Personal Data Protection Policy

How Sangroup Corporation Joint Stock Company collects, uses, shares and protects personal data under the Personal Data Protection Law No. 91/2025/QH15.

1. Data controller

Sangroup Corporation Joint Stock Company (tax code 0110811346; headquarters: No. 20, Row 16B6, European Overseas Vietnamese Village, Ha Dong Ward, Hanoi) processes personal data in accordance with the Personal Data Protection Law No. 91/2025/QH15 and its implementing regulations.

2. Data collected and purposes

Source	Data	Purpose
Contact form on sangroup.vn	Name, phone number, email, message, time sent, page, browser information; stored in Google Sheets	Replying to enquiries and partnership requests
Purchases at OneStop machines	Time, product, amount and payment transaction ID. Machines do not store customers’ phone numbers or wallet accounts.	Processing payments, refunds and reconciliation
Complaints and support requests	Contact details, photos, complaint details	Resolving complaints
Website visits	IP address and browser information, via Google reCAPTCHA	Preventing spam and automated access
Cameras at some OneStop machines	Images of the machine area and people in front of the machine	Security and equipment safety; checking incidents or complaints. Kept for up to 30 days unless needed to resolve a complaint.

Sangroup does not collect sensitive personal data and does not use data beyond the purposes above without the data subject’s consent.

3. Consent

When sending the contact form, users tick a box agreeing to this Policy. Users may withdraw consent at any time by contacting us as described in Section 8; withdrawal does not affect processing carried out before it. Transaction data is processed to complete transactions and to meet accounting and tax obligations required by law.

4. Sharing data

Sangroup does not buy or sell personal data. Data is shared only as far as necessary with:

Viettel Money (Viettel Digital Services Corporation), the payment gateway and e-wallet provider at OneStop machines
Google LLC (reCAPTCHA; Google Sheets and Apps Script storing contact form data)
The provider of the servers and hosting infrastructure for the website
The member business handling the request (OneStop operations, SanTech) when it falls within that business’s scope
Competent state authorities upon lawful request

5. Retention

Contact form data: 24 months after the request has been handled.
Transaction and complaint data: for the retention period for accounting records required by accounting law.
Camera images at machines: up to 30 days unless needed to resolve a complaint.
After that, data is deleted or anonymised.

6. Rights of data subjects

To be informed about the processing of their data.
To give, refuse or withdraw consent.
To access and correct their data, and to request that it be provided, deleted or restricted.
To object to processing.
To complain, report, take legal action and claim compensation.

Sangroup responds to data subject requests within the time limits set by law.

7. Security measures

The website uses encrypted HTTPS connections. Access to data is granted only to staff who need it for their work. If a data breach occurs, Sangroup notifies the competent authorities and affected people as required by law.

8. Contact

Responsible for personal data protection: SanTech, Sangroup’s technology member company
Email: info@sangroup.com.vn · Hotline: 19008247 · Zalo: 0986474868

9. Effective date

This Policy takes effect from the date it is published on sangroup.vn and is updated when the law or the way we process data changes.