338 TRAVEL COMPANY LIMITED
PERSONAL INFORMATION PRIVACY POLICY
Applies to customers using the Company's website and services
This policy outlines the collection, use, storage, sharing, and protection of personal information; it also guides customers on exercising their rights and submitting requests related to personal data. 338 TRAVEL COMPANY LIMITED is referred to as the “Company” in this policy.
1. Purpose of Information Collection
The Company collects personal information from customers for the following purposes:
• Confirming and processing itinerary bookings, service bookings;
• Handling baggage delivery services;
• Contacting to support customers before, during, and after using the service;
• Notifying about schedules, pick-up/drop-off points, changes in trips, or arising issues;
• Confirming payment, reconciling transactions, processing cancellations/exchanges/refunds if applicable;
• Receiving and resolving complaints, disputes;
• Fulfilling obligations as per legal regulations or requests from competent state agencies.
2. Scope of Information Collection
Depending on each service, the Company may collect the following information:
• Full name;
• Phone number;
• Email;
• Contact address, pick-up/drop-off address if applicable;
• Information on departure date and time, departure point, destination;
• Information of sender, recipient, delivery/receiving address;
• Necessary payment information such as amount, payment time, transaction code, transfer content;
• ID card/passport number, date of birth when necessary to verify transactions, handle complaints, or as per legal regulations;
• Other information voluntarily provided by the customer when contacting or using the service.
For information of accompanying persons, senders, or recipients provided by the customer, the customer must ensure they have the legal right to provide and inform the person about the use of data to conduct transactions.
The Company does not require customers to provide bank passwords, OTP codes, PIN codes, card security codes, or personal authentication information via phone, email, message, or social media.
3. Scope of Information Use
Customers' personal information is only used within the necessary scope to:
• Provide and perform the services requested by the customer;
• Contact, care for, and support customers;
• Confirm schedules, services, payments;
• Resolve complaints, disputes, or arising incidents;
• Internal management, accounting, reconciliation, and document storage;
• Fulfill legal requests from competent state agencies.
The Company commits not to buy, sell, exchange, or use customers' personal information for purposes other than those announced, unless with the customer's consent or as per legal regulations.
4. Information Storage Duration
Personal information is stored for the necessary duration to provide services, customer care, handle complaints, reconcile transactions, store documents, and fulfill legal obligations.
Once the collection purpose is fulfilled or upon a valid customer request, the Company will consider deleting, editing, anonymizing, or continuing to store information as per the mandatory legal duration.
The storage period is determined for each data group: service booking information is stored during the transaction and related obligations; complaint records are stored during resolution and the necessary time to protect the legal rights and interests of the parties; accounting documents, invoices, and data subject to mandatory storage are stored as per the legal duration applicable to each type of document.
Technical data, if collected, is only stored for the necessary time for the announced purpose. When the period ends or there is no legal basis for processing, the Company will delete, destroy, or anonymize appropriately; a common duration is not automatically applied to all data types.
5. Entities with Access to Information
Customers' personal information may be accessed by:
• Authorized internal personnel of the Company;
• Departments directly related to service provision;
• Transportation, intermediary, payment, technology, or customer care partners if necessary to provide services;
• Competent state agencies upon legal request.
Entities with access to information are responsible for maintaining confidentiality and using the information only within the scope of their assigned work.
6. Information Collection and Management Unit
338 TRAVEL COMPANY LIMITED
Business Registration Number: 0106766690.
Head Office Address: 338 Tran Khat Chan, Hai Ba Trung, Hanoi.
Website: xehunglong.com.
Contact Phone: 0914 077 779.
Email: xehunglong@gmail.com.
Reception hours for feedback, requests, complaints, and personal data requests: from 09:00 to 17:00 daily.
7. Customer Rights Regarding Personal Information
Customers have the right to request:
• Checking the personal information provided;
• Updating, editing personal information;
• Cancelling or restricting the use of personal information in appropriate cases;
• Complaining if personal information is used for the wrong purpose or beyond the announced scope.
The Company will receive, verify, and process requests within a reasonable time, in accordance with legal regulations and actual operating conditions.
Customers can send requests to view, provide copies, update, edit, delete, cancel, restrict data processing, or withdraw consent via email xehunglong@gmail.com, phone number 0914 077 779, or directly at the head office. Requests must include contact information, related data, and the content of the request; do not send passwords or bank authentication codes.
The Company receives requests, guides identity verification as necessary, checks data scope and processing basis; then implements and notifies results as per applicable legal deadlines. If unable to fully fulfill the request due to storage obligations or other legal bases, the Company will notify the reason and the data scope that needs to continue being stored.
If the system has account functions and information editing, customers can use the provided functions. If there is no corresponding function, customers use the contact channels mentioned above.
Withdrawing consent does not invalidate the legality of processing done previously. If the request makes it impossible for the Company to perform part of the service, the Company will specifically notify the affected part so that the parties can handle the transaction according to the agreement and law; it does not automatically terminate all services.
8. Complaint Reception Mechanism
All complaints related to personal information are received via hotline, email, direct documents at the head office, or the Company's official customer care channels.
Upon receipt, the Company will check, verify, coordinate with related parties if any, and respond to customers in good faith, in accordance with legal regulations.
The Company notifies the receipt of feedback, requests, complaints within 03 working days from the date of receipt. The processing procedure follows the Policy for Receiving and Resolving Feedback, Requests, Complaints; requests to exercise rights regarding personal data are processed according to the corresponding specialized deadlines.
If the case exceeds authority, the Company will coordinate or guide customers to contact the competent state agency for resolution.
9. Commitment to Information Security
The Company applies appropriate management and technical measures to protect customers' personal information from unauthorized access, use, disclosure, alteration, or destruction.
In the event of an information security incident, the Company will check, rectify, coordinate with related parties, and notify as per legal regulations when necessary.
Customers are responsible for self-securing their account information, authentication codes, personal documents, and private information. The Company is not responsible for damages arising from customers voluntarily providing security information to third parties not belonging to the Company's official channels.
10. Policy Effectiveness
This policy is publicly announced on the Company's website and is effective from the time of posting.
Accessing the website is not automatically considered consent for all data processing activities. When consent is required, the Company clearly announces the processing content and records the customer's choice in an appropriate form; silence or non-response is not considered consent.
The Company reserves the right to amend and supplement the policy to suit business activities and legal regulations. Updated content will be announced on the website.
11. Technical Data and Additional Functions
When deploying functions that use accounts, access logs, cookies, device location, or electronic notifications, the Company announces information about the actual data collected, purpose, storage duration, or how to determine the duration and how customers manage choices before implementing the corresponding processing. Only the functions actually provided are applied.
If device location needs to be used, the Company announces the purpose and requests customers to grant permission as per regulations. Customers can manage location access permissions on the device. Refusal only affects functions requiring location, not automatically affecting other functions.
If cookies or similar technologies are used, the Company announces the type of technology, purpose, and appropriate management options. Advertising, marketing, or promotional notifications are only conducted when meeting legal conditions; customers are guided on how to refuse or withdraw consent. Notifications serving transactions are distinguished from advertising information.
