INFORMATION PRIVACY AND PERSONAL DATA PROTECTION POLICY

Last updated: July 31, 2026

This Information Privacy and Personal Data Protection Policy (the “Policy”) describes how Vietnam Custom Leather Joint Stock Company (“VCL,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects the personal data of customers, visitors, and users of the website vcl.com.vn.

VCL respects individuals’ privacy and is committed to processing personal data lawfully, transparently, for specified purposes, and only to the extent necessary to provide products and services to customers.

By accessing the website, creating an account, placing an order, contacting VCL, or voluntarily providing personal data, customers acknowledge that they have read this Policy. Any processing activity that requires consent will only be carried out after VCL has obtained the customer’s valid consent, except where processing without consent is permitted by law.

1. Information About the Personal Data Controller

The entity responsible for collecting, managing, and controlling personal data under this Policy is:

Company name: VIETNAM CUSTOM LEATHER JOINT STOCK COMPANY
Enterprise registration number: 0109354751
Registered office: No. 128, Alley 211 Khuong Trung, Phuong Liet Ward, Hanoi, Vietnam
Website: vcl.com.vn
Telephone: 0329 336 332
Zalo: 0329 336 332
Email: vcl.store.official@gmail.com

2. Scope of Application

This Policy applies to personal data collected by VCL through:

The website vcl.com.vn;
Customer accounts and registration forms on the website;
Online or in-store purchases;
Telephone, Zalo, email, and VCL’s official social media channels;
Consultation, ordering, delivery, payment, warranty, repair, return, exchange, and refund activities;
Newsletter subscriptions, loyalty programs, promotional programs, or events organized by VCL; and
Other lawful methods of interaction between customers and VCL.

3. Categories of Personal Data VCL May Collect

Depending on how a customer interacts with VCL, we may collect one or more of the following categories of data.

3.1. Identification and Contact Data

Full name;
Telephone number;
Email address;
Delivery address and billing address;
Account name or login information; and
Information about the recipient of an order, as provided by the customer.

Customers may only provide another person’s data after informing that person and ensuring that they have the lawful authority to provide such data to VCL.

3.2. Order and Transaction Data

Products in which the customer is interested or has ordered;
Quantity, dimensions, color, material, and packaging requirements;
Order, delivery, return, exchange, warranty, and complaint history;
Payment method and payment status;
Information required for invoice issuance; and
Communications between the customer and VCL relating to a transaction.

VCL does not request customers to provide bank account passwords, personal identification numbers (PINs), one-time passwords (OTPs), or transaction verification codes through telephone, Zalo, email, or social media.

3.3. Data Relating to Custom-Made Products

When a customer orders a product that is designed, crafted, or modified according to specific requirements, VCL may collect:

Measurements and product sizing information;
Design or modification requirements;
Engraving, printing, or personalization content;
Images, drawings, reference samples, or documents voluntarily provided by the customer; and
Other information necessary to complete the product as agreed.

VCL will only use such data to provide consultation, design, manufacture, modify, and supply the product requested by the customer, unless the customer consents to its use for another purpose.

3.4. Technical Data and Website Usage Data

When a customer accesses vcl.com.vn, the system may automatically record:

Internet Protocol address;
Device type and operating system;
Browser type and version;
Access time;
Pages viewed, links accessed, and actions performed on the website;
System log data; and
Cookies and technologies with similar functions.

3.5. Communications and Feedback Data

VCL may retain information provided by customers when they:

Submit questions or consultation requests;
Submit feedback, requests, or complaints;
Review products or services;
Participate in surveys, promotional programs, events, or community activities; or
Contact VCL by telephone, Zalo, email, or official social media channels.

4. Purposes of Personal Data Processing

VCL may process personal data for the following purposes.

4.1. Providing Products and Completing Transactions

Verifying identity and contact information;
Receiving, confirming, and processing orders;
Providing advice on products, sizes, materials, and designs;
Producing custom-made products;
Processing payments, issuing invoices, and reconciling transactions;
Packaging, shipping, and delivering products;
Tracking and updating order status; and
Providing warranty, repair, exchange, return, or refund services.

