PRIVACY AND PERSONAL DATA PROTECTION POLICY

HỘ KINH DOANH TUYẾT LAN 2 owns and operates the website under the Tuyetlan Orchidsilk brand (“Tuyetlan Orchidsilk”).

This Policy explains how Tuyetlan Orchidsilk collects, uses, stores, shares and protects personal data when customers visit the website, place orders, request advice or use its products and services.

Tuyetlan Orchidsilk respects customer privacy and processes personal data in accordance with Vietnamese law, including Decree No. 13/2023/ND-CP on Personal Data Protection, the Law on Protection of Consumers’ Rights, the Law on Cyberinformation Security, e-commerce regulations and other applicable laws.

1. Data controller and processor

• Legal entity: HỘ KINH DOANH TUYẾT LAN 2
• Brand: Tuyetlan Orchidsilk
• Tax identification number: 079196016713
• Registered and business address: 124 Le Thanh Ton Street, Ben Thanh Ward, Ho Chi Minh City, Vietnam
• Representative: Tran Gia Nghi
• Hotline: +84938077701
• Email: trangianghi77701@gmail.com
• Website: tuyetlanorchids.com

2. Categories of personal data collected

Depending on the customer’s interaction, Tuyetlan Orchidsilk may collect:

• Name, telephone number, email address, delivery address and country or region;
• Account or login information, if account functionality is available;
• Order number, products viewed or purchased, order value and history;
• Payment method and payment, delivery, return or warranty status;
• Information required for invoices, accounting records or customs clearance;
• Communications concerning transactions or customer support;
• Measurements, height, weight, garment preferences, voluntarily supplied photos or videos, and other information necessary for consultation or tailoring services;
• IP address, browser, device, operating system, access time, pages viewed, referral source, cookies and similar technical identifiers.

Tuyetlan Orchidsilk does not directly store full payment-card numbers, CVV/CVC codes or payment passwords. Such information is processed by the relevant bank or payment service provider, where applicable.

3. Sources of data

Personal data may be obtained:

• Directly from customers through the website or official contact channels;
• During ordering, payment, shipping, returns, warranty service or complaint handling;
• Automatically when customers use the website;
• From carriers, payment providers or partners involved in fulfilling a customer request; or
• From another lawful source permitted by law.

4. Purposes of processing

Personal data may be processed to:

• Receive, confirm and fulfil orders;
• Provide product, sizing, material or tailoring advice;
• Process payments, shipping, customs clearance, returns, refunds, repairs and warranties;
• Communicate order status and provide customer service;
• Verify transactions and prevent fraud;
• Resolve feedback and complaints;
• Improve products, services and website performance;
• Send marketing information where the customer has consented or the law otherwise permits;
• Perform accounting, tax, invoicing and recordkeeping obligations;
• Respond to lawful requests from competent authorities; and
• Protect the lawful rights and interests of customers, Tuyetlan Orchidsilk and relevant parties.

5. Legal basis and consent

Depending on the circumstances, processing may be based on customer consent, performance of an order or requested service, legal obligations, protection of lawful rights and interests within the limits permitted by law, or another legal basis recognised by law.

Where consent is required, customers will be given sufficient information to make a voluntary decision.

Withdrawal of consent does not affect processing lawfully completed before the request is received. If data is necessary to fulfil an order or comply with law, refusal or deletion may prevent Tuyetlan Orchidsilk from continuing the relevant service.

6. Marketing communications

Tuyetlan Orchidsilk sends direct marketing only where the customer has registered or consented, or where otherwise permitted by law.

Customers may unsubscribe through the link or instructions in a message or by contacting Tuyetlan Orchidsilk.

Opting out of marketing does not affect essential communications about orders, payments, shipping, warranty service or complaints.

7. Cookies and tracking technologies

The website may use cookies or similar technologies to maintain security and operation, remember preferences and viewed products, analyse traffic, measure content or advertising performance and improve user experience.

Depending on its configuration, the website may use third-party analytics or advertising tools such as Google Analytics, Google Ads, Meta Pixel or similar services.

Where required by law, notice and consent will be obtained for non-essential cookies.

Customers may manage or delete cookies through browser settings, although disabling some cookies may affect website functionality.

8. Sharing with third parties

Tuyetlan Orchidsilk does not sell, trade or rent personal data for commercial purposes.

To the extent necessary, data may be shared with:

• Carriers, delivery agents and customs service providers;
• Banks, payment gateways and payment intermediaries;
• Website hosting, server, information-technology, email, customer-service, analytics or advertising providers;
• Accounting, tax, legal, audit or professional advisers;
• Partners assisting with an order or requested service;
• Competent government authorities; or
• A lawful successor in a reorganisation, merger or transfer of the business.

