1. General Information
This Personal Data Protection Policy ("Policy") is issued by Indochina Link Vietnam Co., Ltd. (Tax Code: 0314028165, Accounting License No. 157/KDKET) in compliance with Law on Personal Data Protection (No. 91/2025/QH15), effective from July 1, 2023 ("PDPL" or "Vietnam's Personal Data Protection Decree").
This Policy regulates Indochina Link Vietnam's processing of personal data belonging to:
- Clients who engage our accounting, tax, payroll, and advisory services
- Employees of client companies whose data is processed as part of our service delivery (e.g., payroll processing, PIT filing, work permit applications)
- Third parties whose personal data is provided to us under a service agreement, where the Client represents and warrants that such data was legally collected with proper consent
- Website visitors who submit information through contact forms or newsletter subscriptions
2. Definitions
| Term | Definition |
|---|---|
| Personal Data | Information in the form of symbols, letters, numbers, images, sounds, or similar in a digital environment that identifies or is capable of identifying a specific individual (Article 2, Law 91/2025) |
| Basic Personal Data | Name, date of birth, gender, nationality, address, phone number, email, ID/passport number, tax identification number, social insurance number |
| Sensitive Personal Data | Financial data, health records, biometric data, religious belief, political opinion, criminal records, and location data (Article 2.4, Law 91/2025) |
| Data Controller | The entity that determines the purpose and means of personal data processing |
| Data Processor | The entity that processes personal data on behalf of the Data Controller |
3. Our Role as Controller and Processor
In delivering our services, Indochina Link Vietnam acts in the following capacities:
- Data Controller: When we collect personal data directly from clients and website visitors for our own business purposes (e.g., responding to inquiries, managing client relationships)
- Data Processor: When we process employee personal data on behalf of our clients (e.g., payroll processing, PIT declarations, SHUI registration, work permit applications)
When acting as a Data Processor, we process personal data solely in accordance with the Client's instructions and the terms of the service agreement. We do not use Client employee data for our own purposes.
4. Types of Personal Data We Process
4.1 Basic Personal Data
- Full name (Vietnamese and international spelling)
- Date of birth, gender, nationality
- ID card / Passport / CCCD number
- Tax Identification Number (TIN / MST)
- Social Insurance book number
- Phone number and email address
- Residential and permanent address
- Employment information (position, department, contract type)
4.2 Sensitive Personal Data
In the course of providing accounting, payroll, and immigration services, we may process:
- Financial data: Salary details, bank account numbers, tax deductions, insurance contributions
- Health records: Health check results (for Work Permit applications)
- Criminal records: Background check documents (for Work Permit applications)
- Biometric data: Photos (for Work Permit and TRC applications)
Processing of sensitive personal data requires explicit consent from the data subject, which is obtained through our client engagement process.
5. Purpose of Data Processing
We process personal data for the following purposes:
- Service Delivery: Accounting, bookkeeping, payroll, tax compliance, audit support, and immigration services
- Legal Compliance: Filing tax returns, SHUI declarations, and statutory reports as required by Vietnamese law
- Client Communication: Service updates, regulatory advisories, and responding to inquiries
- Risk Management: Conflict checking, anti-money laundering compliance (Decree 19/2023/ND-CP), and internal quality control
- Legitimate Business Interests: Record keeping, audit trail maintenance, and dispute resolution
6. Data Collection Methods
We collect personal data through:
- Direct submission by clients via engagement letters and service agreements
- Website contact forms and newsletter subscriptions
- Email correspondence and telephone communications
- Data transfer from client systems (payroll data, employee records)
- Public registries and government databases (for verification purposes)
7. Data Processing Methods
- Manual Processing: Physical document handling, meetings, and verbal instructions
- Automated Processing: Electronic data entry, payroll computation systems, accounting software, and e-filing with government portals
All processing methods are subject to our internal security protocols and access controls. Automated processing does not involve profiling or automated decision-making that produces legal effects on data subjects.