4.2. Customer Care and Support

Responding to questions and support requests;
Receiving and resolving feedback, requests, and complaints;
Contacting customers to verify or supplement order information;
Providing product use, maintenance, and care instructions; and
Measuring customer satisfaction and improving the customer experience.

4.3. Website Operation and Improvement

Maintaining the operation of the website and customer accounts;
Remembering shopping cart contents and user preferences;
Analyzing website performance and usage behavior;
Detecting and preventing technical errors, fraud, and unauthorized access; and
Improving the stability, security, and usability of the website.

4.4. Marketing and Communications

With the customer’s appropriate consent, VCL may use contact information to:

Provide information about new products;
Announce promotional programs;
Send invitations to events or customer programs;
Introduce brand content, collections, and activities; and
Personalize marketing content based on the customer’s needs.

Customers may opt out of receiving marketing communications at any time by using the unsubscribe function included in the relevant communication or by contacting VCL directly.

Opting out of marketing communications will not affect essential notices relating to orders, payments, delivery, warranty services, or customer rights and benefits.

4.5. Compliance With Legal Obligations

VCL may process and retain data to:

Fulfill accounting, tax, invoicing, and document-retention obligations;
Prevent and address fraud or violations of law;
Resolve disputes;
Comply with lawful requests from competent state authorities; and
Protect the lawful rights and interests of VCL, customers, and third parties.

5. Legal Bases for Personal Data Processing

Depending on the relevant activity, VCL processes personal data on one or more of the following bases:

The customer’s voluntary, explicit, and verifiable consent;
The necessity of entering into or performing a transaction or contract with the customer;
Compliance with obligations prescribed by law;
The protection of the life, health, or lawful rights and interests of the customer or another individual in an emergency; and
Other circumstances in which the law permits personal data to be processed without consent.

VCL does not treat a customer’s failure to respond or make a selection as consent, unless otherwise provided by law.

6. Consent and Withdrawal of Consent

Where consent is the basis for processing personal data, customers have the right to:

Consent to all or part of the processing purposes;
Refuse to consent to one or more non-essential purposes;
Modify or withdraw previously provided consent; and
Refuse to receive advertising or marketing content.

The withdrawal of consent does not affect the lawfulness of processing carried out before VCL receives the withdrawal request.

In certain circumstances, a customer’s failure to provide, or withdrawal of consent for, necessary data may prevent VCL from continuing to process an order, manufacture a custom-made product, or provide certain functions. VCL will inform the customer of any potential consequences before carrying out the request.

7. Cookies and Similar Technologies

The website vcl.com.vn may use cookies and similar technologies to:

Maintain login sessions;
Remember shopping cart contents and customer preferences;
Ensure the website’s basic functions and security;
Analyze performance; and
Measure and optimize content and advertising where the customer has made an appropriate selection.

Cookies may be classified as follows:

Essential cookies: Support the website’s basic functions and security;
Functional cookies: Remember customer preferences and customizations;
Analytics cookies: Help evaluate how customers use the website; and
Marketing cookies: Support advertising measurement or personalization, where used.

Customers may manage or delete cookies through their browser settings. Disabling essential cookies may prevent certain website functions from operating properly.

For non-essential cookies, VCL will provide a selection mechanism or obtain consent where required by law.

8. Organizations and Individuals That May Access Personal Data

To the extent necessary and consistent with the relevant processing purposes, personal data may be accessed by:

Authorized VCL personnel and departments;
Delivery, transportation, or logistics service providers;
Banks, payment intermediaries, or payment gateway providers;
Website hosting, server, email, messaging, or technical support service providers;
Warranty providers, repair providers, or manufacturing partners involved in an order;
Data analytics or marketing service providers, where the customer has made an appropriate selection;
Legal, accounting, auditing, or insurance advisers;
Competent state authorities as prescribed by law; and
Lawful transferees in the event of a reorganization, merger, consolidation, or transfer of business operations.

