Data Protection Policy
VNPT Customer Data Protection Policy
Updated on January 01, 2026
VNPT Customer Data Protection Policy (hereinafter referred to as the “Policy”) is intended to inform Customer of the Customer Information processed by Vietnam Posts and Telecommunications Group (“VNPT”), the purposes of such processing, the types of information being processed, and the rights and obligations of Customer with respect to Customer Information in accordance with Vietnamese laws on the Protection of Customer Information. This Policy also provides recommendations to help Customer better understand and improve awareness of Customer Information protection.
This Policy is a general commitment that applies to all activities related to the provision of VNPT’s products and services and to channels interacting with Customer.
VNPT shall provide this Policy in full to Customer prior to entering into any contract or transaction, and for obtaining Customer’s consent to this Policy before carrying out any Customer Information processing activities in accordance with applicable law. By tapping the “Consent” box on VNPT’s service websites (web pages) or applications where this Policy is publicly displayed; or by signing a contract with VNPT that references and attaches this Policy; or through any other consent mechanisms implemented by VNPT from time to time, Customer confirms that you have carefully read, fully understood, and agree to this Policy.
Article 1. Definitions and Abbreviations
Within the scope of this Policy, the terms below shall be understood and interpreted as follows:
1. VNPT means Vietnam Posts and Telecommunications Group and its affiliated units.
2. Customer means an individual or the lawful representative of an individual or organization who provides Customer Information to VNPT when searching for, accessing, purchasing, registering for, or using VNPT’s products and services.
3. VNPT Products and Services means any products or services provided by VNPT and/or provided in cooperation with its partners, which are searched for, accessed, purchased, registered for, or used by Customer.
4. Customer Information includes (i) personal data as defined under applicable laws on personal data protection, and (ii) information relating to the Customer’s purchase and use of products and services, as well as other information related to transactions between Customer and VNPT.
Article 2. Processing of Customer Information
1. VNPT shall notify Customer of this Policy and obtaining Customer’s consent before carrying out any Customer Information processing. Customer Information is collected and processed from the following sources:
a) When Customer or their lawful representative contacts VNPT to request consultation on VNPT Products and Services or expresses interest in such products and services;
b) When Customer uses, enters into a contract for, registers for, or purchases VNPT Products and Services;
c) When Customer accesses and/or registers an account on VNPT’s service websites/applications;
d) When Customer voluntarily provides Customer Information to VNPT through channels such as websites/applications, meetings, events, seminars, conferences, social networks, dialogue or survey programs organized, sponsored, or attended by VNPT, and/or from cookies stored on VNPT’s websites/applications, or through communications with VNPT (including mail, telephone, online channels, call centers, or other forms);
e) When Customer of an organization or enterprise authorizes such organization or enterprise to share Customer Information with VNPT;
f) When Customer is a customer of an organization or enterprise in which VNPT invests or holds shares, or of an organization or enterprise that cooperates with VNPT in providing products or services;
g) When requested by competent state authorities;
h) When VNPT carries out activities for the purposes of Customer Information processing as set out in Article 3 of this Policy;
i) Other cases as provided by applicable law.
2. Customer personal data processed by VNPT (hereinafter referred to as “Personal Data”) includes:
2.1. Basic personal data:
a) Full name at birth and other names (if any);
b) Date, month, and year of birth; date, month, and year of death or disappearance;
c) Gender;
d) Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, and contact address;
e) Nationality;
f) Personal images;
g) Phone number, personal identification number, passport number, driver’s license number, and vehicle plate number;
h) Family relationship information (parents, children, spouse);
i) Information on personal digital accounts and data generated during the use of products and services;
j) IP address information, identifying cookies, and device identifiers;
k) Any other information associated with or capable of identifying a specific individual.
2.2. Sensitive personal data:
a) Biometric and genetic data;
b) Username and password of electronic identification accounts; images of ID card, citizen identification card, or national ID card;
c) Customer telecommunications account information;
d) Bank account login credentials, bank card information, transaction history, financial and credit information, and transaction data related to payment intermediary services;
e) Behavioral data and usage data relating to telecommunications services, social networks, online communication services, and other online services;
f) Location data of an individual derived from location-based services;
g) Other personal data classified by law as confidential or requiring enhanced protection measures.