Recipients may access only information necessary for their assigned purpose and must protect it in accordance with applicable agreements and law.

9. International orders and overseas data transfers

For an international order, the customer’s name, contact details, address and order information may be provided to international carriers, delivery agents, customs authorities, payment providers and other entities necessary in the sending, transit or destination country.

Personal data may also be stored or processed by service providers located outside Vietnam, including providers of hosting, email, analytics, advertising, payment or international shipping services.

Where personal data is transferred abroad, Tuyetlan Orchidsilk will implement measures required by Vietnamese personal-data law.

10. Retention

Data is retained only for as long as reasonably necessary for the stated purpose, including order fulfilment, warranty and complaint handling, customer relations, fraud prevention, and statutory accounting, tax and recordkeeping periods.

When data is no longer required, or upon a valid request, it will be deleted, destroyed or anonymised unless continued retention is required or permitted by law.

11. Security

Tuyetlan Orchidsilk applies reasonable organisational and technical safeguards against unauthorised access, misuse, unlawful disclosure, alteration, loss or destruction.

Safeguards may include access controls, account and password management, secure connections, appropriate backups, service-provider controls and staff guidance.

No Internet transmission or storage method can be guaranteed to be absolutely secure.

12. Personal data incidents

If an incident may affect personal data, Tuyetlan Orchidsilk will assess its scope, take reasonable containment and remediation measures, retain relevant information, notify competent authorities or data subjects where legally required, and coordinate with relevant parties.

Customers who suspect unauthorised access or use should contact Tuyetlan Orchidsilk promptly.

13. Customer rights

Subject to applicable law, customers may have the right to:

• Be informed about personal-data processing;
• Give or refuse consent;
• Access or request a copy of their personal data;
• Correct inaccurate data;
• Withdraw consent;
• Request deletion or restriction of processing;
• Object to direct-marketing processing;
• Submit a complaint, report a violation or bring legal proceedings;
• Seek compensation where legally justified; and
• Protect their lawful rights and interests.

Some requests may be limited or delayed where data must be retained to complete an order, resolve a dispute or warranty claim, comply with accounting or tax duties, respond to an authority or perform another lawful obligation.

14. Exercising customer rights

A request should include the customer’s name, contact details, the nature of the request and information reasonably necessary to verify identity or the relevant transaction.

Tuyetlan Orchidsilk may request reasonable verification to prevent unauthorised access, alteration or deletion.

Valid requests will be handled within the period required by law. If a request cannot be fulfilled, Tuyetlan Orchidsilk will provide an appropriate explanation.

15. Customer responsibilities

Customers must provide accurate, complete and lawful information; provide another person’s information only with appropriate authority or consent; protect login and payment credentials; and promptly report suspected unauthorised use.

Unless otherwise provided by law, Tuyetlan Orchidsilk is not responsible for loss caused by a customer’s intentional provision of false information or disclosure of security credentials to an unauthorised party.

16. Contact and complaint handling

Requests, feedback or complaints concerning personal data may be submitted to:

• Receiving entity: HỘ KINH DOANH TUYẾT LAN 2
• Person in charge: Tran Gia Nghi
• Address: 124 Le Thanh Ton Street, Ben Thanh Ward, Ho Chi Minh City, Vietnam
• Hotline: +84938077701
• Email: trangianghi77701@gmail.com

Email and website submissions are received at any time. Hotline and in-person requests are received during operating hours from 10:00 to 22:00 daily. Requests received outside operating hours will be recorded on the next business day.

Tuyetlan Orchidsilk will acknowledge a complete request within two (02) business days. A complaint or negotiated-resolution request will receive a proposed response within no more than seven (07) business days. If the matter is complex, the customer will be informed of the reason and anticipated timeframe.

Customers who disagree with the outcome may exercise complaint, reporting or litigation rights under applicable law.

17. Third-party links and platforms

The website may link to social networks, websites or platforms operated by third parties. Their independent processing is governed by their own privacy policies.

Tuyetlan Orchidsilk does not control such independent processing and is not responsible for it, except where otherwise required by law.

18. Amendments and effective date

Tuyetlan Orchidsilk may update this Policy to reflect changes in law or business operations. The updated version and effective date will be published on the website.

Where a change materially affects the purpose or scope of processing, notice or renewed consent will be provided when required by law.

This Policy is effective from 27 July 2026.