Privacy Policy

This Privacy Policy explains how we collect, use, store, and share your personal information when you visit thienyhue.com or book.thienyhue.com (“the Site”), or when you stay at Thiên Ý — Huế Citadel Villas & Hotel (“the Property”).

We take your privacy seriously and comply with the European Union General Data Protection Regulation (GDPR), the Vietnamese Decree 13/2023/NĐ-CP on Personal Data Protection, and the Hong Kong Personal Data (Privacy) Ordinance, as applicable.

1. Who is responsible for your data

Công ty TNHH Thương Mại và Đầu tư LOR ("LOR", "the Operating Entity", "we", "us", or "our") — a limited liability company registered in Vietnam — is the sole controller of your personal data, including reservation data, on-property data (identity registration with Vietnamese authorities, in-stay services, concierge requests), and marketing communications.

For guests paying by international card, Sen Hong Invest Limited (Hong Kong, Company Number 3030113, Business Registration Number 72803905, registered office at Flat/Room 2105, 21st Floor, Chung Kiu Commercial Building, 47–51 Shantung Street, Mongkok, Kowloon, Hong Kong) facilitates your card payment as our payment services partner, acting on our instructions and only for the purpose of processing your payment. It is not an independent controller of your data. Neither LOR nor Sen Hong Invest Limited ever has access to your full card number or other sensitive payment credentials — these are handled directly by our payment processor, Stripe, under industry-standard tokenisation (see Section 9).

For any data-protection question, write to contact@thienyhue.com.

2. What data we collect

2.1 Data you give us when booking

• Full name, date of birth, nationality
• Contact details: email, phone number, postal address
• Identity document type, number, and expiry (passport, national ID, driver’s licence)
• Visa type and entry date (for foreign guests)
• Card payment details (handled by our payment processor — see Section 5)
• Special requests, dietary preferences, allergies
• Travel companions’ names and ages (where applicable)

2.2 Data we collect during your stay

• Check-in and check-out timestamps
• Charges to your folio (room, food and beverage, concierge services)
• Photographs taken with your consent for marketing (we always ask first)
• Any incident reports relating to the Property

2.3 Data we collect automatically when you visit the Site

• IP address, browser type, device, operating system
• Pages visited, time spent, referring website
• Cookies and similar technologies — see Section 8

2.4 Data we collect from third parties

• Booking platform data (if you book through OTAs like Booking.com or Agoda)
• Marketing analytics from Google Analytics (with your consent)
• Payment confirmation data from Stripe (our card processor)

3. Why we collect it (purpose) and our legal basis

Purpose	Legal basis (GDPR)
Process your reservation and provide accommodation	Performance of a contract (Art. 6.1.b)
Process card deposits and staged payments	Performance of a contract (Art. 6.1.b)
Register your stay with Vietnamese authorities	Legal obligation (Art. 6.1.c — Vietnamese residence law)
Issue VAT invoices and keep accounting records	Legal obligation (Art. 6.1.c — Vietnamese tax law)
Communicate with you about your reservation	Performance of a contract (Art. 6.1.b)
Send you marketing emails (post-stay)	Consent (Art. 6.1.a) — you may opt out at any time
Personalise your stay (dietary, anniversaries, etc.)	Consent (Art. 6.1.a)
Analyse Site traffic to improve our service	Legitimate interest (Art. 6.1.f), with consent for cookies
Comply with anti-fraud and chargeback investigations	Legitimate interest (Art. 6.1.f)

For data subject to Vietnamese Decree 13/2023, the equivalent legal bases (contract performance, legal obligation, consent, and legitimate interest) apply.

4. How long we keep your data

Data category	Retention period
Reservation and stay records	5 years (Vietnamese tax and commercial law)
Identity document copies	5 years (Vietnamese hospitality law)
Card payment data	Stored only by our payment processor, per their retention rules
Marketing email list	Until you unsubscribe, then up to 30 days for unsubscribe confirmation
Website analytics	14 months (Google Analytics default)
Email correspondence	3 years after last contact
Incident reports	5 years

After these periods, data is securely deleted or anonymised.

