Privacy policy

1. Who we are

madenvietnam (madenvietnam.com) is a business-to-business marketplace that connects buyers with Vietnamese suppliers. It is operated by [Company legal name], enterprise code [Enterprise registration number], with its registered office at [Registered address] ("madenvietnam", "we", "us").

For the personal data processed to run the marketplace, we are the data controller: we decide why and how that data is processed. When a supplier receives your inquiry and then uses your details in its own business, that supplier is a separate controller and is responsible for its own use of them.

This policy applies to the website in English and Vietnamese, to accounts, and to the messaging and quotation tools on it. It does not apply to websites we link to, such as public business registries or a supplier's own website.

2. Personal data we collect

We collect only what you give us and what your browser sends when you use the site:

• Account: email address, password (stored only as a one-way bcrypt hash, never in readable form), name (optional), whether you are a buyer or a supplier, preferred language and display currency, and your notification settings.
• Supplier company: company name, registered address, enterprise (tax) code, country and city, and storefront content you publish: company description, logo, banner, store photos, video, certifications and certificate files, and figures such as staff size, revenue range and main markets.
• Verification requests: the legal name, address, enterprise code and contact phone number you submit, any documents you attach, your note, and the result of our check of that enterprise code against Vietnam's public business registry.
• Address book: recipient name, company, phone number, street address, city, country and postal code of the addresses you save.
• Business communications: inquiries and requests for quotation (your name, email, requested quantity and message), chat messages, quotes, product questions, reviews (display name, country, rating and text), and reports you file about a message. Where ordering is offered, order details including buyer name, email, company and shipping address.
• Uploaded files: photos, videos and PDF documents you upload for listings, storefronts and verification. Photos are resized in your browser before upload.
• Technical data: IP address, browser type and the pages you request, which our hosting provider receives with every request and which we use for security, rate limiting and error reports.

We do not ask for sensitive personal data (such as health, religion, political views or biometric data), and we do not collect bank card or payment details: payment is arranged directly between buyer and supplier, as our Terms explain. Please do not upload documents that contain more personal data than a request needs.

3. Why we use it, and on what legal basis

We process personal data on the basis of your consent, which you give when you register and use the marketplace, and, where the law allows processing without consent, to perform our agreement with you, to comply with legal obligations, and to protect the security of the platform and its users. We use it to:

• create and run your account, keep you signed in, and let you publish listings, send inquiries, chat and quote;
• send service emails: address confirmation, password reset, and notifications of new messages, quotes and requests (you can switch notifications off in your account settings);
• check a supplier's enterprise code against the public registry and decide whether to grant a verified badge;
• keep the marketplace safe: block automated sign-ups, limit repeated requests, mask contact details, flag messages that may be a payment scam, review reported messages, and suspend accounts that break the rules;
• offer optional tools you ask for, such as the AI listing writer and visual search;
• find and fix errors, and understand overall traffic in aggregate;
• comply with the law and with lawful requests from competent authorities.

We do not sell personal data, we do not use it for advertising, and we do not build advertising profiles.

4. Automated processing

Some safety and search features run automatically. None of them, on its own, makes a decision with legal or similarly significant effect on you; you can ask for any of them to be reviewed by a person.

• Contact masking: phone numbers, email addresses, links and messaging-app handles written into chat messages and listing text are detected and replaced with a placeholder, so the first conversation stays on the platform. Messages that suggest paying outside it are flagged.
• Photo text scan: once a day, text recognition (OCR) reads uploaded photos for contact details. It runs on our own equipment; no image is sent to an outside service. A product photo found to carry contact details is hidden from the storefront and can be restored by an administrator.
• Registry matching: the name and address a supplier submits are compared with the public registry record for its enterprise code. The verified badge itself is always granted or refused by a person.
• Visual search: when you search with a photo, your browser turns it into a short list of numbers describing its colours and shapes and sends only those numbers. The photo itself never leaves your device, and it cannot be rebuilt from them.
• Message limits: a daily limit on new inquiries and a check for duplicate messages, to keep suppliers' inboxes free of spam.

5. Who sees your data

Other users see what the marketplace needs to show them:

• A supplier you contact receives your name, email address and message. A request for quotation sent to all suppliers shows your name, the quantity and your message to suppliers on the platform.
• Storefronts and listings are public, including the company details a supplier publishes. Reviews and product questions are public under your display name.
• Files you upload are stored at long, random web addresses. They are not listed anywhere, but anyone who has the address of a file can open it.

