Privacy policy
1. Scope of information collection
- Classification of personal data under Decree 13/2023/ND-CP: Personal data includes basic personal data and sensitive personal data.
- Partner & B2B customer data: Business identification and technical data voluntarily provided: full name, job title, department, work phone number, work email, company name, factory, industry, range of equipment/system specifications requested for consulting, catalog downloads or newsletter subscriptions.
- Job applicant data: CV information, work history, qualifications, interview assessment information, and interactions through partner recruitment channels.
- Digital data & automated interactions: IP address, browser type, operating system, access time, catalog lookup history, cookies (essential, marketing-software analytics, functional) and email tracking tags.
- Statement of non-collection of sensitive personal data: EUTC affirms that it does NOT collect sensitive personal data as defined in Decree 13/2023/ND-CP (including but not limited to: political views, religion, health status, genetic information, biometric data, data on sex life, criminal data, and in-depth financial/banking information beyond the purpose of order payment).
- Consent mechanism: The voluntary and explicit consent of the data subject under Decree 13/2023/ND-CP, given through written consent, ticking the agreement box on an electronic interface/website/cookie banner, email confirmation, or other affirmative actions.
2. Purposes of data use
A. Lawful basis for data processing: Voluntary consent of the data subject (Decree 13/2023/ND-CP); carrying out transactions, technical consulting solutions, on-site surveys, sending B2B quotations, negotiating and performing equipment/service sales contracts (measures to prepare for and perform B2B contracts); compliance with current Vietnamese laws on e-commerce, accounting, tax and other legal obligations; EUTC's legitimate interests (ensuring cybersecurity and server system safety, maintaining B2B business relationships, preventing commercial fraud or information security violations). Marketing cookies and advertising/B2B conversion trackers are used to measure B2B campaigns and display industrial equipment messages suited to businesses' search needs, in compliance with the prior-consent principle under Decree 13/2023/ND-CP (trackers are only activated when the user consents).
B. Detailed purposes of use:
a. In-depth technical consulting & configuration breakdown: Receiving requests, handling inquiries, breaking down equipment configurations and providing technical solutions that fit the capacity range/system specifications required by customers.
b. Factory site surveys: Using contact information and addresses to carry out technical surveys, construction or on-site inspections at the factory.
c. Issuing B2B quotations: Preparing, sending and managing commercial quotations and B2B equipment/service sales contracts.
d. Delivery of materials: Transporting and delivering equipment and materials to the correct location and recipient.
e. After-sales support & Warranty: Managing transaction history, performing warranty, maintenance and repair obligations, and periodic technical support.
f. Sending technical newsletters / industry event invitations: Sending product updates, technology solutions, technical documents, catalogs or promotion/event programs (upon receiving consent, with a one-click unsubscribe mechanism).
g. Website system optimization & Information security: Maintaining system security, improving user experience, optimizing the interface, analyzing traffic and detecting and preventing unauthorized access or information security violations at EUTC.
h. Recruitment purposes: Collecting applications, analyzing and assessing candidates, organizing interviews, conducting reference checks, and setting up personnel records when a candidate is hired.
3. Data retention period
A. Retention principle: Personal data will be retained from the time of collection until the data processing purposes set out in Section 2.2 of this Policy are completed, or until a valid request to delete/destroy the data is received from the data subject.
B. Retention under the law: Where sector-specific laws (such as accounting, tax and e-commerce laws) set mandatory retention periods for commercial documents/transactions, EUTC will retain the data for the period mandated by Vietnamese law before safely deleting/destroying it.
C. Retention period for recruitment records: A candidate's recruitment records will be retained until the candidate requests deletion/destruction, or in accordance with labor law regulations for candidates who become official EUTC employees.
4. Sharing information with third parties and international data transfers
A. Commitment against commercialization: EUTC absolutely does not sell, rent or trade the personal data of data subjects in any form.
B. Data sharing with partners & DPA mechanism: EUTC may share personal data with third parties (delivery/shipping units, on-site survey/technical service subcontractors, partner recruitment platforms/services such as TopCV, reference check providers, cloud partners). These processors are strictly bound by a service contract or Personal Data Processing Agreement (DPA), are obliged to keep data confidential and may only use the data for the authorized purpose.
C. Notice and consent principle: Personal data is shared only after the data subject has been notified and has given consent.
D. Cloud technology partners & international transfers: Personal data may be stored and processed on international cloud server services/platforms. EUTC transfers personal data abroad in strict compliance with Article 25 of Decree 13/2023/ND-CP (including preparing a Cross-border Personal Data Transfer Impact Assessment dossier, implementing DPA - Data Processing Agreement data protection commitments, ensuring security and safety standards, and notifying/completing procedures with the competent state management agency).
E. Legal requirements: Providing or disclosing personal data at the legal request of a competent state authority in accordance with the law.
5. User rights and controls
- The full 11 rights of the data subject (under Article 9 of Decree 13/2023/ND-CP): Including (1) the right to be informed about data processing activities; (2) the right to consent or not consent to data processing; (3) the right to access to view, edit or request editing of data; (4) the right to withdraw consent; (5) the right to delete or request deletion of data; (6) the right to request restriction of data processing; (7) the right to request provision of one's own data; (8) the right to object to data processing in order to prevent/restrict disclosure or use; (9) the right to complain, denounce or sue; (10) the right to claim damages when a violation occurs; (11) the right to self-defense under the Civil Code and related laws.
- Obligations of the data subject (under Article 10 of Decree 13/2023/ND-CP): To protect their own personal data and request relevant parties to protect it; to respect and protect the personal data of others; to provide full and accurate personal data when consenting to processing; to take part in promoting and disseminating personal data protection skills; to comply with legal regulations and take part in preventing and combating violations of personal data protection.
- Regulations on reference checks: The person who provides referee information in an application declares that they have obtained the referee's prior approval and consent to provide the information to EUTC.
- Legal consequences of withdrawing consent: If the data subject withdraws consent to the recruitment process, EUTC will stop considering the application and delete the recruitment records. For B2B customers/partners, withdrawing consent may disrupt the provision of services, delivery or B2B contracts.
- Procedure for receiving and handling requests: Data subjects exercise their rights by sending a document or email to EUTC's Data Protection Officer (DPO) at: 102 Nguyen Xi, Binh Thanh Ward, Ho Chi Minh City - Email: info@eutc.com.vn. EUTC verifies identity and commits to receiving, processing and responding within 72 working hours (unless otherwise provided by law).
- Risk warning & incident response measures: Although EUTC applies management and technical measures, encryption, internal access permissions, firewall protection and SSL/HTTPS to prevent loss, unauthorized access or data leaks, data subjects should be aware of objective risks in cyberspace. In the event of a data leak, EUTC activates its Data Breach Protocol: remediating immediately and carrying out the personal data breach notification procedure to the Department of Cybersecurity and High-Tech Crime Prevention - Ministry of Public Security (A05) within 72 hours of discovery, and notifying the data subjects concerned.
- Communication control: A mechanism to opt out/unsubscribe is included in every marketing email/technical newsletter sent to users.
- Cookie control: Data subjects can set up, manage, accept or disable/block cookies through browser settings or the cookie banner when visiting the EUTC website (blocking essential/functional cookies may limit some technical lookup features).