2.3. VNPT shall inform Customer of the Customer Information which is mandatory to provide (“Mandatory Customer Information”) and the Customer Information which may be optionally provided at Customer’s choice (“Optional Customer Information”) at the time Customer contacts, communicates with, registers with, or enters into a contract with VNPT. Mandatory Customer Information means Customer Information that VNPT is required to collect under applicable law, or information that VNPT must necessarily use in order to provide part or all of VNPT’s Products and Services as requested by Customer. Optional Customer Information means Customer Information collected by VNPT to improve customer experience, predict consumer behavior, or conduct service market research. Failure to provide Optional Customer Information will not affect the provision of VNPT’s Products and Services as requested by Customer.
If Mandatory Customer Information is not provided to VNPT, Customer may be unable to use VNPT’s Products and Services. In such cases, VNPT may refuse to provide the relevant products or services to Customer without any obligation to pay compensation and/or penalties (except where such failure is due to VNPT’s fault or otherwise required by applicable law).
2.4. VNPT may, either directly or through authorization or outsourcing to third parties, conduct the processing of Customer Information, provided that such processing ensures the safety and security of Customer Information according to applicable law. Where VNPT authorizes or engages a third party to process Customer Information, Customer consent shall be required, except in the cases specified in Clause 1 Article 4 of this Policy. Such authorization or outsourcing must be made in writing and clearly set out each party’s scope of and responsibilities of each party in protecting Customer Information according to applicable law. Where Customer conducts transactions through a third party, such third party shall be responsible for protecting Customer Information in accordance with applicable law.
Article 3. Purposes of Processing Customer Information
1. VNPT is permitted to process Customer Information in the following cases (“Mandatory Purposes”):
a) To provide VNPT Products and Services as requested by Customer, and only within the scope of information to which Customer has consented (pursuant to Article 18.3(b) of the 2023 Law on Consumer Rights Protection), including:
- Verifying the accuracy and completeness of information provided by Customer in accordance with applicable law; identifying or authenticating Customer and performing customer verification procedures; processing registration for VNPT Products and Services;
- Reviewing Customer applications and assessing eligibility to use VNPT Products and Services. VNPT may use scoring methods, set credit thresholds, and check Customer’s usage history of VNPT Products and Services to assess and manage credit risk, and to ensure payment capability and other related obligations throughout the service provision period;
- Performing Customer’s rights and obligations under applicable law and contracts between Customer and VNPT;
- Notifying Customer of network impact plans related to VNPT Products and Services;
- Managing Customer accounts and loyalty programs;
- Receiving and settling Customer requests, complaints, and claims; and sending surveys to assess Customer satisfaction with product/service quality or VNPT’s complain settlement process;
- Contacting Customer for consultation, information exchange, handling requests or complaints, and delivering invoices, statements, reports, or other related documents via various channels (e.g., email, chat), as well as responding to Customer inquiries. Contacting Customer (or parties designated by Customer) to provide information related to the use of VNPT Products and Services;
- Evaluating business performance of internal units; operating internal management systems, performance evaluation systems, and monitoring systems for business activities;
- Preparing documents for bidding participation or invitations to tender; preparing reports, statistics, and internal data analysis for research, development, management, measurement, improvement of products/services, and business operations;
- Assessing Customer’s likelihood of purchasing or using VNPT Products and Services based on telecommunications credit scoring to better support service provision;
- Providing information requested by Customer or that VNPT reasonably believes may be useful to Customer, including information about VNPT Products and Services as permitted by law;
- Improving technology and user interfaces of websites/applications to optimize Customer experience;
- Detecting and preventing fraud, deception, cyberattacks, unauthorized access or appropriation, and other unlawful activities.
b) To fulfill obligations according to applicable laws (pursuant to Article 18.3(c) of the 2023 Law on Consumer Rights Protection), including:
- Fulfilling VNPT’s legal obligations and responding to requests from competent state authorities, such as inspections, audits, reporting, finance, accounting, taxation, risk management, anti–money laundering, and counter-terrorism financing;
- Detecting and preventing violations of law as required by competent state authorities and/or applicable laws;
- Processing Customer Information on an urgent basis where necessary to protect the life, health, honor, dignity, rights, or lawful interests of data subjects or others; or to protect legitimate rights and interests of VNPT, other persons, or the State, organizations, and agencies against infringements.
- Settling emergency situations, threats to national security even if they have not been officially declared as emergencies; preventing and combating riots, terrorism, crimes, and other illegal activities;
- Carrying out agreements between the data subject and relevant organizations or individuals in accordance with applicable law;
- Disclosing Customer Information as required by law; and complying with the legal obligations of telecommunications, broadcasting, payment intermediary, and mobile money service providers.
