Privacy Policy
Commitment to personal data protection under Decree 13/2023/ND-CP
BMC Consult is committed to protecting the personal data of our customers, partners, and investors in accordance with Decree 13/2023/ND-CP on Personal Data Protection and other applicable Vietnamese laws.
Definitions & Scope of Application
This Policy applies to all personal data that BMC Consult (hereinafter referred to as “BMC” or “We”) collects and processes through:
- Our official website at bmcconsult.vn and its subdomains;
- BMC internal applications and systems (DMS·AI, Partner Portal, HR Portal);
- Offline touchpoints: offices, events, seminars, and distribution networks;
- Social media networks and customer care channels (Zalo OA, Email, Hotline).
Data Subjects include: customers, potential investors, partners, suppliers, job applicants, employees, and website visitors.
Legal Compliance: This Policy is formulated based on Decree 13/2023/ND-CP dated April 17, 2023, on Personal Data Protection, the Law on Cybersecurity 2018, the Law on Protection of Consumers' Rights 2023, and related guiding documents.
Data We Collect
2.1. Basic Personal Data
| Data Group | Details |
|---|---|
| Identity | Full name, date of birth, gender, profile picture, ID card/Passport number (for investors, contracting partners). |
| Contact | Phone number, email, address, nationality, social media accounts. |
| Professional | Job title, company name, industry, corporate tax ID. |
| Transaction | Order history, contracts, payment information, invoices. |
| Technical | IP address, browser type, device details, operating system, website access logs. |
| Interaction | Customer care messages, surveys, feedback, comments. |
2.2. Sensitive Personal Data
In limited circumstances, BMC may collect sensitive personal data as defined under Article 2 of Decree 13/2023/ND-CP, which includes: financial data (for investors), health data (for employees' regular medical examinations), and location data (when using on-site support services). The collection of such data is always subject to the explicit consent of the data subject.
Data Processing Purposes
BMC processes your personal data for the following purposes:
Product & Service Provision
order processing, delivery, warranty, technical support, and investment consulting.
Investment Consulting
assessing investment needs, preparing dossier documents, performing KYC/AML procedures under regulations.
Customer Care
resolving inquiries, receiving feedback, handling complaints.
Marketing & Communications
sending new product updates, promotions, newsletters — only with your consent.
Recruitment
assessing candidate resumes, interviewing, signing employment contracts.
Analysis & Improvement
measuring website performance, analyzing behaviors to enhance user experience.
Legal Obligations
retaining invoices, accounting documents, reporting to competent state authorities.
Security & Fraud Prevention
detecting and preventing fraudulent behaviors, cyber attacks, data breaches.
Legal Bases for Data Processing
BMC's personal data processing is based on one or more of the following legal bases:
- Consent of the data subject (Article 11 of Decree 13/2023/ND-CP);
- Performance of a contract to which the data subject is a party;
- Compliance with the legal obligations of BMC under applicable laws;
- Protecting the life or health of the data subject or others in emergencies;
- Legitimate interests of BMC, provided that they do not infringe upon the data subject's rights.
Data Sharing & Transfer
BMC does not sell personal data. We only share data in the following cases:
Affiliates
entities within the BMC ecosystem (BMC Consult, and other member entities) to provide integrated services.
Data Processors
cloud storage providers, email/SMS service providers, payment gateways, logistics partners — with signed Data Processing Agreements (DPA).
State Authorities
upon valid requests from competent authorities under Vietnamese law.
During M&A Transactions
in the event of restructuring, merger, or asset transfer of BMC — the data subject will be notified in advance.
For overseas data transfer, BMC complies with Article 25 of Decree 13/2023/ND-CP and prepares a Transfer Impact Assessment (TIA) to submit to the Ministry of Public Security within 60 days from the date of processing.
Data Retention Period
| Data Type | Retention Period |
|---|---|
| Customer & Order Data | 05 years from the last transaction |
| Investor Dossiers | 10 years (under Securities Law and Anti-Money Laundering Law regulations) |
| Accounting documents, invoices | 10 years (under Accounting Law 2015) |
| Human Resource Files | Throughout employment + 05 years after termination |
| Rejected Candidate Profiles | 06 months from the interview date |
| Marketing Data | Until the data subject withdraws consent |
| Website access logs | 12 months |
After the retention period, data will be securely deleted or anonymized for statistical purposes.
Security Measures
BMC implements appropriate technical and organizational measures to protect personal data:
- Encrypting data transmission using HTTPS/TLS 1.3;
- Encrypting sensitive stored data (AES-256);
- Role-based access control (RBAC), two-factor authentication (2FA) for administrative systems;
- Maintaining access logs (audit logs) and 24/7 security monitoring;
- Periodic data backup and disaster recovery drills;
- Regular security training for all employees;
- Signing non-disclosure agreements (NDAs) / data processing agreements (DPAs) with all processors.
In the event of a personal data breach, BMC is committed to notifying the Ministry of Public Security and the affected data subjects within 72 hours under Article 23 of Decree 13/2023/ND-CP.
Data Subject Rights
Pursuant to Article 9 of Decree 13/2023/ND-CP, you have the following rights:
| Rights | Content |
|---|---|
| Right to be informed | Be informed of personal data processing activities. |
| Right to consent | Consent or withhold consent to data processing. |
| Right of access | View, inspect, and edit one's own data. |
| Right to withdraw consent | Withdraw previously granted consent at any time. |
| Right to erasure | Request erasure of data when no longer necessary. |
| Right to restrict processing | Request restriction of data processing within 72 hours. |
| Right to object | Object to processing activities for advertising and marketing purposes. |
| Right to complain and denounce | File complaints, denouncements, or lawsuits in accordance with the law. |
| Right to claim damages | Request compensation for damages if violations occur. |
| Right to self-protection | Protect oneself or request protection from competent authorities. |
To exercise your rights, please send a request to our email info@bmcconsult.vn. BMC will respond within a maximum of 72 working hours and process the request within 30 days.
Cookies & Tracking Technologies
BMC website uses the following types of cookies:
Strictly Necessary Cookies
ensures website core functionality (user sessions, security).
Analytical Cookies
measures traffic volume (Google Analytics, Microsoft Clarity).
Marketing Cookies
personalizes ads (Meta Pixel, Google Ads) — only activated upon your consent.
You can manage cookies through browser settings or the cookie consent banner on our website.
Children's Data
BMC does not intentionally collect personal data of children under 16 years of age. In the event that children's data needs to be processed, BMC will require the consent of a parent or legal guardian under Article 20 of Decree 13/2023/ND-CP.
Policy Changes
BMC may update this Policy from time to time to reflect changes in laws, technology, or business operations. The new version will be published on our website with its effective date. For material changes, BMC will send email notifications to affected data subjects at least 15 days before they take effect.
Contact & Complaints
For any inquiries, requests, or complaints related to personal data, please contact BMC's Data Protection Officer (DPO):
| Information | Details |
|---|---|
| Entity | BMC Consult Co., Ltd. — Tax Code: 0309749771 |
| Address | 211 lor 8 toa payoh #01-17, 310211 |
| Security Email | info@bmcconsult.vn |
| Hotline | +6583236888 (Mon – Fri, 08:00 – 17:30 ICT) |
Note: If you are not satisfied with BMC's response, you have the right to file a complaint with the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security.