I. Definitions & Scope
This Personal Data Protection Policy sets out the standards for collecting, storing, processing, protecting, and sharing the personal data of users (including tenants and landlord/leasing partners) across Kim Housing's entire data system. As both Data Controller and Data Processor, Kim Housing is committed to strictly complying with Vietnamese data protection law (in particular the 2025 Law on Personal Data Protection and Decree No. 356/2025/ND-CP dated December 31, 2025).
II. Detailed Provisions
1. General principles and consent
Free anonymous access: Kim Housing keeps its platform open. Users may access and look up serviced apartment information completely free of charge and anonymously, without any requirement to register an account or log in.
Principle of consent: By actively submitting information through our contact channels (hotline, Zalo OA), registering for a service, or signing transaction forms (Deposit Receipt, Room Transfer Form), users are deemed to have confirmed and consented to Kim Housing collecting and processing their personal data under the terms of this policy.
2. Categories of data collected
Personal data is classified as follows:
- Technical data (anonymous): The system automatically records non-identifying information such as temporary IP address, device type, operating system, web browser, access time, and general activity history on the website, for the purpose of improving system performance and user experience.
- Transaction identification data:
- Tenants: Full name, ID card/passport number, mobile phone number, permanent address, bank account information (for preferential support services), number of co-residing household members, and number of vehicles.
- Lessor (landlord/manager): Full name, ID card/passport number, phone number, rental building address, and account information for receiving the holding deposit.
- Sales specialists: Full name, phone number, and employee ID.
3. Purpose and scope of information use
Personal data collected is used only for the following lawful purposes:
- Establishing and carrying out transactions: Drafting, cross-checking, and retaining legal transaction records, including the Deposit Receipt, Room Transfer Form, and Transaction Confirmation Form.
- Verification and transparency: Verifying the identity of tenants and landlords to prevent financial fraud, fake listings, or deposit scams.
- Fulfilling legal obligations: Providing tenants' personal information to the lessor to complete temporary residence/absence registration with local police authorities, as required by residency law.
- Customer care: Integrating data to manage loyalty-point accounts on Zalo OA; sending promotional programs and service vouchers from ecosystem partners. Providing contact information implies consent to share limited basic information with these partners to activate offers.
4. Security and data-transfer commitments (per Article 7, Decree No. 356/2025/ND-CP)
No commercialization commitment: Kim Housing is committed to fully safeguarding users' personal data. We do not sell or trade personal data to third parties for commercial purposes without the user's written consent.
Personal data transfer rules: In compliance with Article 7 of Decree No. 356/2025/ND-CP, when transferring users' personal data to a third party (landlord/building manager or ecosystem partner), Kim Housing applies the following measures:
- Written transfer agreement: Establishing a clear written agreement/terms with the data recipient (landlord/manager or partner), specifying: the purpose of transfer, the type of data transferred, the data retention period, the legal basis for processing, each party's data-protection responsibilities, responsibility for fulfilling data subjects' rights, and the coordination mechanism in the event of an incident or violation.
- Limited purpose and scope of use: The data recipient may only process personal data for the committed transfer purpose, consistent with its registered business line, and may not further transfer it to a fourth party without the consent of both Kim Housing and the data subject.
- Transparent consent mechanism: For linked data-sharing activities that generate economic benefit or ancillary services, Kim Housing sets up a clear technical interface or confirmation mechanism so users can give precise, per-service consent.
- Legal requests: Providing data upon the written request of police authorities or competent state administrative agencies for residency management purposes.
5. Storage, protection, and technical security measures
Retention period: Transaction data is securely stored on internal servers for a maximum of two (2) years from the date the transaction ends, for the purpose of financial reconciliation and resolving any complaints or disputes that may arise. After this period, identifying data is deleted or fully anonymized.
Internal protection measures: Data is digitized and centrally managed in an internal database with strict access controls. Sales specialists may only access information for the group of customers they are directly responsible for.
User's security responsibility: Users are responsible for safeguarding their own transaction information and deposit records. Kim Housing is not liable for any loss resulting from a user voluntarily disclosing transaction or account information to a third party outside the system's authority.
6. Data subject rights and response time
Users have the full rights of a data subject under Decree No. 356/2025/ND-CP, including:
- The right to request review, updating, or correction of personal information.
- The right to withdraw consent to data processing or request restricted processing.
- The right to request complete deletion of personal data from Kim Housing's internal storage systems.
How to submit a request: All requests relating to personal data rights may be sent to kimhousing.hrad@gmail.com or submitted in person at the Kim Housing office (14/5A5 Ky Dong Street, Nhieu Loc Ward, Ho Chi Minh City).
Response time: Kim Housing is committed to verifying identity and fully processing a valid user request within a maximum of 48 working hours of receipt.
