InnoVerse observes Decree 13/2023/ND-CP on personal data shields within Vietnam. This notice explains stewardship practices plus your tooling.
Version 1.0 · refreshed 2026-04-15 · operative 2026-05-01
Article nine Decree thirteen · pertinent to Vietnamese citizens · residents anchored domestically.
Understand which personal attributes process under which lawful basis.
Affirm · decline · revoke processing where elective.
Request portable copies referencing stored dossiers.
Demand inaccurate records corrected swiftly.
Invoke deletion where statutes permit.
Temporarily constrain processing envelopes.
Contest processing rooted in overstretched interpretation.
Escalate supervisory authorities when harmed.
Exercise privileges: email sales@innoverse.vn · reply window seventy-two operating hours · no extraction fees.
Retention: Twenty-four months post-final interaction
Retention: Twenty-six months (GA4 default envelope)
Retention: Ten years · statutory bookkeeping requirement
Retention: Customer stipulated · ninety-day pragmatic default
Retention: Purged as employment terminates
Executed DPAs enumerate purpose · residency · onward transfer calculus.
| Processor | Purpose | Region | Cross-border |
|---|---|---|---|
| Resend | Transactional SMTP | US | Yes · lawful transfer |
| Vercel | Edge hosting · CDN | Singapore | Yes · lawful transfer |
| Cloudflare R2 | Object storage buckets | Singapore | Yes · lawful transfer |
| Google Analytics 4 | Audience analytics · anonymised | US | Yes · lawful transfer |
| Hotjar | Session replay · masked | EU | Yes · lawful transfer |
| Sentry | Reliability instrumentation | US | Yes · lawful transfer |
| Upstash Redis | Cache fabrics · throttle counters | Singapore | Yes · lawful transfer |
DPO coordinates every subject-access workflow.
We notify impacted subjects inside seventy-two hours from discovery when obligations trigger (Decree thirteen · Article fourteen analogue).
Route DSR artefacts via ticketing or email · seventy-two-hour acknowledgement.
