01
Scope
This policy explains how Sao Việt — a non-profit community project for astro-tourism — collects, uses, stores and protects your personal data when you visit the website, create an account, send a tour booking request or take part in the community. It follows Vietnam's Decree 13/2023/ND-CP on personal data protection and any related amending, supplementing or replacing regulations.
For the purposes of this policy, Sao Việt acts as the Personal Data Controller and Processor; you are the data subject. We collect only basic personal data and do not intentionally collect sensitive personal data.
02
Data we collect
| Category | Details | Source |
|---|---|---|
| Account | Name, email, password (stored only as a one-way hash — we cannot read your original password), account role, creation time. | You, at sign-up |
| Booking requests | Contact name, email, phone number, departure date, number of guests, and any notes you type (for example dietary needs or assistance requests). | You, when booking |
| Community content | Tour reviews and star ratings, comments, forum threads and posts, together with your display name and posting time. | You, when posting |
| Technical | Sign-in session cookies; the IP address and browser user agent attached to each sign-in session; server access logs recorded by our hosting provider. | Automatically, as you use the site |
| Contact messages | Name, email, topic and message you send through the contact form. | You |
Please do not post sensitive information (health, religion, ID numbers…) on the forum or in booking notes. If you need to discuss a health matter related to a trip, reach us privately via our Contact page.
03
Why we process data
- Creating and maintaining your account, authenticating sign-ins and protecting the account from unauthorised access.
- Receiving, confirming and coordinating booking requests; contacting you about schedules, weather and trip changes.
- Displaying the community content you publish and moderating it under our Terms.
- Answering questions and requests you send through the contact page.
- Operating, securing and troubleshooting the service; detecting abuse or fraud.
We do not sell personal data, do not use your data for targeted advertising, and do not send marketing email without your separate consent.
04
Legal basis and consent
We process personal data on the basis of your consent. Consent is given expressly when you actively create an account, send a booking request, publish content or submit the contact form after being informed of this policy. Silence or inaction is never treated as consent.
In limited cases the law allows processing without consent — for example to protect your life or health, or someone else's, in an emergency during a trip, or when a competent authority requests it as provided by law. We rely on these grounds only to the minimum extent necessary.
Participants under 18 may join a tour only when a parent or guardian books and travels with them; booking requests for children must be sent, and consented to, by the guardian.
05
How long we keep data
| Data | Retention |
|---|---|
| Account | For as long as the account is active; deleted within 30 days of your deletion request. |
| Booking requests | 24 months from the departure date, to handle complaints and refunds, then deleted or anonymised — unless the law requires longer retention. |
| Community content | Until you delete it, a moderator removes it, or the account is deleted. On account deletion you may choose to delete your content or keep it anonymised. |
| Sessions (IP, user agent) | Until the session expires or you sign out; expired session records are purged periodically. |
| Contact messages | 12 months after the request is resolved. |
07
Your rights
As a data subject you have the following rights over your personal data:
- To be informed about processing — which is what this policy does.
- Access: see and receive a copy of the data we hold about you.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your account and related data deleted, except what the law requires us to keep.
- Withdraw consent, restrict or object to processing. Withdrawal does not affect the lawfulness of processing carried out before it.
- Complain, report, bring legal action and claim damages as provided by law, including complaining to the personal data protection authority under the Ministry of Public Security.
To exercise these rights, send a request via our Contact page and choose the “Personal data” topic. We may ask you to verify your identity (for example by writing from the registered email) before acting. We respond within 72 hours of receiving a valid request; for more complex cases we will tell you the expected timeline.
08
Security measures
- All connections to the website are encrypted with HTTPS (TLS).
- Passwords are one-way hashed with a dedicated algorithm before storage; no one, including administrators, can see the original.
- Session cookies are HttpOnly so page scripts cannot read them.
- Admin rights are re-checked against the database for every sensitive action; only a small number of operators can access booking data.
- Tour prices are always taken from the server, never trusted from the browser.
- If a data breach is detected, we notify the competent authority within 72 hours and inform affected people as required by law.
No system is perfectly secure. Use a unique password for Sao Việt and sign out on shared computers.
10
Changes and contact
When this policy changes materially, we update the effective date at the top of the page and announce it on the website before it applies. If a change widens the purposes of processing, we will ask for your consent again.
For any question or request about personal data, please write to us via our Contact page.
Anything unclear?
We answer every question about personal data, bookings and cancellations — usually within one working day.