Privacy Policy

This English version is provided for convenience. If there is any difference between this version and the Vietnamese original, the Vietnamese version prevails.

THƠMORE COMPANY LIMITED (CÔNG TY TNHH THƠMORE) (“Thơmore”, “we”) is committed to protecting the personal data of customers who visit the thomore.vn website (perfume retail) and use the cskh.thomore.vn customer service platform. This policy complies with the Government of Vietnam’s Decree No. 13/2023/ND-CP on Personal Data Protection (“PDPL”) and with the requirements of Meta Platforms, Zalo, Shopee and TikTok for apps that connect via their APIs.

1. Data controller information

2. Scope

This policy applies to:

• End customers who buy perfume through the thomore.vn website.
• Users who interact with Thơmore through Facebook Messenger, Instagram Direct, Zalo Official Account, Shopee Chat and TikTok Shop Customer Service.
• Tenant businesses that use the cskh.thomore.vn platform, and the customer service staff of those Tenants.

For end-customer data processed through cskh.thomore.vn, Thơmore acts as the data processor; the Tenant is the data controller in its direct relationship with its own customers.

3. Personal data we collect

3.1. From the thomore.vn website (purchases)

• Full name
• Phone number
• Email
• Delivery address
• Order history (products, quantities, time, value)
• Technical cookies (session, cart) — see Section 11.

3.2. From messaging channels (via the customer service platform)

Through each platform’s official API, we receive:

• Message and comment content exchanged between Thơmore (or the Tenant) and customers on: Facebook Messenger, Facebook Page comments, Instagram Direct, Instagram Media comments, Zalo OA, Shopee Chat and TikTok Shop messaging.
• Customer identifiers on each platform:
  • Facebook: Page-Scoped ID (PSID)
  • Instagram: Instagram-Scoped ID (IGSID)
  • Zalo: user_id, display_name, avatar
  • Shopee: buyer_user_id, buyer_name
  • TikTok: OpenID, nickname
• Display name and avatar as provided by the platform.
• Phone number / email only when the customer provides them in a message, or from Shopee/TikTok order data used to match the same customer’s identity across channels.
• Attachments (images, videos, documents) that customers send in a conversation.

3.3. From customer service staff

Company email, password (hashed with bcrypt, cost 12), login history and activity history (audit log).

3.4. What we do NOT collect

Browsing history outside thomore.vn (no cross-site tracking).

Payment or credit card details — all payments go through third-party payment gateways (VietQR, MoMo, Shopee, TikTok); we only receive confirmation of the transaction status.

Biometric data, GPS location, phone contacts.

Account balances, payouts or detailed revenue from Shopee/TikTok.

4. How we use data

We do not use data obtained through platform APIs to: send automated marketing messages, broadcast, retarget advertising, train external AI models, or sell to third parties.

5. Legal basis for processing

Under Article 17 of Decree No. 13/2023/ND-CP, personal data is processed on the following bases:

• Consent of the data subject when placing an order or registering an account at thomore.vn.
• Performance of a contract for the sale of goods, or of a customer service contract with a Tenant.
• Legal obligations (keeping invoices under the Law on Accounting, keeping transaction records under the Law on E-commerce).
• Legitimate interests in caring for customers who have contacted us of their own accord through Thơmore’s official channels.

6. Sharing data with third parties

We do not sell personal data. Data is shared only with the following parties, and only to the minimum extent necessary:

Data is not used for: cross-platform targeted advertising, training external AI, or commercial sharing.

7. Storage and security

• Hosting: servers located in Vietnam (inet.vn), in compliance with the domestic data storage requirements of Decree No. 53/2022/ND-CP.
• Encryption in transit: TLS 1.3 (Let’s Encrypt certificates) for all connections.
• Encryption at rest: platform API tokens are encrypted with AES-256-GCM. Staff passwords are hashed with bcrypt, cost 12.
• Separation of data between Tenants: every query is bound to a tenant_id at the application layer, plus composite foreign keys at the database layer — one Tenant cannot access another Tenant’s data.
• Backups: daily pg_dump plus the attachment file volume, encrypted with age and stored on Cloudflare R2.
• Audit log: every customer merge/unmerge/deletion is recorded in audit_logs and kept for at least 5 years.
• Access control: JWT authentication plus role-based permissions (admin/staff); sessions expire after 7 days.