VCL only provides data to the extent necessary and requires recipients to comply with appropriate confidentiality and data security obligations.

VCL does not buy or sell customers’ personal data.

9. Cross-Border Transfer of Personal Data

Where VCL uses service providers whose servers, cloud computing infrastructure, or data-processing operations are located outside Vietnam, personal data may be transferred to or accessed from another country.

Where a cross-border transfer of personal data occurs, VCL will:

Clearly identify the purpose and scope of the transfer;
Transfer only the data that is necessary;
Apply appropriate security measures;
Require the recipient to protect the data; and
Complete the required documentation, procedures, and other obligations prescribed by law.

10. Data Retention Period

Personal data is retained for as long as necessary to fulfill the notified purposes, including:

Account data is retained until the account is terminated or the customer requests its deletion;
Order data is retained for as long as necessary to complete delivery, provide warranty services, process returns or exchanges, and resolve complaints;
Invoices and transaction documents are retained for the periods required under accounting, tax, and record-retention laws;
Design records, measurements, and personalization requirements may be retained for warranty services or repeat orders, unless the customer requests deletion and VCL is not legally required to continue retaining them;
Marketing data is retained until the customer withdraws consent or requests that communications cease; and
Technical logs are retained for as long as necessary to ensure security and investigate incidents.

When there is no longer a lawful purpose for retaining personal data, VCL will delete, destroy, anonymize, or otherwise appropriately process the data, unless continued retention is required by law.

11. Personal Data Protection Measures

VCL applies administrative and technical measures appropriate to the nature of the data and the level of risk. Such measures may include:

Assigning and limiting access rights;
Controlling administrator accounts;
Applying authentication and password-protection measures;
Backing up and restoring data;
Monitoring, detecting, and addressing unusual access activities;
Protecting systems, devices, and communication networks;
Requiring personnel and partners to comply with confidentiality obligations;
Periodically reviewing and updating security measures; and
Establishing incident-response plans.

No method of data transmission or storage can guarantee absolute security. Nevertheless, VCL will proactively apply reasonable measures to minimize the risk of loss, unauthorized access, misuse, disclosure, or alteration of personal data.

12. Personal Data Incident Management

Upon detecting or receiving information about an incident that may affect personal data, VCL will:

Record and assess the incident;
Take measures to contain the incident and minimize damage;
Identify the data and data subjects that may be affected;
Remedy any vulnerability or cause of the incident;
Notify competent authorities and affected data subjects where required by law; and
Maintain records and implement measures to prevent recurrence.

13. Customer Rights Regarding Personal Data

To the extent permitted by law, customers have the following rights:

The right to be informed about personal data processing activities;
The right to consent or refuse to consent to processing;
The right to withdraw consent;
The right to request access to or disclosure of personal data;
The right to request the correction or updating of inaccurate data;
The right to request the deletion of data;
The right to request restrictions on data processing;
The right to object to data processing;
The right to request a copy of, or the transfer of, data where the applicable legal conditions are satisfied;
The right to submit complaints, denunciations, or legal claims;
The right to claim compensation for damage where there are lawful grounds; and
The right to exercise other self-protection rights.

Certain rights may be restricted where fulfilling the request would:

Violate a statutory retention obligation;
Affect the lawful rights and interests of another individual;
Obstruct dispute resolution or fraud-prevention activities; or
Fall within circumstances in which the law permits a request to be refused or restricted.

14. Exercising Rights and Submitting Requests

Customers may submit requests relating to personal data through any of the following channels:

Telephone: 0329 336 332
Zalo: 0329 336 332
Email: vcl.store.official@gmail.com
Postal address: Vietnam Custom Leather Joint Stock Company, No. 128, Alley 211 Khuong Trung, Phuong Liet Ward, Hanoi, Vietnam.

