — cart, admin login session, and thp_consent (remembers your cookie choice, 12 months); (2) Order attribution — thp_utm, thp_ref, thp_lid, thp_referrer_host (30 days) as described in section 2, and thp_clk (ad-click IDs gclid/fbclid/ttclid, 90 days, stored only if you arrive from an ad and have agreed to advertising cookies); (3) Analytics — Google Analytics cookies (_ga, _ga_*), on by default and you can switch them off with “Essential only”; (4) Advertising — Google Ads, Meta and TikTok cookies, only after you click “Accept all”. You can change your choice any time via the “Cookie settings” link in the footer, or block cookies in your browser — some features (cart, affiliate attribution) may then not work correctly.

9. Changes to this policy

This policy may be updated to reflect changes in our operations or the law. The most recent update date is shown at the top of this page.