1. Users’ consent
Grand Plaza Club respects privacy and strives to protect the User’s personal data to comply with the provisions of Vietnamese laws. The Privacy Policy governs and regulates Grand Plaza Club’s collection and processing practices of personal data of the Users during the Users’ access or interaction with the Website. Grand Plaza Club takes the privacy of information of Users seriously. This Privacy Policy applies to all data collected by Grand Plaza Club or provided by Users in relation to using the Website.
The Privacy Policy is set out in accordance with Decree No. 13/2023/ND-CP prescribing personal data protection and relevant laws (the “Decree No. 13”). The Users are required and responsible for reading these contents carefully and regularly checking back for updates on any changes set out in the Privacy Policy. By accessing the Website or by agreeing to allow Grand Plaza Club to collect and process the personal data of the Users in a manner of compliance with the laws, the Users accept the policies and regulations described in this Privacy Policy without any limitation or reservation. If Users refuse or disagree with any provisions of the Privacy Policy, please stop accessing the Website.
For clarification, Grand Plaza Club reserves the right to suspend or terminate the access of Users at the time the Users refuse to accept these terms without any notice. The use of the Website will be provided to the Users once Grand Plaza Club obtains the Users’ consent to the collection and processing of personal data in accordance with this Privacy Policy.

2. Definitions
2.1. “Personal data” means information in the form of symbols, scripts, digits, images, sounds, or similar forms in the electronic environment that is associated with a specific person or helps identify a specific person. Personal data includes basic personal data and sensitive personal data.

2.2. “Basic personal data” include:
a) Full name, middle, and birth name, and other names (if any);
b) Date, month, year of birth; date, month, year of death or disappearance;
c) Gender;
d) Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address;
e) Nationality;
f) Images of individuals;
g) Phone number, identity card number, personal identification number, passport number, driver’s license number, license plate number, personal tax, identification number, social insurance number, health insurance card number;
h) Marital status;
i) Information about family relationships (parents, children);
j) Information about the individual’s digital account; personal data reflecting activities and history of activities in cyberspace;
k) Other information that relates to a specific person or helps identify a specific person that does not fall under the category of sensitive personal data.

2.3. “Sensitive personal data” means personal data associated with individual privacy that, when infringed, will directly affect the legitimate rights and interests of individuals, including:
a) Political views, religious views;
b) Health and personal status are recorded in the medical record, excluding information about blood type;
c) Information related to racial and ethnic origin;
d) Information about inherited or acquired genetic characteristics of individuals;
e) Information about individual physical properties, biological characteristics;
f) Information about the sex life, sexual orientation of the individuals;
g) Data on crimes and offenses collected and stored by law enforcement authorities;
h) Information on customers of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including: customer identification as prescribed by laws, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service providers;
i) Data about the individual’s location determined through location services;
j) Other personal data provided by laws is specific and requires necessary security measures.

2.4. “Processing of personal data” is one or more activities affecting personal data, such as collection, recording, analysis, confirmation, storage, modification, publicity, combination, access, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction of personal data or other related actions.

3. Collection of personal data

Grand Plaza Club may collect directly or indirectly personal data of the Users in the course of accessing and using the Website of Users.

4. Notification for processing personal data
4.1. Notification is given once prior to the processing of personal data by Grand Plaza Club.

4.2. Contents of notification to Users regarding the processing of personal data include:
a) Purpose of processing;
b) Type of personal data used related to the purposes of processing specified in section 4.2(a) of this Privacy Policy;
c) Method of processing;
d) Information about other organizations and individuals related to the purposes of processing specified in section 4.2(a) of this Privacy Policy;
e) Possible unexpected consequences and damages;
f) Start time and end time of data processing.

4.3. Notification to Users will be presented by Grand Plaza Club in a format that can be printed, and copied in writing, including in electronic or verifiable format

4.4. Grand Plaza Club does not need to provide a personal data processing notification to Users in the following cases:
a) Users are aware of and fully consent to the contents of sections 4.1 and 4.2 of this Privacy Policy before consenting to the collection of personal data by Grand Plaza Club, in accordance with the provisions of section 11 of this Privacy Policy;
b) Personal data processed by competent state authorities for the purpose of serving the operation of state authorities in accordance with laws.

5. Processing of personal data without the consent of the Users
5.1. In case of emergency, relevant personal data needs to be immediately processed to protect the life and health of Users or others. Grand Plaza Club is responsible for proving this case.

5.2. The disclosure of personal data in accordance with the laws.

5.3. The processing of personal data by competent state authorities in case of an emergency of national defense and security emergency, social order and safety, major disasters, or dangerous epidemics; when there is a threat to national security or defense but not to the extent of declaring a state of emergency; preventing and combating riots, terrorism, preventing and combating crimes and violations of laws in accordance with the provisions of laws.