8. Retention periods

9. Rights of the data subject

Under Article 9 of Decree No. 13/2023/ND-CP, you have the following rights:

1. Right to be informed of what data about you is being processed, for what purpose, and who has access to it.
2. Right of access — to request a copy of your personal data.
3. Right to rectification of inaccurate data.
4. Right to request deletion of data (see Section 10).
5. Right to restrict processing of data in certain cases.
6. Right to object to processing for purposes outside the original contract.
7. Right to receive your data in a structured, machine-readable format.
8. Right to lodge a complaint with the Authority of Information Security (Ministry of Information and Communications) if we fail to comply.

To exercise these rights, please send your request together with proof of identity to [email protected]. We respond within 72 hours and complete the request within 30 days of verifying that it is valid.

10. User Data Deletion Instructions

This section implements the User Data Deletion Callback requirements of Meta App Review, Zalo OA, Shopee and TikTok.

10.1. How to request deletion

Send an email to: [email protected]

Subject: “Personal data deletion request” (or, in Vietnamese, “Yêu cầu xoá dữ liệu cá nhân”)

Please include:

• Your full name
• Your registered email / phone number
• Your identifier on the channel concerned (e.g. Facebook name, Instagram username, phone number used with Zalo OA)
• A short description of the data to be deleted (everything / only messages from date X / only contact details…)

10.2. Process

1. Thơmore confirms receipt of the request by email within 72 hours.
2. We verify the identity of the requester to avoid deleting the wrong data.
3. We carry out the deletion / anonymisation within 30 days.
4. We notify you by email when it is complete, confirming which fields have been processed.

10.3. What is deleted

After deletion, your name, avatar, phone number, message content and attachments are anonymised. We keep only a “skeleton” record (ID + timestamp) and an audit log entry as evidence that the deletion request was carried out (as required by the PDPL).

10.4. When data cannot be deleted immediately

Some data must be kept to meet legal obligations (e.g. invoices for 5 years under the Law on Accounting). In such cases, we will explain this clearly in our reply email.

11. Cookies and tracking technologies

The thomore.vn website uses:

• Strictly necessary technical cookies: to keep you logged in and maintain your cart — these cannot be switched off if you want to use the website.
• Analytics cookies (Google Analytics): to measure traffic anonymously — you can refuse them through your browser settings.
• We do not use Facebook Pixel, TikTok Pixel or any other third-party advertising trackers.

12. Protection of children

Thơmore’s services are not directed at children under 16 years of age. We do not knowingly collect data from children. If a parent finds that their child has provided information to us, please contact [email protected] to have it deleted.

13. Transfer of data abroad

Personal data is stored mainly in Vietnam. Some technical data (encrypted attachments, error logs) may be stored on Cloudflare R2, which uses global infrastructure. We have carried out an overseas data transfer impact assessment (TIA) under Article 25 of Decree No. 13/2023/ND-CP and submitted the dossier to the Authority of Information Security.

14. Personal data breaches

In the event of a personal data breach, we will:

• Notify the Ministry of Public Security (A05) within 72 hours of discovery, in accordance with Article 23 of Decree No. 13/2023/ND-CP.
• Notify affected data subjects by email/SMS as soon as possible.
• Publish the remedial measures on the website.

15. Complaints

If you believe that Thơmore has processed your personal data in breach of the regulations:

1. Step 1: Send a complaint to [email protected] — we respond within 72 hours.
2. Step 2: If you disagree with our response, you may lodge a complaint with the Authority of Information Security — Ministry of Information and Communications in accordance with the law.

16. Changes to this policy

This policy may be updated to reflect changes in the law or in our services. The date of the latest update is shown at the top of the page. Material changes (e.g. expanding the scope of collection, adding a third party) will be:

• Announced on the thomore.vn home page at least 7 days before they take effect.
• Emailed to customers with a registered account.

Continuing to use the services after the updated policy takes effect constitutes acceptance of the new version.

17. Contact

Thơmore Co., Ltd.

• Address: 172/44 An Dương Vương, TP. Hồ Chí Minh
• Phone: (028) 6675.6679
• Email: [email protected]
• DPO (Data Protection Officer) email: [email protected]
• Tax code: 0318772576