338 TRAVEL COMPANY LIMITED
PERSONAL INFORMATION PRIVACY POLICY
Applicable to customers using the Company's website and services
This policy outlines the collection, use, storage, sharing, and protection of personal information; it also guides customers on exercising their rights and submitting requests related to personal data. 338 TRAVEL COMPANY LIMITED is referred to as the “Company” in this policy.
1. Purpose of Information Collection
The Company collects personal information from customers for the following purposes:
• Confirming and processing itinerary bookings and service requests;
• Handling baggage delivery services;
• Contacting and supporting customers before, during, and after using the service;
• Notifying about schedules, pick-up/drop-off points, trip changes, or arising issues;
• Confirming payments, reconciling transactions, processing cancellations/changes/refunds if applicable;
• Receiving and resolving feedback, complaints, disputes;
• Fulfilling obligations under legal regulations or requests from competent state authorities.
2. Scope of Information Collection
Depending on the service, the Company may collect the following information:
• Full name;
• Phone number;
• Email;
• Contact address, pick-up/drop-off address if applicable;
• Information on departure date and time, departure and destination points;
• Information of the sender, recipient, delivery/receipt address;
• Necessary payment information such as amount, payment time, transaction code, transfer content;
• ID/passport number, date of birth if necessary for transaction verification, complaint handling, or legal regulations;
• Other information voluntarily provided by the customer when contacting or using the service.
For information about accompanying persons, senders, or recipients provided by the customer, the customer must ensure they have the legal right to provide it and inform the person about the data usage for transaction purposes.
The Company does not require customers to provide bank passwords, OTP codes, PIN codes, card security codes, or personal authentication information via phone, email, message, or social media.
3. Scope of Information Use
Customers' personal information is only used within the necessary scope to:
• Provide and perform the services requested by the customer;
• Contact, care for, and support customers;
• Confirm schedules, services, payments;
• Resolve complaints, disputes, or arising incidents;
• Internal management, accounting, reconciliation, and document storage;
• Fulfill legal requests from competent state authorities.
The Company commits not to buy, sell, exchange, or use customers' personal information for purposes other than those announced, unless with the customer's consent or under legal regulations.
4. Information Storage Duration
Personal information is stored for the necessary duration to provide services, customer care, handle complaints, reconcile transactions, store documents, and fulfill legal obligations.
Once the collection purpose is completed or upon a valid customer request, the Company will consider deleting, editing, anonymizing, or continuing to store the information according to the mandatory legal period.
The storage duration is determined by each data group: service booking information is stored during the transaction and related obligations; complaint records are stored during resolution and the necessary time to protect the legal rights and interests of the parties; accounting documents, invoices, and data subject to mandatory storage are stored according to the legal period applicable to each document type.
Technical data, if collected, is only stored for the necessary duration for the announced purpose. When the period expires or there is no longer a legal basis for processing, the Company deletes, destroys, or anonymizes appropriately; a common duration is not automatically applied to all data types.
5. Entities Accessing Information
Customers' personal information may be accessed by:
• Internal personnel authorized by the Company;
• Departments directly involved in service execution;
• Transportation, intermediary, payment, technology, or customer care partners if necessary to provide services;
• Competent state authorities upon a legal request.
Entities accessing the information are responsible for maintaining confidentiality and using the information only within the assigned work scope.
6. Information Collection and Management Unit
338 TRAVEL COMPANY LIMITED
Business registration number: 0106766690.
Head office address: 338 Tran Khat Chan, Hai Ba Trung, Hanoi.
Website: xehunglong.com.
Contact phone: 0914 077 779.
Email: xehunglong@gmail.com.
Reception time for feedback, requests, complaints, and personal data requests: from 09:00 to 17:00 daily.
7. Customer Rights Regarding Personal Information
Customers have the right to request:
• Check the personal information provided;
• Update, edit personal information;
• Cancel or restrict the use of personal information in appropriate cases;
• Complain if they believe personal information is used for the wrong purpose or beyond the announced scope.
The Company will receive, verify, and process requests within a reasonable time, in accordance with legal regulations and actual operational conditions.
Customers can send requests to view, provide copies, update, edit, delete, cancel, restrict data processing, or withdraw consent via email xehunglong@gmail.com, phone number 0914 077 779, or directly at the head office. Requests must include contact information, related data, and the proposal content; do not send bank passwords or authentication codes.
The Company receives requests, guides identity verification as necessary, checks data scope and processing basis; then implements and notifies results according to the legal period. If unable to fully implement the request due to storage obligations or other legal bases, the Company will notify the reason and the data scope that needs to be continued.
If the system has account functions and information editing, customers can use the provided functions. If there is no corresponding function, customers use the contact channels mentioned above.
Withdrawing consent does not invalidate the legality of processing previously performed. If the request prevents the Company from performing part of the service, the Company will specifically notify the affected part so that the parties can handle the transaction according to the agreement and law; not automatically terminating all services.
8. Complaint Reception Mechanism
All complaints related to personal information are received via hotline, email, direct documents at the head office, or the Company's official customer care channels.
After receiving, the Company will check, verify, coordinate with related parties if any, and respond to customers in good faith, in accordance with legal regulations.
The Company notifies the receipt of feedback, requests, complaints within 3 working days from the date of receipt. The processing procedure follows the Policy on Receiving and Resolving Feedback, Requests, Complaints; requests for exercising data rights are processed according to the corresponding specialized period.
If the case exceeds authority, the Company will coordinate or guide customers to contact competent state authorities for processing.
9. Commitment to Information Security
The Company applies appropriate management and technical measures to protect customers' personal information from unauthorized access, use, disclosure, alteration, or destruction.
In case of an information security incident, the Company will check, remedy, coordinate with related parties, and notify according to legal regulations when necessary.
Customers are responsible for self-securing their account information, authentication codes, personal documents, and private information. The Company is not responsible for damages arising from customers voluntarily providing security information to third parties not belonging to the Company's official channels.
10. Policy Effectiveness
This policy is publicly announced on the Company's website and is effective from the time of posting.
Accessing the website is not automatically considered consent for all data processing activities. When consent is needed, the Company clearly informs the processing content and records the customer's choice in a suitable manner; silence or no response is not considered consent.
The Company reserves the right to amend and supplement the policy to suit business activities and legal regulations. Updated content will be announced on the website.
11. Technical Data and Additional Functions
When implementing functions using accounts, access logs, cookies, device location, or electronic notifications, the Company announces information about the actual data collected, purpose, storage duration, or how to determine the duration and how customers manage choices before performing the corresponding processing. Only actually provided functions are applied.
If device location use is needed, the Company informs the purpose and requests customers to grant permission according to regulations. Customers can manage location access rights on the device. Refusal only affects functions requiring location, not automatically affecting other functions.
If using cookies or similar technology, the Company informs the type of technology, purpose, and appropriate management choices. Advertising, marketing, or promotional notifications are only performed when meeting legal conditions; customers are guided on how to refuse or withdraw consent. Transaction-related notifications are distinguished from advertising information.
