Privacy policy

QQ EATS Privacy Policy 

The operator of QQ EATS establishes and discloses the following privacy policy to protect members' personal information in accordance with Vietnam's Decree 13/2023/N?-CP (Personal Data Protection) and the Cybersecurity Law of 2018.

Article 1 (Items and Methods of Personal Information Collection)

The operator collects personal information through systematic and transparent methods to ensure effective service delivery while maintaining data protection standards. For membership registration and comprehensive service provision, the following categories of personal information are collected:

Mandatory Information: This includes the member's name in both Korean and English formats, contact number within Vietnam for delivery coordination, email address for communication and account management, default delivery address for service provision, and type of stay to better understand service requirements.

Optional Information: Members may choose to provide hotel name and room number for hotel deliveries, contact number in Korea for additional communication options, and payment card information which is securely stored exclusively by certified payment gateway providers rather than by the operator directly.

Automatically Collected Information: The system automatically captures access IP addresses for security monitoring, cookies for service personalization, device information for compatibility optimization, and comprehensive service usage records for service improvement purposes.

Personal information is obtained through two primary methods: direct input by members during registration and service usage, or automatic generation through system processes during the course of service utilization.

Article 2 (Purpose of Collection and Use of Personal Information)

The collected personal information is utilized exclusively for legitimate business purposes that directly relate to service provision and legal compliance. These purposes encompass member identification and confirmation of registration intent to ensure account security, comprehensive order processing including food preparation coordination and delivery logistics, secure payment processing and efficient refund handling when required, responsive customer support and effective dispute resolution mechanisms, operation of promotional campaigns including coupon distribution and point system management, and fulfillment of legal obligations including tax reporting requirements and food safety compliance measures.

Article 3 (Provision of Personal Information to Third Parties)

The operator maintains strict data protection standards while enabling essential service delivery through limited third-party information sharing. Only the minimum necessary information, specifically name, contact number, and hotel name with room number when applicable, is provided to carefully selected third parties for legitimate service purposes. It is important to note that the operator maintains physical presence in Vietnam, ensuring local compliance and oversight.

Delivery Service Providers: Information is shared with riders, whether in-house delivery staff or external delivery services including established platforms such as Grab, Ahamove, and Be, strictly for the purpose of accurate and timely food delivery.

Payment Processing Partners: Relevant information is provided to certified payment gateway providers exclusively for secure payment processing and transaction completion.

Hotel Reception Personnel: When deliveries are made to hotel locations, necessary information is shared with hotel reception staff to facilitate smooth food handover and ensure successful delivery completion.

The operator maintains a strict policy of not providing members' personal information to any third parties beyond these specifically outlined cases without obtaining explicit prior consent from the affected members.

Article 4 (Retention Period by Type of Personal Information)

To ensure transparency and legal compliance, the operator maintains different retention periods for various types of personal information based on legal requirements and business necessity. Order and Payment Receipts are retained for a period of five years in accordance with Article 47 of the Law on Tax Administration, ensuring compliance with tax reporting and audit requirements. Membership Registration Information, including names and contact details, is retained until the point of membership withdrawal or for one year following the member's last order, whichever occurs first, in compliance with Decree 13/2023/N?-CP. Contact Information for Marketing Purposes is retained until the member withdraws consent for marketing communications or for a maximum period of one year, adhering to Decree 13/2023/N?-CP guidelines. Location Information Provided to Riders for delivery coordination is automatically deleted thirty days after delivery completion, following the principle of data minimization upon purpose achievement. Dispute-Related Records are maintained for three years following dispute resolution to comply with the statute of limitations for civil complaints and ensure adequate record-keeping for potential legal proceedings.

Article 5 (Rights of Members)

Members possess comprehensive rights regarding their personal information and may exercise these rights at any time through appropriate channels. These rights include the right to request access to their personal information to understand what data is being processed, the right to request correction or deletion of inaccurate or outdated personal information, the right to request suspension of personal information processing when circumstances warrant such action, and the right to withdraw consent for data collection and use when such consent was the legal basis for processing.

The operator is committed to processing all member requests without undue delay in strict accordance with the provisions of Decree 13/2023/N?-CP, ensuring that member rights are respected and protected throughout the data processing lifecycle.

Article 6 (Measures to Ensure the Security of Personal Information)

The operator implements comprehensive security measures to protect personal information from unauthorized access, disclosure, or misuse. A Data Protection Impact Assessment (DPIA) is prepared and maintained separately from this Privacy Policy to systematically evaluate and mitigate privacy risks associated with data processing activities. All personal information is stored using advanced encryption technologies and undergoes rigorous security processing during network transmission to prevent interception or unauthorized access.

In the event of a personal information breach, the operator has established emergency response procedures to notify affected members within twenty-four hours of incident discovery and immediately report the breach to relevant regulatory authorities in compliance with legal notification requirements.

Article 7 (Use of Cookies)

The operator may utilize cookie technology to provide personalized and enhanced services tailored to individual member preferences and usage patterns. Members retain full control over cookie usage and may refuse cookie storage by adjusting their web browser settings according to their privacy preferences. This ensures that members can continue to use the service while maintaining their desired level of privacy control.

Article 8 (Changes to the Privacy Policy)

When modifications to this Privacy Policy become necessary, the operator commits to transparent communication with all members. Changes will be announced through the KakaoTalk channel, mobile application, and website at least seven days prior to the effective date of implementation. For changes that may be disadvantageous to members' interests, a more extensive grace period of at least thirty days will be provided to ensure members have adequate time to review and respond to the modifications.