5. Who we share your data with

We do not sell your personal data. We share it only with the following categories of recipients, and only to the extent necessary:

• Stripe Inc. (United States and Hong Kong) — our card payment processor for international reservations. Stripe is PCI-DSS Level 1 certified, the highest standard in the industry. See Stripe’s Privacy Policy.
• Currenxie (Hong Kong) — our banking partner for receipt of card settlements from Stripe.
• BIDV and Vietinbank (Vietnam) — our domestic banks, receiving bank transfers.
• Vietnamese public security authorities — for legally mandated residence registration, as required by Vietnamese law for all hotel guests.
• Vietnamese tax authorities — for VAT invoice and tax filings.
• Booking platforms (OTAs) — only if you booked through them, and only the data needed to fulfil that booking.
• Translation services — open-source, on-premises translation (Argos Translate) running on our own servers; your messages are not sent to third-party translation APIs.
• Email and SMS providers — to send you reservation confirmations and operational communications.
• Professional advisors — accountants, auditors, and lawyers, under strict confidentiality, only when needed.

We never sell, rent, or trade your personal data with any third party for their own marketing purposes.

6. International transfers

Because our payment services partner, Sen Hong Invest Limited, is in Hong Kong, and our payment processor Stripe operates internationally, your card payment data may be transferred between Hong Kong, Vietnam, and the European Economic Area or other jurisdictions where Stripe operates.

For transfers from the European Economic Area, we rely on:

• Standard Contractual Clauses approved by the European Commission, where applicable, and
• The Hong Kong–EU adequacy regime where it applies, and
• For data shared with Vietnamese authorities under legal obligation, the GDPR exception in Article 49(1)(d).

7. Your rights

You have the following rights regarding your personal data (subject to local exceptions, in particular Vietnamese legal-obligation data):

• Right of access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure (“right to be forgotten”) — ask us to delete your data, subject to legal retention requirements
• Right to restrict processing — ask us to stop processing your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest, in particular marketing
• Right to withdraw consent — at any time, for processing based on consent
• Right to lodge a complaint — with the relevant data protection authority (your national authority within the EU, the Hong Kong Privacy Commissioner, or the Vietnamese Ministry of Public Security’s Department of Cybersecurity)

To exercise any of these rights, email contact@thienyhue.com. We will respond within 30 days.

8. Cookies and similar technologies

We use cookies on the Site to make it work, remember your preferences, and understand how guests use it. A cookie is a small text file stored on your device.

8.1 Categories of cookies we use

• Strictly necessary cookies — required for the Site to work (session, security, language preference, shopping basket). No consent required.
• Functional cookies — remember your preferences (currency, recently viewed villas). Consent required.
• Analytics cookies — Google Analytics, helping us understand traffic and improve the Site. Consent required.
• Cookieless visit statistics — our own visitor counter (Umami), run on our own server and not shared with anyone. It records which pages are viewed, the referring site, country and device type, without cookies and without storing your IP address or any identifier, so no consent is needed. It is not loaded when “Do Not Track” is enabled.
• Marketing cookies — currently none. If we introduce any in future, we will update this Policy and ask your consent.

8.2 Managing your cookie preferences

When you first visit the Site, you will see a cookie banner letting you accept all cookies, accept only essential cookies, or customise your choice. You can change your preferences at any time by clicking “Cookie settings” in the footer of any page.

You can also manage cookies through your browser settings — see your browser’s help pages for instructions.

8.3 Do Not Track

We respect the “Do Not Track” browser setting where technically feasible. When DNT is enabled, we do not load analytics or marketing cookies even if you have previously consented.

9. Security

We take appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS / TLS) on all websites and internal services
• Encrypted backups of our database
• Strict access control: only authorised staff who need data for their role have access
• Tokenisation of card data via Stripe — we never see your full card number
• Regular software updates and security patches
• Vulnerability monitoring of our infrastructure
• Staff training on data protection and confidentiality

In the unlikely event of a data breach affecting your personal data, we will notify you and the relevant authorities within 72 hours of becoming aware, as required by GDPR and Vietnamese law.

10. Children

Our service is not directed at children under 16. We do not knowingly collect personal data from children. Children may stay at the Property as part of a family reservation; in that case, their data is treated as part of the parent or guardian’s reservation, and only the minimum information required by law (name, age, identity document where applicable) is collected.

11. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top reflects the current version. Material changes will be notified to you by email if you have an active reservation or are on our marketing list.

12. Contact and complaints

For any privacy question, request, or complaint:

• Email: contact@thienyhue.com
• Property: Thiên Ý — Huế Citadel Villas & Hotel, Kiệt 31 Nguyễn Thiện Thuật, Huế, Vietnam

For the specific channels, process, and response timeframes we use to receive and resolve privacy-related requests or complaints, see our Feedback & Complaints page. If you are not satisfied with our response, you also have the right to lodge a complaint with your local data protection authority.