PRIVACY POLICY

VinaBos • Version 1.0 • Effective from 1 September 2026

We collect data in order to properly operate the rental management software you are using — managing rooms, contracts, invoices and notifications. We do not sell data, do not use it for advertising, and do not track you across other apps or websites.

1. Who we are

VinaBos Company Limited ("VinaBos", "we", "the Company") provides the VinaBos software — a management platform for boarding houses, mini apartment buildings and serviced apartments, available as a web version and as mobile apps on iOS and Android.

2. Who is responsible for tenant data

VinaBos's role with respect to personal data depends on the entity that directly operates the accommodation facility:

Case 1 – Facilities directly operated by VinaBos:

VinaBos directly collects and processes the personal data necessary to manage tenants, contracts, payments, residence and facility operations. In this case, VinaBos is responsible for the personal data processing activities within its scope of management in accordance with the law.

Case 2 – Other entities using the VinaBos software:

Landlords or operators using the VinaBos software are responsible for the collection and use of the personal data of tenants at their own facilities. VinaBos provides the platform and stores and processes data to the extent necessary to provide the software service, maintenance, security, incident resolution and technical support.

Data is segregated between the entities using the software. One operator may not access the data of another.

VinaBos maintains system administration accounts with technical access to data when necessary to operate the system, ensure security, resolve incidents or provide support at the request of the entity using the software. Such access is not for the purpose of using customer data for independent business activities, advertising, or the purchase or sale of data.

When an operator enters data of tenants or co-occupants into the system, that operator is responsible for ensuring that the collection and provision of the data to the system has a lawful basis, and for fulfilling the related obligations in accordance with the law.

3. Data we collect

Depending on the user's role and the functions used in the system, VinaBos may collect and process the following categories of data:

3.1. For landlords and staff

  • Full name, email, phone number;

  • Profile photo, employee ID (if any);

  • The account's role and permissions in the system;

  • Information necessary to sign in and authenticate the account;

  • Sign-in times and activity logs in the system, to the extent recorded by the system.

3.2. For tenants and co-occupants

Tenant information may be entered into the system by VinaBos, the landlord or the operator's staff based on information provided by the tenant. Some information may also be provided or updated directly by the tenant through their own account.

This data may include:

  • Full name, phone number, email, date of birth, gender, place of origin;

  • Identity document information such as citizen ID card/ID card, passport, and images of such documents;

  • Information about co-occupants, to the extent necessary to manage the tenancy and carry out residence registration procedures;

  • Residence registration and declaration information;

  • Information about the rented room/apartment, the lease contract, the lease term and the deposit;

  • Invoices, payment history and outstanding balances;

  • Repair requests, feedback, supporting photos and communications related to the tenancy and use of the room/apartment.

VinaBos and operators collect and process only the information necessary and appropriate for the purposes of managing the tenancy, operating the accommodation facility and fulfilling obligations under the law.

3.3. Data from devices and the app

When users use the corresponding functions, the app may process:

  • Device identifiers or technical information necessary to send notifications related to invoices, contracts, payments and management activities;

  • Images that users actively take or select to upload to the system, including images of identity documents, rooms/apartments, buildings, or images for repair requests and management;

  • Technical information necessary to keep users signed in and to ensure the operation and security of the app.

When a function requires the camera, photo library or other access permissions on the device, the app will request the appropriate permission through the operating system's mechanism.

3.4. Activity and security logs

The system may record information about account activity, including sign-in times and actions performed in the system, to the extent necessary to:

  • Manage and protect accounts;

  • Ensure system security;

  • Detect and handle abnormal access;

  • Provide technical support;

  • Reconcile records and resolve complaints or disputes when necessary.

4. How we use data

VinaBos processes personal data to the extent necessary for the following purposes:

  • Creating, managing and authenticating user accounts; assigning access permissions appropriate to the role of each account;

  • Managing buildings, rooms/apartments, tenants, co-occupants, lease contracts and information related to the tenancy;

  • Managing invoices, rent, electricity, water, fees, payments, outstanding balances, income and expenses, and reports supporting operations;

  • Managing the information necessary to carry out residence registration and declaration and related obligations in accordance with the law;

  • Sending notifications related to contracts, invoices, payments, outstanding balances and management activities relevant to the user;

  • Receiving and handling repair requests, feedback, incidents or support requests during the tenancy and use of the room/apartment;

  • Providing the software service, technical support, maintenance and incident resolution, and ensuring the stable operation of the system;

  • Protecting accounts and the system; detecting, preventing and handling unauthorized access, fraud or other risks to data security;

  • Managing service provision and payment of software usage fees by landlords or operators using VinaBos;

  • Reconciling records and resolving complaints, disputes and other issues arising from the use of the service;

  • Fulfilling obligations under the law and providing information to competent state authorities upon lawful request.

4.1. Future utilities, services and partnership programs

In the future, VinaBos may develop or integrate additional utilities, services, promotional programs, introductory content or partnership programs with partners to serve the needs of users on the VinaBos platform.

