Privacy

Personal data protection policy

This English version is a translation provided for convenience. In case of any discrepancy between language versions, the Vietnamese version prevails. This does not limit any rights you have under mandatory law applicable to you.

Version v1.0 – prepared under the Personal Data Protection Law No. 91/2025/QH15, Decree 356/2025/ND-CP, the E-commerce Law No. 122/2025/QH15 and Decree 248/2026/ND-CP (Article 5). Effective date: 12/10/2026.

1. Data controller

Top Source Vietnam Co., Ltd. (CÔNG TY TNHH TOP SOURCE VIETNAM)
Enterprise code / tax code: 0110833879
Head office address: No. 20, Lien Ke 14, Housing Area for Officers of Departments B42 & B57, General Department V (Ministry of Public Security), Thanh Liet Ward (formerly Tan Trieu Commune, Thanh Tri District), Hanoi, Vietnam
Contact email for personal data: [email protected]

2. Purposes and scope of collection

The website has no form for collecting personal data. When you email us at [email protected] or message us on WhatsApp, we receive the data you choose to provide, usually: full name, company name, country, email, phone number/WhatsApp and the content of your message (product, specification, quantity, place of delivery). When you visit the website, Cloudflare processes technical data (such as IP addresses) to operate and protect the website.

Purposes: to answer your enquiry, prepare a quotation and, if you decide to proceed, take the steps before signing a contract. We do not use enquiry data for marketing purposes without your separate consent.

3. Legal basis for processing

We process the data you send us by email or WhatsApp to perform your request before entering into a contract (answering your enquiry, preparing a quotation). When you sign a contract with us, we process the data necessary to perform that contract. For any other purpose (for example marketing information), we process data only with your separate consent (Personal Data Protection Law No. 91/2025/QH15).

4. Scope of use and parties with access to the data

The data is used only within the purposes stated in section 2. Parties with access: company staff directly handling the enquiry; the following personal data processors, which process data on the company's behalf under contract and are also recipients of data transferred abroad: (1) Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States) – website hosting and DNS, global server network; (2) Microsoft Regional Sales Pte. Ltd. (Singapore, the contracting entity for Microsoft 365 customers in Asia) together with Microsoft Corporation (United States) and its affiliates – Microsoft 365 company email, mailbox [email protected], data stored outside Vietnam in the Asia Pacific region. In addition, goods suppliers or logistics partners receive data only when necessary to prepare a quotation. We do not buy or sell personal data.

WhatsApp: if you choose to contact us via WhatsApp, it is a third-party platform of your choice, not a data processor of the company. WhatsApp/Meta processes your data under its own terms and policies, on servers outside Vietnam – see the WhatsApp Privacy Policy.

5. Transfer of personal data abroad

Your data is processed on servers abroad: the website and DNS run on the global server network of Cloudflare, Inc.; emails you send to [email protected] are stored in the Microsoft 365 service (Microsoft) with data stored outside Vietnam (Asia Pacific region). WhatsApp messages are processed by WhatsApp/Meta under its own policies (see section 4). Data is transmitted over encrypted connections and used only for the purposes stated in this policy. We prepare and keep the impact assessment dossier for the transfer of personal data abroad where Vietnamese law requires it.

Possible unwanted consequences and damage: data may be accessed, disclosed or lost without authorisation (for example through a security incident at a service provider or a phishing email); when data is stored abroad, it may be subject to the laws of the country where it is stored. Mitigation: we use only providers with contractual data protection commitments, encrypted transmission, restricted mailbox access, minimal collection and deletion when the retention period ends.

6. Retention period

Processing starts when we receive your email or message and lasts up to 24 months from the last contact, unless the law or a signed contract requires longer retention. When the period ends, the data is deleted or destroyed.

7. Data protection measures

The website is accessible only over encrypted HTTPS/TLS connections (Cloudflare). The website has no database and does not store contact data; emails are kept in the company mailbox [email protected] (Microsoft 365) and access to this mailbox is limited to staff assigned by the company.

8. Rights of the data subject

Under Article 4 of Law 91/2025/QH15, you have the right to:

9. How to view, correct, delete or restrict the processing of data

Send your request to [email protected], stating the request clearly and the information needed to identify the data concerned. We respond within 02 working days and act within the time limits set by Vietnamese personal data protection law. Withdrawing consent does not affect processing carried out before the withdrawal.

10. Receiving and handling complaints about personal data

Complaints about personal data are sent to [email protected]; we respond within 02 working days and resolve them within the time limits of Decree 356/2025/ND-CP. You may also contact the competent personal data protection authority.

11. Cookies and analytics tools

The website currently does not use analytics, advertising or tracking cookies and does not load third-party scripts.

12. Policy updates

Any changes are published on this page together with a new effective date.