Privacy Policy

VALÉ by Doris Duong ("we") is committed to protecting your personal data in compliance with Decree 13/2023/ND-CP on Personal Data Protection in Vietnam. This policy applies to all users accessing and using the website valebydorisduong.com.

We collect the following types of data: • Account information: full name, email address, password (bcrypt-encrypted). • Shipping information: delivery address, phone number, recipient name. • Purchase history: list of orders, purchased products, transaction dates. • Technical data: IP address (stored in security logs), browser device (user-agent). We do NOT collect or store payment card or account information — no online transactions take place on this website. Payment is agreed separately via Messenger or Instagram.

Your data is used for the following purposes: • Processing and delivering your orders. • Communicating order status and delivery issues. • Providing customer support. • Improving the shopping experience and service quality. • Detecting and preventing fraud, ensuring account security. • Complying with legal obligations (invoice retention per Vietnamese regulations).

• Account data and purchase history: retained for 3 years from the last transaction. • Security logs (IP, login activity): retained for 90 days. • After account deletion: personal data (name, email) is anonymised immediately. Order history is retained for accounting purposes per Vietnamese law. • Upon expiry of the retention period, data is permanently deleted or anonymised.

VALÉ by Doris Duong does not sell, rent or exchange your personal data with any third party for commercial purposes. Your data is only shared with essential technical partners: Cloudflare (security), Supabase (database storage) and Vercel (hosting). These partners are bound by strict confidentiality obligations.

Your data is stored at: • Database: Supabase (PostgreSQL), Southeast Asia region — Singapore (AWS ap-southeast-1). • Website hosting: Vercel Inc., San Francisco, USA. Data is distributed via a global CDN but personal data is not stored at CDN level. • Product images: Cloudinary (does not contain personal data). International data transfers comply with appropriate safeguards as required by Decree 13/2023/ND-CP.

Under Decree 13/2023/ND-CP, you have the following rights over your personal data: • Right of access: view and download your personal data (at /account/profile). • Right to rectification: update account information and addresses (at /account). • Right to deletion: request account deletion and anonymisation of personal data (at /account/security). • Right to object: object to data processing in certain circumstances. • Right to complain: submit a complaint to the Information Security Department, Ministry of Information and Communications of Vietnam. To exercise any of the above rights, please contact: contact@valebydorisduong.com

We only use cookies necessary for website operation: • Session cookies: maintain your login state (httpOnly, secure, sameSite strict). • Language cookie: save your language preference (VI/EN). • No payment provider cookies since no online payment processing takes place. We do NOT use advertising tracking cookies, third-party analytics cookies (Google Analytics, Facebook Pixel) or any other non-essential cookies. We collect anonymous visit statistics without cookies and without personal data (no IP addresses are stored), deleted automatically after 90 days.

We apply the following technical measures to protect your data: • Passwords encrypted with bcrypt (cost factor 12). • Mandatory SSL/TLS connection across the entire website. • Failed login attempt limits (account locked after 5 attempts). • Optional two-factor authentication (2FA) for accounts. • Security monitoring and logging for all sensitive activities. • Regular security audits.

For any questions regarding this privacy policy or your personal data, please contact: Email: contact@valebydorisduong.com Address: Ho Chi Minh City We commit to responding within 72 hours.