8. Data Retention
We retain personal data in accordance with the following Vietnamese legal requirements:
| Document Type | Retention Period | Legal Basis |
|---|---|---|
| Accounting documents (invoices, receipts, journals) | Minimum 5 years | Law on Accounting (88/2015/QH13), Article 41 |
| Financial statements and audit reports | Minimum 10 years | Law on Accounting (88/2015/QH13), Article 41 |
| Tax returns and supporting documentation | Minimum 10 years | Law on Tax Administration (38/2019/QH14, as amended by Law 56/2024/QH15) |
| Payroll records and SHUI documentation | Minimum 10 years | Law on Social Insurance (41/2024/QH15) |
| Employment contracts and labor records | Minimum 5 years after termination | Labor Code 2019 (45/2019/QH14) |
| Website contact form submissions | Maximum 3 years | Personal Data Protection Law (91/2025/QH15) |
Upon expiry of the applicable retention period, personal data is securely deleted or anonymized unless continued processing is required by law.
9. Data Subject Rights
Under Law on Personal Data Protection (91/2025/QH15), you have the following rights regarding your personal data:
- Right to Know: Be informed about the processing of your personal data
- Right to Consent: Give, withdraw, or modify consent for data processing
- Right to Access: Request access to your personal data held by us
- Right to Correction: Request correction of inaccurate or incomplete data
- Right to Deletion: Request deletion of your data (subject to legal retention obligations)
- Right to Restrict Processing: Limit how your data is processed
- Right to Data Portability: Receive your data in a structured, commonly used format
- Right to Object: Object to data processing in certain circumstances
- Right to Complain: File complaints with the Ministry of Public Security or competent authorities
- Right to Compensation: Seek damages for violations of your data protection rights
To exercise any of these rights, please submit a written request to info@indochinalink.com. We will respond within 72 hours of receiving a valid request, as required by the Personal Data Protection Law (91/2025/QH15). Additional identity verification may be required.
10. Data Security Measures
We implement the following technical and organizational measures to protect personal data:
- Encryption: All data in transit is encrypted via TLS/HTTPS. Sensitive files are encrypted at rest.
- Access Controls: Role-based access limits data visibility to authorized personnel only
- Infrastructure Security: Cloudflare WAF, DDoS protection, and enterprise-grade hosting
- Physical Security: Controlled access to office premises where physical documents are stored
- Staff Training: Regular training on data protection obligations under the Personal Data Protection Law (91/2025/QH15)
- Incident Response: Documented breach notification procedures — within 72 hours to the Ministry of Public Security as required by law
11. Cross-Border Data Transfer
In the ordinary course of our services, personal data is processed and stored within Vietnam. If cross-border transfer is required (e.g., providing reports to a Client's overseas parent company), we comply with the requirements of the Personal Data Protection Law (91/2025/QH15), including:
- Obtaining data subject consent for cross-border transfer
- Preparing and filing an Impact Assessment Dossier with the Ministry of Public Security
- Ensuring the receiving country provides adequate data protection safeguards
12. Client Obligations
When providing personal data to Indochina Link Vietnam, Clients are obligated to:
- Ensure that all personal data provided was collected lawfully and with proper consent
- Inform data subjects that their data will be shared with Indochina Link Vietnam for service delivery
- Ensure the accuracy and completeness of the personal data provided
- Comply with their own obligations under Personal Data Protection Law (91/2025/QH15)
13. Changes to This Policy
This Policy may be updated to reflect changes in Vietnamese law or our data processing practices. Material changes will be communicated to Clients through our regular advisory channels. The "Last updated" date at the top of this page reflects the most recent revision.
14. Governing Law and Dispute Resolution
This Policy is governed by the laws of the Socialist Republic of Vietnam, including the Personal Data Protection Law (No. 91/2025/QH15). Disputes arising from this Policy shall be resolved through negotiation, and if unsuccessful, submitted to the competent courts in Ho Chi Minh City, Vietnam.
15. Contact Information
For any questions or requests regarding this Personal Data Protection Policy:
- Company: Indochina Link Vietnam Co., Ltd.
- Registered Office: Level 3, An Phu Plaza, 117-119 Ly Chinh Thang, Xuan Hoa ward, Ho Chi Minh City, Vietnam
- Email: info@indochinalink.com
- Phone: +84 282 2468 007
- Tax Code: 0314028165