5.4. Performing the obligations under the User’s contract with relevant agencies, organizations, and individuals in accordance with the provisions of laws.

5.5. Serving the operation of state authorities prescribed by specialized laws

6. Use of personal data
6.1. Any of the above data may be required by the Website from time to time in order to provide Users with the best possible experience when using the Website. Specifically, the data may be used by Grand Plaza Club for the following reasons in accordance with this Privacy Policy:
a) Improvement of our services;
b) Other purposes for which the data was provided to Grand Plaza Club by the Users.

6.2. Grand Plaza Club uses the personal data collected from the Users to provide Users’ support, undertake necessary security and identify verification checks, meet certain business requirements, and for any other purpose related to the operation of the Website. User’s personal data may also be used by Grand Plaza Club to provide Users with:
a) Promotional offers and information regarding our services; and
b) Promotional offers and information regarding the services of our partners, in order to enlarge the range of provided services and improve our customer service.

7. Provision of personal data
7.1. Users are entitled to ask Grand Plaza Club to provide themselves with their personal data.

7.2. Grand Plaza Club shall have the right:
a) To provide personal data of Users to other organizations and individuals with the consent of Users, unless otherwise provided for by laws;
b) To provide personal data of Users to other organizations or individuals on behalf of Users when Users agree to allow representation and authorization unless otherwise provided for by laws.

7.3. The provision of personal data of Users is provided by Grand Plaza Club within 72 hours after the User’s request unless otherwise provided by laws.

7.4.Grand Plaza Club does not provide personal data under the circumstances:
a) Causing harm to national defense, security, social order, and safety;
b) The provision of personal data of Users may affect the safety, physical or mental health of others;
c) Users do not agree to provide, allow to represent, or authorize to receive the personal data.

7.5. Form of request for personal data:
a) Users directly or authorize others to come to Grand Plaza Club’s head office to request personal data. Grand Plaza Club’s staff receiving requests is responsible for instructing Users or Users’ authorized representatives to fill in the Personal Data Request Form. In case the Users or Users’ authorized representative requesting the information is illiterate or has a disability that cannot write the request, Grand Plaza Club’s staff receiving the request is responsible for helping to fill in the contents of the Personal Data Request Form.
b) To send the request form for personal data in accordance with the forms prescribed by laws via electronic network, postal service, fax to Grand Plaza Club.

7.6. The request form for the provision of personal data shall be in Vietnamese, including the following main contents:
a) Full name, first name; place of residence, address; identity card number, citizen identification card or passport number; fax number, telephone number, email address (if any);
b) Personal data requested to be provided, specifying the name of the document, dossier;
c) Forms of provision of personal data;
d) Reasons and purposes of request for provision of personal data.

7.7. In case of a request to provide personal data specified in section 7.2 of this Privacy Policy, it must be accompanied by the written consent of the individual or organization concerned.

7.8. Receiving requests for personal data:
a) Grand Plaza Club is responsible for receiving requests for personal data and monitoring the process and list of personal data provisions upon request;
b) Where the requested personal data is not within our competence, Grand Plaza Club must notify and instruct the requesting organization or individual to the competent authority or clearly notify the inability to provide personal data.

7.9. Handling requests for personal data Upon receipt of a valid request for personal data, Grand Plaza Club shall inform the duration, place, and form of provision of personal data; actual costs for printing, copying, capturing, and sending information via postal and fax services (if any) and payment methods and terms; provide personal data in accordance with the orders and procedures specified in the section 7 of this Privacy Policy.

8. Correction of personal data
8.1. Grand Plaza Club corrects the User’s personal data after obtaining the User’s consent as soon as possible or in accordance with specialized laws. In case this is not possible, Grand Plaza Club shall notify Users after 72 hours after receiving the request to correct the Users’ personal data.

8.2. Users have access to view and correct their personal data after it has been collected by Grand Plaza Club in accordance with your consent unless otherwise provided by laws. Where direct correction is not possible due to technical or other reasons, Users are entitled to request Grand Plaza Club to correct their personal data.

8.3. Users have access to view and correct their personal data after it has been collected by Grand Plaza Club in accordance with your consent unless otherwise provided by laws. Where direct correction is not possible due to technical or other reasons, Users are entitled to request Grand Plaza Club to correct their personal data.