2. Except as provided in Clause 1 of this Article, VNPT shall notify Customer and obtain Customer’s consent prior to processing Customer Information for the purposes listed below (hereinafter referred to as the “Optional Purposes”). Any Customer Information collected, updated, or supplemented shall be relevant to and limited within the scope and purposes of processing set out in this Policy.
a. Purposes of business provision of personal data processing services (including but not limited to credit scoring, credit rating, credit information assessment, and creditworthiness evaluation), data products and services, authentication services, and identification services.
b. Purposes of business provision of advertising services, marketing services, market research services, opinion polling services, and brokerage services. For marketing services, the methods, forms, and frequency of product introduction shall comply with applicable personal data protection laws.
c. Using Customer personal data for research and development of machine learning algorithms, artificial intelligence systems, and other automated systems, and/or for processing personal data using blockchain technology, artificial intelligence, and big data analytics for the research and development of products, services, applications, or systems.
d. Organizing promotional programs, product introductions, and trade promotion activities related to goods, products, and services provided by VNPT to the Customer, including activities that use Customer Information for advertising and marketing purposes such as promotions, research, surveys, news updates, information updates, events, prize-based contests, distribution of related rewards, as well as advertisements and related content about VNPT Products and Services.
3. VNPT shall not carry out the purchase or sale of Customer Information in any form.
Article 4. Scope of Customer Information Usage
1. VNPT is allowed to share Customer Information with the organizations and individuals as below for the purposes set out in this Policy (“Mandatory Scope of Use”), as follows:
a) Sharing information with third-party service providers to VNPT or business partners under business cooperation agreements for the development of VNPT Product and Service, where the parties have entered into a written agreement requiring the third party to protect Customer Information (pursuant to Article 18.4(a) of the 2023 Law on Consumer Rights Protection). For example, VNPT may engage and/or cooperate with other companies and individuals to execute certain tasks and programs, such as advertising and promotional programs for Customer, market research, analysis and product development, strategic consulting, and billing collection services. These third-party service providers and/or partners may access, collect, use, and process Customer Information within the scope agreed by Customer and authorized by VNPT to fulfill their functions, and must comply with applicable laws on Customer Information protection as Data Processors. A written data processing agreement shall be executed, clearly defining the scope, purposes, types of Customer Information shared, the rights and obligations of the parties, and the responsibilities of the data processor in protecting Customer Information.
b) Sharing information with telecommunications enterprises that have entered into written agreements with VNPT on the exchange and provision of subscriber information and information on users’ telecommunications service usage for billing and invoicing purposes (pursuant to Article 6.4(b) of the 2023 Telecommunications Law);
c) Providing telecommunications subscriber information of users who evade payment obligations for telecommunications services in accordance with applicable law (pursuant to Article 6.4(c) of the 2023 Telecommunications Law);
d) When required by competent state authorities in accordance with applicable law.
2. Except for the entities specified in Clause 1 of this Article, any sharing of Customer Information with any other third party shall require Customer’s consent (“Optional Scope of Use”).
Article 5. Rights of Customer
1. Right to be Informed and Right to Consent
Customer has the right to be informed about the processing of their Customer Information, unless otherwise provided by law.
Customer has the right to agree or disagree with the terms and conditions of this Policy through methods instructed by VNPT via channels such as SMS messages, phone calls, checkboxes on service websites/applications, or by contacting VNPT’s customer care hotline, in accordance with applicable law. VNPT shall only process Customer Information upon obtaining Customer’s consent, unless otherwise required by law.
2. Right to View and Request Provision of Customer Information
Customer has the right to access VNPT’s service applications/websites and/or contact VNPT directly to view, edit, or extract their Customer Information, unless otherwise provided by law.
Where Customer is unable to access to view, edit, or extract Customer Information, or encounters difficulties in doing so, Customer may contact VNPT for prompt assistance.
3. Right to Edit or Request Correction of Personal Data
Customer has the right to view and edit their Customer Information, provided that such edit does not violate any applicable laws. Where Customer is unable to amend Customer Information, or encounters difficulties in doing so, Customer may contact VNPT for prompt assistance.
