1. Scope and data controller
This Policy applies to the website and Kim Tài - Tick Vàng Online. The data controller for the processing described in this Policy is the operator pending legal configuration, registration number to be published before release, registered at to be published before release. Personal-data requests may be sent to the data-protection channel to be published before release.
We process data only for specific, clear purposes and for a period appropriate to those purposes, using safeguards proportionate to the processing under Vietnamese law.
2. Data categories that may be involved
Under the current configuration, the website does not create accounts, take orders or payments, enable advertising, or install user-analytics tools.
Gold-portfolio data entered in the App, such as gold type, quantity, unit, cost, and related notes; under the current design this is stored locally on the device.
Minimum technical data needed when a device requests reference prices or opens a third-party service, potentially including IP address, request time, device/browser details, and security logs depending on the actual implementation.
Information you choose to send to support, such as your name, contact details, request content, and attachments.
Local preferences such as language, unit, preferred price source, reminder schedule, and appearance.
3. Processing purposes
Data is processed only for notified purposes that are necessary to deliver functions you request.
Display and calculate your portfolio on the device.
Retrieve and present reference-price data from configured sources.
Remember preferences, run reminders, and maintain service security and stability.
Receive, verify, and resolve support requests or complaints.
Meet legal obligations and lawful requests from competent authorities.
4. Processing grounds and consent
Where consent is required, we will provide a clear and specific notice before processing and allow you to agree or refuse. Personal-data consent is separate from accepting the Terms of Service and from optional marketing choices.
Where processing is not based on consent, we process data without consent only when a specific case under Article 19 of Law 91/2025/QH15 or another applicable rule actually applies, for example when necessary to perform an agreement with you or comply with a legal duty. The operator must identify and document the specific case; “lawful rights and interests” is not a standalone processing basis outside the statutory cases.
5. Local storage and your control
Portfolio data stored on your device is not automatically data received by the operator. You may view, edit, or erase it using App functions or the platform's app-data controls.
Back up data appropriately before uninstalling the App, replacing the device, or resetting it. If a later version adds cloud sync, accounts, or remote backup, this Policy must be updated and disclosed before that feature is used.
6. Recipients and third-party services
The website may link to the App Store and Google Play. The App may connect to reference-price sources or infrastructure providers. Those parties process data under their own role and policies.
The actual list of hosting, support, price, analytics, notification, and other processors must be disclosed before release. We do not sell personal data and will not make consent a condition for a function that does not need the relevant data, unless law requires otherwise.
7. Cross-border personal-data transfers
The current configuration does not confirm any transfer of personal data outside Vietnam. Before a cross-border transfer is introduced, the operator must identify the destination, recipient, purpose, safeguards, and complete the impact documentation required by Law 91/2025/QH15 and Decree 356/2025/ND-CP where applicable.
If you choose to open an app store or third-party website, you interact directly with that provider under its privacy notice.
8. Retention and deletion
Local portfolio data remains on the device until you erase or reset it or uninstall the App under the platform's behavior. Support data or logs actually received by the operator are retained only as needed for the stated purpose, dispute handling, system security, or legal duties.
Specific periods for each system, backup, and log must be filled in after the real data flows are inventoried. When a period ends, data must be erased, destroyed, or anonymized as required.
9. Data-subject rights
Under the Personal Data Protection Law 91/2025/QH15, and subject to its procedures and limits, you have the right to:
Know about processing; agree or refuse; and request withdrawal of consent.
View, correct, or request correction; and request provision, erasure, or restriction of personal data.
Object to processing; complain, report, bring a claim, and seek compensation as provided by law.
Protect your personal data and ask competent authorities, organizations, or relevant persons to apply protective measures as provided by law.
10. Children and represented persons
The App is intended for adults managing personal assets and is not actively directed to children. Where data of a child, a person lacking or having limited civil capacity, or a person with cognitive difficulties is involved, the data subject's rights are exercised by the legal representative and under the special conditions of applicable law.
If inappropriate collection is identified, the operator will stop processing and erase or otherwise handle the data as lawfully required.
11. Security and incidents
We apply organizational, technical, and human safeguards proportionate to the processing, such as access limits, software updates, log management, and incident procedures. No system can be guaranteed absolutely secure.
For a reportable breach or incident, the operator will assess, remediate, and notify the relevant authority or data subject in the time and form required by law. Cybersecurity Law 116/2025/QH15 applies from 1 July 2026.
12. Requests, contact, and Policy changes
Send personal-data requests to the data-protection channel to be published before release and other support requests to https://www.facebook.com/profile.php?id=61592343291824. We may reasonably verify identity before acting on a data request to protect your data.
If this Policy changes materially, we will publish the new version, effective date, and appropriate advance notice. A changed purpose or consent basis will be handled separately as required by law; continued use does not automatically replace renewed consent where consent is required.
The Vietnamese version is used to interpret and apply this document. However, if the Vietnamese and English versions differ and applicable law requires the version more favorable to the consumer to prevail, the more favorable wording applies.