Click Star Personal Data Protection Policy

Last updated: 17 October 2026. Effective from the date of publication on the website.

1. Introduction and legal basis

This policy explains how Click Star Digital Co., Ltd (Click Star) collects, uses, stores, shares and protects your personal data when you visit clickstar.vn, submit a consultation request or chat with the assistant on our website.

It is prepared and compared directly with Vietnam's current legislation:

• Personal Data Protection Law No. 91/2025/QH15, passed by the National Assembly on 26 June 2025 and effective from 1 January 2026 (the 2025 PDP Law);
• Decree No. 356/2025/ND-CP of 31 December 2025 of the Government, detailing the Law's implementation, effective from 1 January 2026 and replacing Decree 13/2023/ND-CP.

In each section below we state what the law requires and what Click Star does. A summary comparison is in section 14 and official Government sources are listed in section 16.

2. Key concepts (under the 2025 PDP Law)

• Personal data: digital data or information in other forms that identifies, or helps identify, a specific person; it includes basic and sensitive personal data.
• Basic personal data: common identity and background details used in transactions, such as full name and phone number.
• Sensitive personal data: data tied to privacy which, if infringed, directly affects lawful rights and interests, such as biometrics, health, credit and financial information, location data. The detailed list is set by the Government in Decree 356/2025/ND-CP.
• Data subject: the person the data relates to, that is, you.
• Data controller and processor: the organisation that decides the purposes and means of processing and directly processes the data. Here, that is Click Star.
• Data processor: an organisation processing data on the controller's behalf under a contract (for example an infrastructure provider).
• Processing: any activity affecting data, such as collecting, analysing, storing, editing, deleting, destroying, providing or transferring.

3. Data controller and processor

• Entity: Click Star Digital Co., Ltd
• Address: 6th Floor, MD Complex Tower (Office Building), 68 Nguyen Co Thach, Tu Liem Ward, Hanoi, Vietnam
• Email: [email protected]
• Hotline: +84 383 406 735

4. Data we collect

The law's principle: collect and process data only within a specific, clear scope and purpose in compliance with the law; keep it accurate and store it only as long as appropriate for the purpose.

Click Star's practice: we ask for the minimum information needed to contact you.

A. Data you provide through the contact form

• Full name and phone number (required), which are basic personal data;
• Email and company/brand name (optional);
• Service of interest and your request (you decide how much detail to give);
• A record that you consented to Click Star processing your data, and when.

B. Data generated when you use the website

• Your language choice, stored in the cs-lang cookie;
• The service pages you viewed, stored in your own browser (cs_personalize_v1) to show relevant suggestions; this data sits on your device;
• Click Star's traffic measurement data, to understand how the website is used and improve the experience;
• The text you type into the website assistant chat.

Click Star does not deliberately collect sensitive personal data such as biometrics, health, credit/financial information or precise location.

5. How we use your data

We use your data only for the purposes below, and not for others without your consent:

1. Contacting you, advising and quoting services at your request;
2. Creating and managing customer records and communication history for better support;
3. Sending internal notifications so our team can respond promptly (usually within 24 business hours);
4. Improving website content, performance and experience;
5. Complying with legal obligations when requested by competent authorities.

6. Your consent

The law (Article 9, 2025 PDP Law):

• Consent must be voluntary, and before consenting the data subject must clearly know: the types of data and purposes; the data controller; and their rights and obligations;
• Consent must be clear and specific, in a form that can be printed or copied, including electronic or verifiable formats;
• Consent must be sought for each purpose, with no obligation to accept other purposes;
• Silence or no response is not consent.

What Click Star does:

• The contact form has a consent checkbox that is unticked by default; the form can only be sent when you tick it;
• The consent text names the controller (Click Star), the purpose (consultation) and points to this policy (your rights and obligations);
• We keep a record of consent with its time (Vietnam time) together with your request so it can be verified;
• Any marketing or promotional messages (if offered) will ask for separate consent, not bundled into the consultation checkbox.

Withdrawing consent: you may withdraw consent or request restriction of processing at any time by sending a written request (email is fine) to [email protected]. Withdrawal does not affect processing carried out before it.

7. Sharing and transfer of data

The law: personal data may be transferred only in cases the law allows, including: with the data subject's consent; between the controller and a processor or third party as regulated; at the request of a competent state authority; and the no-consent cases under clause 1, Article 19.

The law prohibits buying and selling personal data (Article 7), unless other laws provide otherwise.

What Click Star does: we do not sell personal data. Data is shared only as needed with:

• Click Star's internal systems (customer management, email notifications) to handle your request;
• Processors that are infrastructure providers hosting and operating the website, database and email delivery, under contractual confidentiality commitments;
• AI service providers when you chat with the website assistant: the text of your question is sent to the provider to generate an answer. Please do not enter sensitive personal information in the chat;
• Competent state authorities where required by law.

8. Transfer of personal data abroad

The law: cross-border transfer covers 3 cases: moving data stored in Vietnam to a system located outside Vietnam; transferring data to organisations or individuals abroad; and using a platform located outside Vietnam to process data collected in Vietnam. The transferring party must prepare a cross-border transfer impact assessment dossier and send it to the specialised unit of the Ministry of Public Security within the prescribed period.

Violations can be fined up to 5% of the previous year's revenue (Article 8).

What Click Star does: some infrastructure, measurement and AI providers we use have servers outside Vietnam. We therefore select providers with suitable security commitments and carry out the dossier and notification obligations under the 2025 PDP Law and Decree 356/2025/ND-CP.

9. Retention and deletion

The law: personal data is stored for a period appropriate to the processing purpose unless the law provides otherwise; data subjects may request deletion.

