338 TRAVEL COMPANY LIMITED
PERSONAL INFORMATION PRIVACY POLICY
Applicable to customers using the Company's website and services
This policy regulates the collection, use, storage, sharing, and protection of personal information; it also guides customers on exercising their rights and submitting requests related to personal data. 338 TRAVEL COMPANY LIMITED is referred to as “the Company” in this policy.
1. Purpose of Information Collection
The Company collects customers' personal information for the following purposes:
• Confirm and process itinerary and service booking requests;
• Handle baggage delivery services;
• Contact customer support before, during, and after service use;
• Notify itinerary, pick-up/drop-off points, changes in trips, or arising issues;
• Confirm payment, reconcile transactions, process cancellations/exchanges/refunds if any;
• Receive and resolve complaints, disputes;
• Fulfill obligations as per legal regulations or requests from competent state agencies.
2. Scope of Information Collection
Depending on the service, the Company may collect the following information:
• Full name;
• Phone number;
• Email;
• Contact address, pick-up/drop-off address if applicable;
• Information on departure date and time, departure and destination points;
• Sender and recipient information, delivery/receipt address;
• Necessary payment information such as amount, payment time, transaction code, transfer content;
• ID card/passport number, date of birth if necessary for transaction verification, complaint handling, or as per legal regulations;
• Other information voluntarily provided by customers when contacting or using services.
For information of accompanying persons, senders, or recipients provided by customers, customers must ensure they have the legal right to provide and inform the person about the use of data for transaction execution.
The Company does not require customers to provide bank passwords, OTP codes, PIN codes, security codes, or personal authentication information via phone, email, message, or social media.
3. Scope of Information Use
Customers' personal information is only used within the necessary scope to:
• Provide and perform the services requested by customers;
• Contact, care for, and support customers;
• Confirm itinerary, services, payment;
• Resolve complaints, disputes, or arising incidents;
• Internal management, accounting, reconciliation, and document storage;
• Fulfill legal requests from competent state agencies.
The Company commits not to buy, sell, exchange, or use customers' personal information for purposes other than those announced, unless with the customer's consent or as per legal regulations.
4. Information Storage Duration
Personal information is stored for the necessary duration to provide services, customer care, handle complaints, reconcile transactions, store documents, and fulfill legal obligations.
After the purpose of collection is fulfilled or upon a valid customer request, the Company will consider deleting, editing, anonymizing, or continuing to store information according to the mandatory legal period.
The storage duration is determined by each data group: service booking information is stored during transaction execution and related obligation processing; complaint records are stored during resolution and the necessary time to protect the legal rights and interests of the parties; accounting documents, invoices, and data subject to mandatory storage are kept according to the legal period applicable to each type of document.
Technical data, if collected, is only stored for the necessary duration for the announced purpose. When the period expires or there is no longer a legal basis for processing, the Company deletes, destroys, or anonymizes appropriately; a common period is not automatically applied to all types of data.
5. Entities Accessing Information
Customers' personal information may be accessed by:
• Authorized internal personnel of the Company;
• Departments directly related to service execution;
• Transportation, transit, payment, technology, or customer care partners if necessary to provide services;
• Competent state agencies upon legal request.
Parties accessing the information are responsible for confidentiality and only using the information within the scope of their assigned work.
6. Information Collection and Management Unit
338 TRAVEL COMPANY LIMITED
Business registration number: 0106766690.
Head office address: 338 Tran Khat Chan, Hai Ba Trung, Hanoi.
Website: xehunglong.com.
Contact phone: 0914 077 779.
Email: xehunglong@gmail.com.
Reception time for feedback, requests, complaints, and personal data requests: from 09:00 to 17:00 daily.
7. Customer Rights Regarding Personal Information
Customers have the right to request:
• Check the personal information provided;
• Update, edit personal information;
• Cancel or restrict the use of personal information in appropriate cases;
• Complain if they believe personal information is used for the wrong purpose or beyond the announced scope.
The Company will receive, verify, and process requests within a reasonable time, in accordance with legal regulations and actual operating conditions.
Customers can send requests to view, provide copies, update, edit, delete, cancel, restrict data processing, or withdraw consent via email xehunglong@gmail.com, phone number 0914 077 779, or directly at the head office. Requests must state contact information, related data, and the content of the proposal; do not send passwords or bank authentication codes.
The Company receives requests, guides identity verification as necessary, checks data scope and processing basis; then executes and notifies results according to the legal period applied. If unable to fully fulfill the request due to storage obligations or other legal grounds, the Company will notify the reason and the scope of data that needs to continue being stored.
If the system has account functions and information editing, customers can use the provided functions. If there is no corresponding function, customers use the contact channels mentioned above.
Withdrawing consent does not invalidate the legality of processing already performed. If the request makes it impossible for the Company to perform part of the service, the Company will specifically notify the affected part so that the parties can handle the transaction according to the agreement and law; it does not automatically terminate all services.
8. Complaint Reception Mechanism
All complaints related to personal information are received via hotline, email, direct documents at the head office, or the Company's official customer care channels.
After receiving, the Company will check, verify, coordinate with related parties if any, and respond to customers in a spirit of goodwill, in accordance with legal regulations.
The Company notifies the reception of feedback, requests, complaints within 03 working days from the date of receipt. The processing procedure is implemented according to the Policy on Receiving and Resolving Feedback, Requests, Complaints; requests to exercise personal data rights are processed according to the corresponding specialized period.
If the case exceeds authority, the Company will coordinate or guide customers to contact competent state agencies for handling.
9. Commitment to Information Security
The Company applies appropriate management and technical measures to protect customers' personal information from unauthorized access, use, disclosure, alteration, or destruction.
In case of an information security incident, the Company will check, remedy, coordinate with related parties, and notify as per legal regulations when necessary.
Customers are responsible for self-securing account information, authentication codes, personal documents, and their private information. The Company is not responsible for damages arising from customers voluntarily providing security information to third parties not belonging to the Company's official channels.
10. Policy Effectiveness
This policy is publicly announced on the Company's website and is effective from the time of posting.
Accessing the website is not automatically considered consent for all data processing activities. When consent is needed, the Company clearly informs the processing content and records the customer's choice in an appropriate manner; silence or no response is not considered consent.
The Company reserves the right to amend and supplement the policy to suit business activities and legal regulations. Updated content will be announced on the website.
11. Technical Data and Additional Functions
When implementing functions using accounts, access logs, cookies, device location, or electronic notifications, the Company announces information about the actual data collected, purpose, storage period, or method of determining the period and how customers manage choices before performing the corresponding processing. Only functions actually provided are applied.
If device location needs to be used, the Company informs the purpose and requests customers to grant permission as per regulations. Customers can manage location access permissions on their devices. Refusal only affects functions requiring location, not automatically affecting other functions.
If cookies or similar technologies are used, the Company informs the type of technology, purpose, and appropriate management options. Advertising, marketing, or promotional notifications are only conducted when meeting legal conditions; customers are guided on how to refuse or withdraw consent. Transaction-related notifications are distinguished from advertising information.