6. Service providers

We use the following service providers, which process personal data on our behalf (data processors) under their own terms and data-protection commitments:

• Cloudflare, Inc.: hosting and delivery of the website, storage of uploaded files (R2), request logs, bot protection on sign-in and registration forms (Turnstile), privacy-friendly traffic statistics (Web Analytics) and routing of email sent to our addresses. Global network; company based in the United States.
• Neon, Inc.: the database that holds account, storefront and message data, hosted in Singapore (AWS ap-southeast-1).
• Resend: delivery of service emails; it receives the recipient address and the content of each email. United States.
• Sentry (Functional Software, Inc.): error monitoring; when the server fails, it receives a technical report of the failed request. It is configured not to collect personal data by default. United States.
• Google (Gemini API): only when a Gold supplier uses the AI listing writer or store advice: the draft listing text, category and attributes, or a summary of the storefront's completeness, are sent to generate suggestions. No buyer data is sent.
• VietQR (api.vietqr.io): public business-registry lookup: we send only the enterprise code a supplier entered, and receive the registered name, address and status.

We may also disclose personal data where the law requires it, to a competent authority that lawfully requests it, or to protect the rights and safety of users. If the marketplace is transferred to another operator, personal data would pass to that operator under this policy, and we would tell you in advance.

7. Transfers outside Vietnam

The providers above store and process data outside Vietnam — in Singapore, the United States and other countries where Cloudflare operates. By using the marketplace you consent to this transfer. Where Vietnamese law requires it, we prepare and file the impact assessment for transferring personal data abroad, and we choose providers that commit to protecting the data they process for us.

8. Cookies and storage on your device

We use only the cookies the site needs to work. There are no advertising or cross-site tracking cookies.

• __Host-mvn_session: keeps you signed in. Strictly necessary; not readable by scripts; expires after 7 days or when you sign out.
• mvn_currency: remembers the display currency you chose. Kept for 1 year.
• Cloudflare Turnstile: checks that a sign-in or registration is made by a person. It evaluates signals from your browser and issues a one-time token that our server verifies with Cloudflare.
• Browser storage: your recent searches, recently viewed products, comparison list and cart are kept in your own browser's local storage and are not sent to us as a profile. Clearing your browser data removes them.

Our traffic statistics come from Cloudflare Web Analytics, which sets no cookies and does not identify individual visitors.

9. How long we keep it

• Your account: kept while the account is open. You can delete it yourself in account settings; the account, saved addresses, favourites, follows, notifications and pending email links are deleted at once. If you are the last member of a supplier company, its products are taken offline and its verified badge removed; the company record itself is deleted by an administrator on request.
• Dealings with others: inquiries, messages, quotes, orders and reviews stay after you delete your account, unlinked from it, because they are also the other company's business record. The name and email you used in them remain part of that record. On request, we will anonymise them where we have no legal reason to keep them.
• Uploaded files: a file removed from a listing, or belonging to a deleted product or account, stops being shown but is not yet erased from storage automatically. We erase it on request.
• Verification records: kept while the supplier company is on the marketplace, as the record of why a badge was granted or refused.
• Technical data: request logs and error reports are kept by our providers for a limited period, generally no more than 90 days. Rate-limit counters last minutes. Password-reset and email-confirmation links expire automatically.

We may keep data longer where the law requires it, or where it is needed to handle a dispute, a report or a request from an authority.

10. How we protect it

All traffic is encrypted in transit (HTTPS). Passwords are stored only as bcrypt hashes. Session cookies are signed, cannot be read by scripts, and can be revoked: changing your password signs out every other session. Sign-in and registration are rate-limited and protected against bots, and only administrators can see verification requests and reported messages.

No system is completely secure. If a breach affects your personal data, we will notify the competent authority and, where required, you, within the time limits set by law.

11. Your rights under Vietnamese law

Under Vietnam's Law on Personal Data Protection and its implementing regulations, including, where it still applies, Decree No. 13/2023/ND-CP, you, as the data subject, have the right to:

• be informed about how your personal data is processed — this policy is that notice;
• give or withhold consent, and withdraw consent at any time;
• access your personal data and obtain a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• ask us to restrict processing, and object to processing;
• complain to the competent authority, and claim compensation for damage as provided by law.

You can do much of this yourself in account settings: edit your name and saved addresses, choose which emails you receive, and delete your account. For anything else, email us from the address on your account. We may need to confirm your identity, and we will respond within the time limits set by law. Withdrawing consent does not affect processing already carried out, and because the marketplace cannot run without some of this data, it may mean closing your account.

12. Visitors from the EU, EEA and UK

If the EU or UK General Data Protection Regulation applies to you, our legal bases are: performance of a contract (running your account and the marketplace features you use), legitimate interests (security, fraud and spam prevention, contact masking, error monitoring and aggregate statistics, balanced against your rights), legal obligation, and consent where we ask for it.

You have the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent, and the right to lodge a complaint with the supervisory authority where you live or work. Transfers outside the EEA or UK rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses.

13. Children

madenvietnam is a service for businesses and is not directed at children. You must be at least 16 years old and acting for a business to create an account. If we learn that we hold personal data of a child under 16, we will delete it.

14. Changes to this policy

We will update this policy when our practices or the law change, and show the new effective date at the top of this page. If a change materially affects how we use your personal data, we will tell you by email or on the site before it takes effect, and ask for your consent again where the law requires it.