Privacy Policy & Personal Data Protection

2. Information We Collect

We collect 5 main data groups:

• A.
  Account information — full name, email, phone number, company, tax ID, delivery address, password (bcrypt-hashed).
• B.
  Transaction information — RFQs, orders, favorited products, payment history (status only, no card numbers stored — handled by the partner payment processor), tracking numbers, dispute history.
• C.
  Device & log information — IP address, user agent, OS, browser, language, access time, pages viewed (kept 90 days for analytics and security audit).
• D.
  Communication content — chat with suppliers via the platform, video call transcripts (saved only when the user confirms), email sent through the system, and review comments.
• E.
  Third-party information — when signing in via Google/Apple/Facebook, Huayue receives: email, name, avatar (only the fields you agree to share via the OAuth consent screen). We do NOT collect: national ID/passport numbers (except when KYC is required for transactions of $10K or more), biometric data, medical data, religion or political opinions (per the definition of 'sensitive personal data' in Article 2.4 of Decree 13/2023).

3. Purposes & Legal Basis for Processing

Huayue processes data on 4 legal bases under Article 11 of Decree 13/2023:

• 1.
  Consent — you check 'I agree' at registration and may withdraw at any time.
• 2.
  Contract performance — processing data needed to provide the agreed B2B services (RFQs, ordering, shipping, after-sales).
• 3.
  Legal obligation — retaining tax records for 10 years under Vietnam's Tax Administration Law, and storing e-invoices under Decree 123/2020/NĐ-CP.
• 4.
  Legitimate interest — fraud prevention, system security, product improvement (only where it does not infringe your fundamental rights). Specific purposes: providing and personalizing services, connecting Buyers and Suppliers, processing payment and shipping, sending transaction notifications, preventing fraud/abuse, improving products through aggregate-data analysis, marketing (only with the Buyer's opt-in consent), and complying with the law and requests from authorities.

4. Cookies & Tracking Technologies

Huayuesc uses 4 cookie groups with a clear policy and a cookie management panel at /info/quan-ly-cookies:

• a.
  Essential cookies — maintain login, the RFQ cart and language; no consent required under Article 6 of Decree 13/2023 (necessary for service). Examples: csr_session, csr_locale, csr_csrf.
• b.
  Analytics cookies — Google Analytics 4 (anonymized IP), Hotjar session replay (masks sensitive fields), Mixpanel funnel. Opt-in required. Kept 24 months.
• c.
  Marketing cookies — Facebook Pixel, Google Ads, LinkedIn Insight, TikTok Pixel. Opt-in required. Kept 12 months.
• d.
  Supplier partner cookies — activated only when you click into a Supplier's product page (rare). A cookie consent banner appears on your first visit, with 3 options: Accept all / Essential only / Customize. You can change your choice at any time at /buyer-center/settings/privacy.

5. Sharing with Third Parties

Huayue shares data with 5 third-party groups, each bound by a Data Processing Agreement (DPA) requiring compliance with Decree 13/2023 plus GDPR-equivalent standards:

• 1.
  Suppliers — only the minimum information needed to complete the order is shared (contact name, company, delivery address, requested SKU); email and phone are NOT shared directly — all communication goes through Huayue's relay.
• 2.
  Partner banks in Vietnam and China for the Trade Assurance escrow service; payment processors for international payments — they see only the minimum information needed to process the transaction and meet KYC.
• 3.
  Logistics partners and the Hai Phong port customs partner — delivery address, tracking number and customs declaration contents are shared.
• 4.
  Service providers — AWS Singapore (hosting), Cloudflare (CDN, anti-DDoS), Twilio (SMS OTP), SendGrid (transactional email), Sentry (error tracking, scrubs PII).
• 5.
  Government authorities — only upon a lawful written request (a search order, a prosecution notice); Huayue publishes an annual Transparency Report on the number of requests received. We NEVER sell data to data brokers or third parties for marketing.

6. Cross-Border Vietnam–China Data Transfers

Huayue operates across the Vietnam–China border: Vietnamese Buyer data may be transferred to the Guangzhou procurement representative office so the Huayue team can support sourcing, factory audits, goods inspection and dispute handling. Cross-border data transfers are protected by 3 layers:

• i.
  Standard Contractual Clauses (SCCs) — an internal instrument between the Hanoi headquarters and the Guangzhou representative office of Huayue Supply Chain (Vietnam) Co., Ltd., conforming to the reference template from Vietnam's Ministry of Justice.
• ii.
  Encryption-in-transit — all Vietnam↔China traffic over TLS 1.3 with certificate pinning, cannot be intercepted.
• iii.
  Cross-border data transfer registration with the Authority of Information Security under Article 25 of Decree 13/2023 — Huayue is in the process of completing this registration. You have the right to ask Huayue NOT to transfer your data to China — we will respect this but may have to limit the on-site factory audit service (which is carried out by the Guangzhou team).