A request should include:

The requester’s full name;
The telephone number or email address previously provided to VCL;
The nature and scope of the request;
Relevant order or transaction information, if any; and
Reasonable documents or information enabling VCL to verify that the requester is the data subject or a lawful representative.

VCL will only request verification information to the extent necessary and will not ask customers to provide bank passwords, OTPs, or PINs.

15. Procedure for Receiving and Processing Personal Data Requests

Customer requests are processed in accordance with the following steps:

Receipt: VCL records the request submitted through an official contact channel.
Acknowledgment: VCL acknowledges receipt within 24 working hours.
Verification: VCL may contact the requester to verify identity, representative authority, or clarify the request.
Processing: VCL processes the request within the period prescribed by law. For standard requests, VCL will endeavor to provide a result within seven working days after receiving all valid and necessary information.
Notification of result: VCL informs the customer that the request has been completed, that additional time is required, or of the reason why the request cannot yet be completed.

Where a matter is complex, involves multiple systems or parties, or requires additional verification, the processing period may be extended. VCL will inform the customer of the status of the request and the anticipated timeline for further processing.

16. Children’s Personal Data

VCL’s website and products are not intentionally directed toward the collection of children’s personal data without the involvement of a parent or lawful guardian.

Where a transaction involves a child, the person providing the data must ensure that they have all necessary authority and consent as required by law.

Where VCL discovers that a child’s data has been collected contrary to applicable requirements, VCL will take steps to verify the circumstances, restrict processing, or delete the data, unless continued retention is required by law.

17. Customer Responsibilities

Customers are responsible for:

Providing accurate, complete, and lawful information;
Promptly updating information when it changes;
Protecting login credentials and not sharing passwords;
Informing VCL upon discovering unauthorized access to an account;
Not providing another person’s data without appropriate authority or consent; and
Not sending banking information, OTPs, passwords, or unnecessary data to VCL through unsecured channels.

VCL will not be liable for damage directly resulting from a customer’s intentional provision of inaccurate information, voluntary disclosure of confidential information, or failure to comply with security warnings, except where the damage is attributable to VCL’s fault in accordance with applicable law.

18. Third-Party Links and Platforms

The website may contain links to third-party websites, social media services, payment gateways, or other platforms.

When customers access or use such platforms, the processing of their data may be governed by the relevant third party’s own privacy policy. VCL recommends that customers review each platform’s privacy policy before providing personal data.

VCL does not control and is not responsible for the independent data-processing activities of third parties, unless otherwise provided by law or by an agreement between the relevant parties.

19. Changes to This Privacy Policy

VCL may amend this Policy to reflect:

Changes in applicable law;
Changes in business operations;
The introduction of new products, services, or functions; or
Requirements to enhance security and data protection.

The updated version will be posted on vcl.com.vn and will clearly state its effective date. Where a material change directly affects customers’ rights, VCL will provide appropriate notice and obtain renewed consent where required by law.

20. Personal Data Complaint Mechanism

Where a customer believes that their personal data has been collected, used, disclosed, or otherwise processed inappropriately, the customer may submit a complaint to VCL through:

Telephone/Zalo: 0329 336 332
Email: vcl.store.official@gmail.com
Address: No. 128, Alley 211 Khuong Trung, Phuong Liet Ward, Hanoi, Vietnam.

VCL will receive, verify, and address complaints in good faith, objectively, and in accordance with applicable law.

Submitting a complaint directly to VCL does not limit the customer’s right to submit feedback, complaints, or requests to a competent state authority.

21. Contact Information

For any questions, requests, or feedback relating to this Policy, please contact:

VIETNAM CUSTOM LEATHER JOINT STOCK COMPANY

Enterprise registration number: 0109354751
Registered office: No. 128, Alley 211 Khuong Trung, Phuong Liet Ward, Hanoi, Vietnam
Website: vcl.com.vn
Telephone: 0329 336 332
Zalo: 0329 336 332
Email: vcl.store.official@gmail.com