4. Right to Object, Restrict, and Withdraw Consent for Data Processing
a) Customer has the right to object to, request the restriction of, or withdraw consent for the processing of Customer Information where there are concerns regarding the scope or purposes of personal data processing or the accuracy of such data, unless otherwise provided by law. However, objection to, restriction of, or withdrawal of consent in relation to Mandatory Customer Information as set out in Article 2, or processing for the Mandatory Purposes specified in Clause 1, Article 3 of this Policy, or the Mandatory Scope of Use specified in Clause 1, Article 4 of this Policy, may result in VNPT being unable to provide its products and services to Customer. In such cases, VNPT may consider suspending service provision or unilaterally terminating the contract without having to compensate Customer, as the conditions for contract performance have changed (except where caused by VNPT’s fault).
b) Where Customer wishes to object to, restrict, or withdraw consent for the processing of Customer Information for the Optional Purposes set out in Clause 2, Article 3 of this Policy, or for Optional Customer Information, or for the Optional Scope of Use set out in Clause 2, Article 4, Customer shall follow the VNPT’s instructions at the time Customer Information is collected or contact VNPT using the contact details provided in this Policy. If Customer no longer wishes to receive notifications from VNPT’s service applications, Customer may adjust notification settings within the application or on their device.
5. Right to Delete Customer Information
Customer has the right to request VNPT to delete their Customer Information, provided that such request complies with applicable laws and does not fall within cases where VNPT is required to store information according to legal regulations.
However, a request to delete Customer Information that is mandatorily required under law may cause VNPT to be unable to provide products and services to the Customer. It means VNPT may unilaterally terminate the contract without having to compensate Customer, as the conditions for contract performance have changed (except in cases due to VNPT's fault or as otherwise stipulated by law).
6. Right to Lodge Complaint, Make Denounciation, or Initiate Legal Proceeding
Customer has the right to lodge complaints, make denunciations, or initiate legal proceedings according to the applicable laws.
7. Right to Claim Compensation for Damages
The Customer has the right to claim compensation for damages in accordance with applicable laws where violations relating to the protection of their Customer Information occur, unless otherwise agreed by the parties or otherwise provided by law.
8. Right to Request Protection Measures
The Customer has the right to request competent authorities or relevant organizations, entities, or individuals involved in personal data processing to implement measures and solutions to protect their personal data under applicable laws.
Article 6. Obligations of Customer
Customer shall be responsible for protecting their Customer Information as follows:
1. Protect their own personal data;
2. Proactively implement measures to protect, manage, and safely use their accounts and personal technological devices (including devices such as smartphones, computers, tablets, laptops) by logging out of accounts after use, setting a strong password, and keeping their login credentials and password confidential. The aforementioned measures for protecting and managing the safe use of accounts and mobile devices help prevent unauthorized access to the Customer's account. VNPT shall not be liable for any damages incurred by the Customer in cases where the Customer’s password is disclosed, lost, or stolen, resulting in unauthorized access to the account; or where any activities on the Customer’s account are performed on a lost or misplaced mobile device leading to unauthorized use of the service; or where VNPT’s system is unlawfully breached by a third party despite VNPT having fully implemented measures to protect the system (except in cases caused by VNPT’s fault);
3. Once this Policy has been accepted, Customer shall be responsible for providing and updating their Customer Information fully and accurately in accordance with applicable laws and with the contract or when consenting to the processing of their personal data. Customer shall also promptly notify VNPT upon discovering any violation of Customer Information protection regulations.
4. The Customer is responsible for respecting the Customer Information of other data subjects and complying with applicable laws on the protection of Customer Information, as well as participating in efforts to prevent and combat any activities that infringe upon Customer Information.
Article 7. Principles for Exercising Customer’s Rights and Bbligations
1. When exercising their rights and obligations, Customer must comply with the following principles:
a) Compliance with applicable laws and contractual obligations. The exercise of the Customer’s rights and obligations must aim to protect the Customer’s own legitimate rights and interests;
b) Not causing any obstruction or hindrance to the exercise of legal rights and obligations of VNPT and other parties as prescribed by the Law on Personal Data Protection;
b) Not infringing upon the legitimate rights and interests of the State, regulatory authorities, organizations, or other individuals.
2. In cases where the Customer exercises the rights set out in Article 5 of this Policy but fails to comply with the principles stated in Clause 1 of this Article, or does not follow the VNPT’s procedures or instructions from time to time, VNPT may refuse to fulfill the Customer’s requests until the Customer fully meets the conditions above.
Article 8. Processing of Personal Data of Customer Under 16 Years Old
1. For individual customer aged from 7 (seven) to under 16 (sixteen) years old (“Child Customers”), VNPT shall verify the Customer’s age before processing their Customer Information.
2. In cases where Child Customers purchase, register for, or use VNPT Products and Services, VNPT will obtain consent through the Child Customer’s parent or legal guardian. The parent or legal guardian shall provide confirmation of consent regarding the processing of the Child Customer’s personal data, except where otherwise required by law.