Where these activities involve the use of personal data for marketing, advertising, service introduction, content personalization or sharing data with partners, VinaBos will clearly notify users of the purpose and scope of data processing, and will obtain consent or complete other necessary procedures in accordance with the law before implementation.

With respect to tenant data belonging to landlords or operators using the VinaBos software, VinaBos does not, on its own initiative, use such data for independent business purposes outside the scope of providing and operating the software. Any partnership programs or commercial activities involving this group of users will be implemented on the basis of an agreement with the relevant operator and in compliance with personal data protection regulations.

VinaBos does not sell users' personal data to third parties. Where a user actively registers for or chooses to use a service provided by a partner, the information necessary to provide that service will be transferred to the partner only to the extent appropriate to the service the user has chosen and in accordance with the law.

5. Sharing and disclosure of personal data

VinaBos shares or discloses personal data only to the extent necessary, consistent with the notified processing purposes and in accordance with the law.

Personal data may be shared or disclosed in the following cases:

5.1. Landlords or operators

For facilities using the VinaBos software, the landlord or operator may access and process the data of tenants at the facilities under its management for the purposes of managing tenants, contracts, invoices, payments, residence, repairs and related operational activities.

Data is segregated between landlords or operators. One entity may not access data belonging to another, unless otherwise provided by law.

5.2. Technical and infrastructure service providers

VinaBos may use technical service providers necessary to operate the system, including server, data storage, backup, notification delivery, security and related technical services.

These providers may access or process data only to the extent necessary to provide services to VinaBos and must comply with data protection obligations under the law and the relevant agreements.

5.3. Partners providing utilities or services

In the future, VinaBos may cooperate with partners to provide additional utilities, services, promotional programs or relevant content to users on the VinaBos platform.

VinaBos does not provide users' personal data to these partners by default.

When a user actively registers for, selects or agrees to use a service provided by a partner, VinaBos may provide the partner with the information necessary to perform the service the user has chosen. The user will be notified of the purpose and scope of data sharing, and data processing will be carried out in accordance with the law.

For tenants belonging to other landlords or operators using the VinaBos software, the implementation of partnership programs or commercial activities involving the data of this group of users must also be consistent with the agreement between VinaBos and the relevant operator.

5.4. Competent state authorities

VinaBos may provide personal data to the extent necessary upon lawful request by a competent state authority or when providing the data is necessary to fulfill obligations under the law.

5.5. Other cases

If a need arises to share personal data for purposes other than those already notified, VinaBos will provide notice, obtain consent or complete other necessary procedures in accordance with the law before doing so, except where the law permits data processing without the consent of the data subject.

6. Data retention period

VinaBos retains personal data for as long as necessary to fulfill the purposes stated in this Policy, provide and operate the service, settle arising obligations and comply with the law.

The retention period is determined according to each category of data and processing purpose, specifically:

6.1. During use of the service

Account data, tenant information, contracts, invoices, payments, outstanding balances, residence information, repair requests and related operational data are retained for as long as necessary for VinaBos or the operator to provide and manage the service.

6.2. When a user account is deleted

When a user requests account deletion, VinaBos will delete, or take appropriate measures with respect to, the personal data associated with the account in accordance with the account and data deletion procedure.

Some data may continue to be retained if retention is necessary to fulfill legal, accounting or tax obligations, resolve complaints or disputes, prevent fraud or meet other lawful obligations. Such data is retained only to the extent and for the period required under applicable regulations.

Deleting a sign-in account does not mean that all data related to lease contracts, transactions or legal obligations is deleted immediately.

6.3. When a landlord or operator stops using the VinaBos software

When a landlord or operator ceases using the software, VinaBos may retain the data for a reasonable period to support the export, handover or restoration of data where necessary.

After this retention period, VinaBos will delete, anonymize or take other appropriate measures with respect to data that is no longer necessary, unless the data must continue to be retained under the law or under a lawful agreement between the parties.

VinaBos does not use the data of an entity that has terminated the service for independent business purposes outside the scope that has been notified or agreed.

6.4. System logs and security data

Activity logs, sign-in information and security-related data may be retained for as long as necessary to protect the system, detect and investigate incidents, reconcile activities and resolve complaints or disputes.

6.5. When the retention period expires

When personal data is no longer necessary for the processing purpose and there is no longer a basis or obligation to continue retaining it, VinaBos will delete it, anonymize it or apply appropriate measures so that the data is no longer used for unauthorized purposes.

7. Protection of personal data

VinaBos applies appropriate technical and organizational measures to protect personal data against the risk of unauthorized access, use, disclosure, alteration, loss or destruction.

Protective measures may include:

  • Using secure connections when transmitting data between the app, the website and the server system;

  • Applying account authentication mechanisms and role-based access control;

  • Segregating the scope of data between landlords or operators using the VinaBos software;

  • Limiting access to personal data according to function, duties and necessity;

  • Applying protective measures to sign-in credentials, identity documents and other data requiring protection;

  • Recording system activities or events necessary for security, auditing, reconciliation and incident handling;

  • Implementing backup, recovery and data protection measures appropriate to the technical system in use;

  • Controlling the access of system administration accounts and technical personnel to the extent necessary for operation, maintenance, support and incident resolution.