9. Retention, deletion, destruction of personal data
9.1. Users are entitled to request Grand Plaza Club to delete their personal data in the following cases:
a) Realizing that it is no longer necessary for the purpose agreed and accepting the possible damages that may occur when requesting deletion of data;
b) Withdrawal of consent;
c) Object to the processing and Grand Plaza Club has no legitimate reason to continue the processing;
d) Personal data is processed in contravention of the agreed purpose, or the processing of personal data is in violation of the provisions of laws;
e) Personal data must be deleted in accordance with the provisions of laws.

9.2. Deletion of personal data will not apply at the request of Users in the following cases:
a) Data deletion is not allowed by laws;
b) Personal data are processed by competent state authorities for the purpose of serving their operations in accordance with laws;
c) Personal data that has been public in accordance with the provisions of laws;
d) Personal data are processed to serve legal requirements, scientific research and statistics in accordance with the provisions of laws;
e) In case of an emergency of national defense and security, social order and safety, major disasters or dangerous epidemics; when there is a threat to national security or defense but not to the extent of declaring a state of emergency; preventing and combating riots, terrorism, preventing and combating crime and violations of laws;
f) Respond to an emergency that threatens the life, health or safety of Users or other individuals.

9.3. Data deletion is done within 72 hours after the User’s request for all personal data collected by Grand Plaza Club, unless otherwise required by laws.

9.4. Grand Plaza Club stores personal data in a form consistent with our operations and takes measures to protect personal data in accordance with the laws.

9.5. Once deleted, personal data cannot be recovered in the following cases:
a) Improper processing of personal data or fulfillment of the purpose of processing personal data agreed upon by the User;
b) The storage of personal data is no longer necessary for the operation of Grand Plaza Club;
c) Grand Plaza Club is dissolved or ceases to operate or declares bankruptcy or has our business operations terminated in accordance with laws.

10. Protection of personal data
Grand Plaza Club shall treat Users’ personal data as private and confidential right from the start and throughout the processing of personal data. Grand Plaza Club shall not disclose Users’ personal data to any other party, except in the following cases:
a) With the consent of the Users;
b) Users authorize Grand Plaza Club to provide the personal data;
c) When Grand Plaza Club transfers rights and obligations under the agreement(s) between the Users and Grand Plaza Club;
d) According to the requirements of relevant competent authorities or compliance with the laws;
e) Other cases as prescribed by laws.

11. Users’ rights
Users have the rights concerning their personal data as prescribed in Decree No. 13/2023/NĐ-CP. To make enquiries, exercise any of Users’ rights set out above, withdraw Users consent to the processing of Users’ personal data, or make a complaint against our way of processing of their personal data, please contact us at (84) 936-263-330.
In the event that the Users are not satisfied with Grand Plaza Club’s response to your complaint in relation to the processing of their personal data, Users may send your complaint to the relevant data protection authority. It is important that the Users’ personal data held by Grand Plaza Club is accurate. Please keep Grand Plaza Club informed if Users’ personal data changes during the period of processing of Grand Plaza Club.

12. Withdrawal of consent
12.1. Users have the right to withdraw their consent to provide personal data to Grand Plaza Club.

12.2. The withdrawal of consent does not affect the lawfulness of the processing of personal data that was consented prior to the withdrawal of consent.

12.3. The withdrawal of consent must be expressed in a format that can be printed, copied in writing, including in electronic or verifiable format.

12.4. Upon receiving a request to withdraw consent from Users, Grand Plaza Club shall notify Users of the consequences and damages that may occur when withdrawing consent.

12.5. Upon receipt of notice of withdrawal of consent from Users in accordance with section 12.3 of this Privacy Policy, Grand Plaza Club must cease and request the relevant organizations and individuals to stop processing the personal data of Users.

13. Changes in business ownership and control
Grand Plaza Club may, from time to time, expand or reduce our business, leading to the involvement of the sale and/or transfer of control of all or part of the Website, personal data provided by Users’ willingness, where it is relevant to any part of Grand Plaza Club’s business, be transferred and the new owner or newly controlling party will, under the terms of this Privacy Policy, be permitted to use the personal data for the purposes for which it was originally supplied to Grand Plaza Club.

14. Cookies
When Users visit the Website, cookies are stored on your computer. It is mostly used to make the Website work as Users expect and give you a more personalized experience. The Users can accept all or part of cookies on the Website.

15. General terms
Users may not transfer any of Users’ rights under this Privacy Policy to any other person. Grand Plaza Club may transfer Grand Plaza Club’s rights under this Privacy Policy where Grand Plaza Club reasonably believes that Users’ rights will not be affected. If any provision of this Privacy Policy (or part of any provision) is invalid, illegal, or unenforceable, that provision or part-provision will be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be affected.

Grand Plaza Club reserves the right to update or modify this Privacy Policy at any time. Any changes will be posted on the official Website and, where appropriate, notified to Users via email or in-app notifications.