7. Storage & Data Lifecycle

Personal data lifecycle at Huayue follows the 'minimum necessary' principle:

• a.
  Active accounts — stored continuously, updated at your request.
• b.
  Accounts inactive for 18 months or more — a warning email is sent plus automatic deletion if there is no response within the next 90 days.
• c.
  Completed orders — details kept 7 years per Vietnamese tax obligations, then anonymized.
• d.
  Transaction records and invoices — kept 10 years under the Tax Administration Law.
• e.
  Communication logs (chat, email) — kept 24 months for dispute resolution, then permanently deleted.
• f.
  Server logs — 90 days, then aggregated into analytics reports (no PII).
• g.
  Cookies — per the time-to-live noted in Section 4. When you request account deletion (a right in Section 9), Huayue hard-deletes within 30 days plus email confirmation plus a 'Certificate of Erasure' on request (for businesses that need an audit trail).

8. Technical & Organizational Security Measures

Technical security measures:

• 1.
  Transport encryption — TLS 1.3 with forward secrecy, HSTS preload, certificate transparency monitoring.
• 2.
  Storage encryption — AES-256-GCM for the database at rest, key management via AWS KMS with 90-day key rotation.
• 3.
  Password hashing — bcrypt with work factor 12 plus per-user salt plus pepper.
• 4.
  Intrusion detection — Cloudflare layer-7 WAF, AI anomaly detection for login patterns, rate limiting that automatically blocks brute-force attacks.
• 5.
  Internal access control — principle of least privilege, role-based access control (RBAC), mandatory 2FA for every Huayue employee with production access.
• 6.
  Audit logging — all data access is logged with timestamp, IP, user and action; logs are kept on a write-once system for 12 months.
• 7.
  Penetration testing — twice a year by an independent security partner.
• 8.
  Bug bounty program — report vulnerabilities to privacy@huayuesc.vn for a reward of $100-5,000 depending on severity. Organizational measures: Huayue staff sign an NDA and attend quarterly security training; the AWS Singapore and Vietnam data centers are ISO 27001 certified; the incident response process has an RTO of 4h and RPO of 1h; automatic backups run hourly plus offsite daily.

9. Your 11 Rights under Decree 13/2023

Under Articles 9–22 of Decree 13/2023, you have 11 basic rights over your personal data:

• 1.
  Right to be informed — knowing what data is collected, why, and for how long.
• 2.
  Right to consent — approving or declining processing.
• 3.
  Right of access — requesting to view your data (exported as JSON/CSV within 30 days).
• 4.
  Right to withdraw consent — at any time, without explanation.
• 5.
  Right to erasure — 'right to be forgotten', deleting your account and all data within 30 days (except records that must be kept under tax law).
• 6.
  Right to restrict processing — asking Huayue to temporarily halt data processing while a complaint is resolved.
• 7.
  Right to data portability — requesting transfer of your data to another provider.
• 8.
  Right to object — objecting to processing for marketing or profiling.
• 9.
  Right to complain — filing a complaint with the Authority of Information Security (Ministry of Information & Communications) or with us.
• 10.
  Right to claim damages — if a Huayue violation causes harm.
• 11.
  Right to self-protection — taking your own data protection measures (changing your password, enabling 2FA, opting out of cookies). To exercise any right, email privacy@huayuesc.vn — a response within 7 business days, fully processed within 30 days.

10. Protection of Children Under 16

Huayuesc is a B2B platform for businesses and is NOT directed at children under 16. At registration, users must confirm they are 18 or older (or the age of majority under the law of their country of residence). If a child's account is found, Huayue will deactivate it immediately and delete all data within 7 days. Parents who discover their child has created an account can contact privacy@huayuesc.vn — we verify and delete on a priority basis at no charge.

11. Data Incidents & Notification Process

Our Data Breach Response Plan complies with Article 23 of Decree 13/2023: (Step 1) Detection — a 24/7 Security team monitors year-round, or receives reports from the Bug Bounty program / staff / partners. (Step 2) Containment — within 4 hours, identify the scope, stop the leak, lock affected systems. (Step 3) Assessment — security forensics determine how many users are affected, what data, and the severity. (Step 4) Notify the authorities — within 72 hours of detection, file a report with the Authority of Information Security (Ministry of Information & Communications) using the standard template. (Step 5) Notify users — email/SMS to every affected user within 72 hours, describing the incident plus the exposed data plus remediation plus recommendations (change password, enable 2FA, monitor your account). (Step 6) Remediation — fix the vulnerability, audit the whole system, publish a public post-mortem within 30 days. (Step 7) Compensation — if a user proves direct harm, Huayue has a transparent compensation policy.

12. Policy Amendments & DPO Contact

Huayue reviews this policy at least once a year and updates it when the law, technology or services change. The current version is v1.0, effective 01/01/2026. Old versions are archived at /info/privacy-policy/lich-su for reference. For material changes (affecting user rights), Huayue notifies users via:

• a.
  Email to every active user at least 30 days before it takes effect.
• b.
  A banner on the website/app for 60 days.
• c.
  A request for user re-consent if the purpose of data processing changes. Contact the DPO (Data Protection Officer): email privacy@huayuesc.vn (response within 72h), hotline +86 181-2225-6999 (business hours), or by post to 'DPO — Huayue Supply Chain (Vietnam) Co., Ltd.', Floor 07, Bao Ngoc Building, No. 02 Thanh Lam Street, Xuan Phuong Ward, Hanoi, Vietnam. Independent complaints authority: the Authority of Information Security (Ministry of Information & Communications), 18 Nguyen Du, Hanoi — website ais.gov.vn.