Article 9. Customer Information Storage
1. Storage location of Customer Information: To the extent permitted by law, VNPT may store Customer Information in Vietnam or abroad, including on cloud computing storage solutions. VNPT shall applies data security standards in accordance with applicable laws and regulations.
2. Storage duration of Customer Information: Unless otherwise required by law, VNPT shall retain Customer Information only for fulfilling the Mandatory Purposes (and Optional Purposes where Customer has given consent) as specified in this Policy.
Article 10. VNPT’s Obligations and Measures to Protect Customer Information
1. Customer Information is committed to be kept confidential in accordance with applicable laws and this Policy. VNPT may use technology to process Customer Information and shall implement appropriate protection measures in compliance with applicable laws, including measures to prevent the following actions:
a) Unauthorized theft or access to information;
b) Unauthorized use of information;
c) Unauthorized edit, update, or deletion of information.
2. VNPT will applie physical, electronic, and administrative measures to protect Customer Information, including:
a) VNPT’s official website servers and all information systems containing Customer Information are protected by security measures and technologies such as firewalls, encryption, and intrusion prevention systems. VNPT also implements personnel control measures and establishes inspection, assessment, and audit procedures to prevent violations of Customer Information protection regulations.
c) VNPT shall take all necessary measures to ensure that Customer Information is processed only for the notified purposes and as consented by Customer. VNPT shall comply with applicable legal requirements relating to the processing of Customer Information at any time.
3. VNPT shall process the Customer’s requests related to Customer Information, provided that such requests comply with applicable laws and with VNPT’s procedures and instructions as issued from time to time.
4. In the event that the information system is attacked, giving rise to risks to the safety or security of Customer Information, VNPT or the relevant data storage service provider shall notify the competent state authorities within the time limit prescribed by law and implement necessary measures to ensure the safety and security of Customer Information in accordance with law on cybersecurity, network information security, electronic transactions, and other relevant legal provisions.
5. Other obligations as prescribed by applicable law and this Policy.
Article 11. Internet Advertising and Third Parties
VNPT’s service websites/applications may include third-party advertisements and links to other service websites/applications. Third-party advertising partners may collect information about Customer when Customer interacts with their content, advertisements, or services. All access to and use of third-party links or websites are not governed by this Policy, but are instead governed by the privacy policies of those third parties.
Article 12. Governing Law
This Policy is drafted and governed by the laws of Vietnam.
Article 13. Language
This Policy is originally made in the Vietnamese language. Any its translation is solely for reference. In the event of any inconsistency between different language version, the Vietnamese verson shall prevail.
Article 14. Contact Information
If Customer has any questions regarding this Policy or wishes to exercise Customer’s rights in relation to Customer Information, please contact VNPT through the following methods and information:
1. Contact Call Center provided on VNPT’s official service websites/applications from time to time.
2. Contact in person at VNPT’s transaction points nationwide.
3. Other contact methods such as Live Chat (online chat software), VNPT’s official fanpage, or customer support email, as made available to the Customer at any time.
-----------------------------------------------------------------------------------------------
Confirmation of Consent for Customer Information Processing Purposes
By ticking the boxes below, Customer confirms consent for VNPT to process Customer Information for the purposes as follow:
Provide VNPT’s products and services
(Providing VNPT Products and Services as requested by Customer, and only within the scope of information to which Customer has consented)
Fulfilling obligations according to applicable laws
• Carrying out business of products, services on personal data
(Purposes of business provision of personal data processing services (including but not limited to credit scoring, credit rating, credit information assessment, and creditworthiness evaluation), data products and services, authentication services, and identification services)
• Carrying out business in advertising, marketing, market research, opinion polling and brokerage services
(Purposes of business provision of advertising services, marketing services, market research services, opinion polling services, and brokerage services)
• Carrying out research and development activities
(Using Customer personal data for research and development of machine learning algorithms, artificial intelligence systems, and other automated systems, and/or for processing personal data using blockchain technology, artificial intelligence, and big data analytics for the research and development of products, services, applications, or systems)
• Advertising and introducing VNPT’s products, goods, and services
(Organizing promotional programs, product introductions, and trade promotion activities related to goods, products, and services provided by VNPT to the Customer, including activities that use Customer Information for advertising and marketing purposes such as promotions, research, surveys, news updates, information updates, events, prize-based contests, distribution of related rewards, as well as advertisements and related content about VNPT Products and Services)