Privacy Policy - GDPR Compliant (US)
- Hanoi Voyages

Version 2025 – This Privacy Policy explains how Hanoi Voyages collects, uses, stores, protects, and processes personal data in compliance with:

  • Regulation (EU) 2016/679 (GDPR)

  • ePrivacy Directive

  • Guidelines of the European Data Protection Board (EDPB)

  • Applicable US privacy principles (transparency, notice, consumer rights, and data security)

1. Data Controller

Hanoi Voyages
2nd Floor, Hanoi Group Building, 445 Doi Can Street, Ngoc Ha Ward, Hanoi, Vietnam

🌐 www.hanoivoyage.com
📧 [email protected]
☎️ +84 24 37 15 30 12

Although Hanoi Voyages is established outside the European Union, it offers services to EU and US residents and therefore complies with GDPR Article 3 (territorial scope) and applicable international data protection standards.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1. Identity Data

Full name, email address, phone number, postal address, country of residence.

2.2. Travel-Related Data

Travel dates, preferences, group composition, passport details, special requests, dietary restrictions, accessibility needs.

2.3. Technical Data

IP address, device type, browser information, cookies, session identifiers, navigation data.

2.4. Financial Data

Payment confirmations and transaction records.
Hanoi Voyages does not store credit or debit card numbers.

2.5. Marketing & Communication Data

Website interactions, quote requests, email engagement, subscription preferences.

3. Purposes of Processing (GDPR Art. 5 & 6)

Your personal data is processed for the following purposes:

  • Handling travel inquiries and quotation requests

  • Designing and personalizing travel itineraries

  • Performing contractual travel services

  • Managing bookings with travel partners

  • Customer support before, during, and after the trip

  • Payment processing and accounting compliance

  • Website performance improvement and user experience optimization

  • Sending newsletters and travel information (with consent)

  • Statistical analysis and audience measurement

  • Legal compliance and fraud prevention

4. Legal Bases for Processing (GDPR Art. 6)

Processing is based on one or more of the following legal grounds:

  • Contract performance (quotes, reservations, travel arrangements)

  • Consent (newsletters, non-essential cookies, personalized marketing)

  • Legitimate interest (service improvement, website security, analytics)

  • Legal obligations (accounting, regulatory compliance, authority requests)

5. Data Recipients

Personal data is shared strictly on a need-to-know basis with:

5.1. Travel Service Providers

(necessary for service delivery)

  • Hotels and accommodation providers

  • Transportation companies

  • Local guides

  • Cruise operators

  • Travel insurance providers

  • Certified tourism partners

5.2. Technical Sub-Processors (GDPR Art. 28)

  • Web hosting providers

  • Email communication platforms

  • Payment service providers

  • Analytics and marketing tools (e.g. Google Analytics, Meta)

All partners and sub-processors are contractually bound to:
✔ comply with GDPR or equivalent standards
✔ implement appropriate security measures
✔ process data solely for agreed purposes

6. International Data Transfers (GDPR Art. 44–50)

Personal data may be transferred to Vietnam or other non-EU countries only when necessary to deliver travel services.

Such transfers are safeguarded through:

  • Standard Contractual Clauses (SCCs)

  • Enhanced technical measures (encryption, restricted access)

  • The principle of necessity for contract execution

No data is transferred to unsafe jurisdictions without appropriate safeguards.

7. Data Retention Periods (GDPR Art. 5.1.e)

  • Quote requests: 3 years after last contact

  • Client data: contract duration + 5 years

  • Invoices and accounting records: 10 years (legal obligation)

  • Cookies: 13 months

  • Newsletter subscriptions: until unsubscribed

8. Your Data Protection Rights (GDPR Art. 12–23)

You have the right to:

  • Access your personal data

  • Rectify inaccurate or incomplete data

  • Object to processing, including direct marketing

  • Request erasure (“right to be forgotten”)

  • Restrict processing

  • Data portability

  • Withdraw consent at any time

  • Lodge a complaint with a European supervisory authority
    (e.g. CNIL – France: www.cnil.fr)

To exercise your rights: 📧 [email protected]
We will respond within 30 days.

9. Cookies & Tracking Technologies (ePrivacy)

We use the following types of cookies:

Essential Cookies

Required for website functionality.
Legal basis: legitimate interest.

Analytics Cookies

Audience measurement (e.g. Google Analytics).
Legal basis: consent.

Marketing & Advertising Cookies

Targeted advertising and remarketing.
Legal basis: consent.

Social Media Cookies

Content sharing via Facebook, Instagram, etc.
Legal basis: consent.

You may manage or withdraw your consent at any time via:

  • the cookie consent banner

  • your browser settings

Refusing non-essential cookies does not restrict website access.

10. Data Security Measures (GDPR Art. 32)

10.1. Technical Security

  • SSL/TLS encryption

  • Secure servers

  • Firewalls and malware protection

  • Restricted and logged access

  • Regular data backups

10.2. Organizational Security

  • Trained personnel

  • Internal access control

  • Confidentiality agreements

  • Internal data protection procedures

11. Personal Data Breach Management (GDPR Art. 33–34)

In the event of a data breach likely to result in risk:

  • Notification to the competent EU authority within 72 hours

  • Notification to affected individuals if the risk is high

12. Sensitive Data

Hanoi Voyages does not intentionally collect sensitive personal data
(health, religion, biometric data, etc.).

Such data is processed only if voluntarily provided and strictly for travel safety or adaptation purposes, and never for marketing.

13. Children’s Data

Our services are not intended for unaccompanied minors.
Any personal data related to a child must be provided by a legal guardian.

14. Changes to This Privacy Policy

This Privacy Policy may be updated to reflect:

  • Legal or regulatory changes

  • EDPB or supervisory authority recommendations

  • Internal technical developments

The online version shall always prevail.

15. Contact — Data Protection

Hanoi Voyages
2nd Floor, Hanoi Group Building, 445 Doi Can Street, Ngoc Ha Ward, Hanoi, Vietnam

🌐 www.hanoivoyage.com
📧 [email protected]
☎️ +84 24 37 15 30 12