Draft translation, not yet approved. The Vietnamese version applies until this one is approved.
Privacy policy and data processing agreement
Stayloom has two roles: controller of the Host's data, and processor on the Host's behalf for the data of visitors to the Website. This document is written to meet the Personal Data Protection Law 2025, Decree 356/2025/ND-CP, and the GDPR where Hosts or guests are in the EU or UK.
Version: PRIV-v1.0
F1. Privacy policy (the Host's data)
1. Data Stayloom collects
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Contact | Name, email, phone number, Zalo/Telegram | Providing the Service, communication, renewal reminders | Consent; performance of the contract |
| Payment and invoicing | Transaction code, company name, tax code, address | Confirming payment, issuing invoices | Legal obligation (tax, accounting) |
| Commission payouts | Bank account number, tax code or ID number | Payouts and tax withholding | Legal obligation; performance of the contract |
| Host Content | Photos, story, room information, links | Building and running the Website | Performance of the contract |
| Technical | IP address, device, dashboard access logs | Security, fraud prevention | Legitimate interest; consent |
| Proof of consent | Document version, time, IP when the box was ticked | Proving the contract was made | Legal obligation |
Stayloom does not buy or sell personal data and does not use Hosts' data to advertise for third parties.
2. Recipients
| Recipient | Role | Where processed |
|---|---|---|
| Cloudflare | Hosting, storage, CDN, domain registration, notification emails | United States and global network |
| Anthropic (Claude AI model) | Processing Host Content to build and edit the Website | United States |
| PayPal; payOS and banks | Payments | United States / Vietnam |
.vn domain registrar | Domain registration | Vietnam |
| Accountant, e-invoice provider | Invoices, tax | Vietnam |
| Competent state authorities | When lawfully requested | Vietnam or where competent |
3. International transfers. The Host agrees to their data being transferred to the recipients above. Stayloom only uses providers with data processing agreements and confidentiality commitments, and for data from the EU or UK the Standard Contractual Clauses (SCC). Stayloom prepares a cross-border transfer impact assessment under Vietnamese law when required.
4. Retention
- Account data and Host Content: for the duration of the contract and 30 days after it ends, then deleted.
- Accounting records, invoices, tax withholding certificates: for the period required by the Law on Accounting.
- Technical logs: up to 12 months.
- Proof of consent: for the statutory limitation period, at least 3 years after the contract ends.
5. The Host's rights. The Host has the right to be informed, to consent or withdraw consent, to access, correct, request deletion, restrict processing, receive a copy of their data, object to processing, complain and claim compensation. Send requests to stayloom.net@gmail.com; Stayloom replies within the statutory time limit. Withdrawing consent does not affect processing already carried out, and may mean Stayloom can no longer provide the Service.
6. Security. Encrypted connections (HTTPS), role-based access, two-factor authentication for administrator accounts, separate access control for the administration system, regular backups.
7. Data breaches. When a personal data breach is discovered, Stayloom notifies the competent personal data protection authority within 72 hours and the affected Hosts within the statutory time limit.
8. Under 18s. The Service is for people aged 18 or over with capacity to enter into contracts.
9. Contact and complaints. Data protection contact: Doan Thi My Linh, stayloom.net@gmail.com. Hosts may complain to the personal data protection authority of the Ministry of Public Security, or to the supervisory authority where they live in the EU or UK.
F2. Data processing agreement (data of Website visitors)
1. Scope. Applies to personal data of visitors and of guests who send forms on the Website: name, email, phone number, dates of stay, message content, visit and click data. The Host is the controller; Stayloom is the processor.
2. The Host's obligations
- Have a lawful basis to process guests' data, and approve the guest privacy notice Stayloom prepares on the Website.
- Not ask for sensitive data or identity documents through the Website.
- Handle guests' data lawfully when receiving it by email or through the dashboard.
3. Stayloom's obligations
- Process only on the Host's instructions as set out in these documents and the Website configuration; not use guests' data for its own purposes.
- Ensure that people with access to the data are bound by confidentiality.
- Apply the security measures in section F1.6.
- Use the sub-processors listed in F1.2. Give 30 days' notice before adding a new sub-processor; the Host may object and terminate if they disagree.
- Help the Host answer guests' data rights requests.
- Notify the Host within 48 hours of discovering an incident involving the Website's guest data.
- On termination, return (through the data export) and delete guests' data within 30 days, unless the law requires it to be kept.
- Provide the documents needed to demonstrate compliance on the Host's reasonable request, at most once a year.
4. Data from the EU or UK. Where the Host is in the EU or UK, the parties apply the European Commission's SCC (Module 2, controller to processor) and the corresponding UK addendum; the SCC prevail in case of conflict.
5. Cookies and affiliate links. By default the Website uses no tracking cookies and loads no analytics or affiliate tracking scripts. Clicks on affiliate links are only counted per day, not linked to the person who clicked. When a guest clicks a link, they are taken to the partner's site; any cookies are set by the partner on its own site, and the partner is an independent controller under its own policy. If the Host asks to enable measurement tools, the Website shows a cookie banner (Part H) and loads those tools only after the guest consents.