What Click Star does: we keep data as long as needed for the purposes in section 5, or until you ask us to delete it, whichever comes first, unless the law requires longer retention. Data no longer needed is deleted or destroyed.

10. Safeguards and incident handling

The law: appropriate institutional, technical and human measures must be applied together to protect data.

On discovering a violation that may harm national defence, security, public order, or infringe the life, health, honour, dignity or property of data subjects, the specialised authority must be notified within 72 hours of discovery, with a written record, containment and remediation.

What Click Star does:

• Data is transmitted over encrypted connections (HTTPS);
• Access control: only authorised staff can view customer data;
• Row-level access control on the database;
• Periodic security reviews and prompt remediation of identified risks;
• When a reportable incident occurs, we record it, notify the specialised authority within 72 hours, contain it and remediate.

11. Your rights and how to exercise them

The law: data subjects have 6 rights. Click Star commits to honour each:

1. To be informed about the processing of your data: this policy, and you can ask for more by email;
2. To consent or refuse, and to withdraw consent: as in section 6;
3. To view, correct or request correction of your data: send us the details to amend;
4. To request provision, deletion or restriction of processing, and to object: we act within what the law allows;
5. To complain, denounce, sue and claim compensation under the law: you may contact Click Star first and keep your right to go to competent authorities;
6. To ask competent authorities or relevant organisations to apply protective measures to your data.

How: send a written request (email is fine) to [email protected] with the name and phone number you registered so we can verify you. We respond within the period required by law and aim to do so as soon as possible. If we cannot fulfil a request for a legitimate reason, we will tell you why.

Data subject's obligations (under the law): protect your own data; respect and protect others' data; provide complete and accurate data when consenting to processing; comply with personal data protection law.

12. Cookies, tracking and advertising

The law: customer data may be used for advertising only as agreed or from the business's own activities, with consent, and customers must know the content and frequency and have a way to refuse (Article 28). Tracking behaviour on a website for personalised advertising needs prior consent; data subjects may ask to stop receiving advertising services.

What Click Star does:

• The website uses a small amount of cookies and browser storage (display language, suggestions based on pages viewed, traffic measurement);
• Suggestion data sits in your browser; you can delete or block it at any time in your browser settings, and some features may work less well when blocked;
• We do not use your data to advertise for third parties and do not sell data;
• You may ask to stop receiving marketing from Click Star at any time by email as in section 11.

13. Children's data

The law: a legal representative exercises a child's data-subject rights; processing a child's data (aged 7 or older) to disclose private-life information or personal secrets needs the consent of both the child and the representative; processing must stop on withdrawal of consent or at a competent authority's request.

What Click Star does: the website is not directed at persons under 16 (the definition of a child under Vietnamese law). If you are a legal guardian and find that a child has provided data, please contact us and we will delete it promptly.

14. Comparison: legal requirements and Click Star's practice

Consent (Article 9). Law: voluntary, clear about purpose/controller/rights, verifiable, per purpose, silence is not consent. Click Star: unticked checkbox, controller and purpose named, consent record with time, marketing needs separate consent. Status: implemented.

Withdrawal and restriction (Article 9). Law: written request, including electronic, to the controller. Click Star: accepted at [email protected]. Implemented.

Minimisation and purpose limitation (Article 4 and Chapter II). Law: appropriate scope and purpose, accurate, retention fit for purpose. Click Star: only full name and phone are required; no sensitive data. Implemented.

Transfer of data (Chapter II, Section 1). Law: only in cases the law allows. Click Star: shared only with processors under contract and with state authorities on request. Implemented.

Ban on buying and selling data (Article 7). Law: prohibited. Click Star: no sale or rental of data. Compliant.

Cross-border transfer (Chapter II, Section 1; Article 8). Law: impact assessment dossier sent to the specialised authority; fines up to 5% of revenue. Click Star: providers with security commitments and dossier obligations. Dossier being completed under Decree 356/2025/ND-CP.

Processing impact assessment (Chapter II, Section 1). Law: the controller prepares a dossier and sends it to the specialised authority. Click Star: prepared and updated as required. Being completed.

Breach notification (Article 23). Law: notify the specialised authority within 72 hours, record, remediate. Click Star: internal incident process meeting the deadline. Established.

Data subject rights (Chapter I). Law: 6 rights. Click Star: honoured by email per section 11. Implemented.

Advertising and tracking (Article 28). Law: consent, a way to refuse, right to stop advertising. Click Star: no third-party advertising, browser data can be deleted, own marketing asks separate consent. A cookie-choice tool is being added to the website.

Children's data. Law: representative exercises rights; from age 7 both parties' consent is needed to disclose private-life information. Click Star: not directed at persons under 16, deletion on notice. Implemented.

15. Updates and contact

Click Star may update this policy when the law or our activities change; a new version takes effect from the date it is published on the website. For any question or request about personal data, contact: [email protected] · +84 383 406 735.

16. Official Government sources

• Personal Data Protection Law No. 91/2025/QH15 (Government Official Gazette)
• Law No. 91/2025/QH15 (Government Portal, vanban.chinhphu.vn)
• Decree No. 356/2025/ND-CP detailing the PDP Law (vanban.chinhphu.vn)
• Decree No. 356/2025/ND-CP (Government Official Gazette)
• Introductory material on the basic content of the PDP Law (Ministry of Justice)
• Notable provisions of the 2025 PDP Law (Ministry of Public Security)
• Personal data protection in specific activities and sectors (Ministry of Public Security)
• Notable provisions of the 2025 PDP Law (Government policy-making news portal)

This content provides transparency to customers and is not legal advice. In case of difference, the legal documents in force prevail.