Data processing agreement

1. Basis and scope

This agreement is part of the Terms of service and covers the personal data of guests and staff a business puts on the platform operated by Mr Lê Anh Tuấn (an individual). It follows Vietnam’s Personal Data Protection Law No. 91/2025/QH15 and Decree 13/2023/ND-CP.

2. Roles

• The business is the data controller: it decides why and how its guests’ data is processed.
• HostBooking is the data processor: it processes only on the business’s instructions, as given through settings and actions on the platform.
• For the owner’s own account data, HostBooking is the controller under the Privacy policy.

3. Data and purposes

• Guests’ basic data: name, phone, email, country, dates, party size, notes, invoice details, booking and payment history, reviews.
• Staff data: name, email, phone, role, activity log.
• Purposes: taking and managing bookings, payment, confirmations and reminders, guest care, reports, system security.
• No sensitive personal data (health, biometrics, religion…) is processed. The business does not type such data into notes.

4. The business’s obligations

• Inform guests about processing (each booking site carries a template privacy policy in its footer; the business is responsible for it).
• Have a lawful basis: performing the booking contract, the guest’s consent, or a legal obligation.
• Prepare a personal data processing impact assessment where the law requires one.
• Receive and answer guests’ requests (access, correction, deletion…); HostBooking helps technically where needed.
• Give access to guest details only to staff who need it.

5. HostBooking’s obligations

• Process data only to provide the service to the business; never use a business’s guest data for its own purposes or sell it.
• Apply the safeguards in the Privacy policy: per-business isolation, encrypted secrets, permissions, logs.
• HostBooking’s people access a business’s data only to support it or handle an incident; every access is logged where the business can see it.
• Tell the business within 72 hours of discovering an incident affecting its data.
• Help the business answer data subjects and the authorities.

6. Sub-processors

The business agrees to HostBooking using these sub-processors; adding one updates this agreement and raises its version:

• A VPS provider in Vietnam — hosting and operation.
• Cloudflare — content delivery, firewall, bot protection.
• SePay — transfer matching; any payment gateway the business connects itself.
• Zalo (VNG), Google (Gmail, Firebase) — notifications, sign-in.
• Google Gemini, Groq, OpenRouter — AI processing at a user’s request.

7. Transfers abroad

Some sub-processors host data outside Vietnam. HostBooking prepares and keeps the cross-border transfer impact assessment, and sends only the data each task needs.

8. On termination

After the service ends the business has 30 days to export its data. After that HostBooking deletes the business’s guest and staff data from the live system; backups expire on their own rotation.

9. Contact

Personal data contact: the email, phone or Zalo at the foot of the page.