With respect to data belonging to other landlords or operators using the VinaBos software, VinaBos's technical administration rights do not mean a right to freely use the data. Data is accessed only to the extent necessary to provide the service, ensure system security, perform maintenance, resolve incidents, provide support upon request or fulfill obligations under the law.

Although VinaBos applies measures to protect personal data, no information technology system can guarantee absolute security. When an incident that may affect personal data is detected, VinaBos will take the necessary measures to address it and will notify the relevant parties or competent state authorities where required by law.

8. User rights regarding personal data

Under Vietnamese law on personal data protection, users have rights regarding their personal data to the extent provided by law, including the right to:

  • Be informed about the processing of their personal data;

  • Consent or not consent to the processing of personal data in cases where the law requires consent;

  • Access, view and request a copy of their personal data;

  • Request the correction or updating of inaccurate or incomplete personal data;

  • Withdraw consent previously given for processing based on consent;

  • Request the deletion of personal data in cases permitted by law;

  • Request the restriction of, or object to, the processing of personal data in cases provided by law;

  • File complaints or denunciations, initiate lawsuits or request the protection of their lawful rights and interests in accordance with the law;

  • Claim compensation for damages when their rights regarding personal data are infringed, in accordance with the law.

8.1. How to exercise these rights

Users may exercise some rights directly through the functions provided in the VinaBos app or by sending a request to VinaBos using the contact information published at the end of this Policy.

VinaBos may ask the requester to provide the information necessary to verify their identity before processing a request, in order to prevent personal data from being accessed, altered or deleted by unauthorized persons.

8.2. Data at facilities directly operated by VinaBos

For tenants at facilities directly operated by VinaBos, VinaBos will receive and handle requests related to personal data in accordance with the law and this Policy.

8.3. Data belonging to other landlords or operators

For tenants at facilities of other landlords or operators using the VinaBos software, certain requests related to tenancy records, contracts, payments, residence or data managed by that entity may need to be forwarded to the relevant landlord or operator for verification and handling.

In this case, VinaBos will assist by receiving and forwarding the request, or by guiding the user to contact the appropriate responsible entity.

8.4. Limitations on requests for deletion, correction or restriction of processing

The exercise of user rights does not mean that all data must be deleted, corrected or no longer processed immediately in every case.

VinaBos or the operator may continue to retain or process certain data when doing so is necessary to:

  • Fulfill obligations under the law;

  • Perform or establish rights and obligations arising from a contract;

  • Fulfill accounting, tax, residence registration or other legal obligations;

  • Resolve complaints, disputes or requests from competent state authorities;

  • Ensure system security, prevent fraud or protect the lawful rights and interests of the parties to the extent permitted by law.

Where a user's request cannot be fulfilled in whole or in part, VinaBos or the responsible entity will handle and respond to it in accordance with applicable law.

9. Deletion of accounts and personal data

Users may request the deletion of their VinaBos account and related personal data through the account deletion function provided in the app or through the contact methods published by VinaBos.

9.1. When a user requests account deletion

After an account deletion request is confirmed, VinaBos will terminate or remove the account's access and process the related personal data in accordance with the law.

Deleting a sign-in account does not mean that all data related to the user will be deleted immediately.

Some data may continue to be retained if VinaBos, the landlord or the operator has an obligation or lawful basis to retain it, such as data related to:

  • Lease contracts and the performance of those contracts;

  • Invoices, payments, outstanding balances and related documents;

  • Residence information that must be retained under the law;

  • Pending complaints, disputes or legal obligations;

  • System security, fraud prevention or lawful requests from competent state authorities.

Data that is no longer necessary and for which there is no longer a basis for continued retention will be deleted, anonymized or otherwise handled in an appropriate manner.

9.2. For tenants of other landlords or operators

If the user is a tenant at a facility of another landlord or operator using the VinaBos software, deleting the VinaBos account does not automatically delete the entire tenancy record managed by that landlord or operator.

For requests to delete data in the tenancy record, VinaBos may forward the request to the relevant landlord or operator, or coordinate with that entity to handle the request in accordance with the law.

9.3. Data retained after account deletion

Where certain data must continue to be retained after an account is deleted, such data will continue to be processed only to the extent necessary for the lawful retention purpose and will not be used for new purposes inconsistent with the basis for retention.

When the retention period expires or there is no longer a necessary basis for retention, VinaBos will delete, anonymize or otherwise process the data in accordance with applicable regulations.

9.4. Information about the account deletion process

VinaBos will provide instructions on how to request the deletion of accounts and personal data in the app or on the account deletion instructions page published on VinaBos's official website.

10. Children's personal data

The VinaBos app is not designed to directly provide services to children as tenants or independent users.

However, in the course of managing tenancies and residence, VinaBos or landlords and operators may need to process certain personal data of children who are co-occupants, family members or persons residing with the tenant.

Such data is collected and processed only to the extent necessary to manage the tenancy, carry out residence registration procedures, ensure the lawful rights and interests of children or fulfill other obligations under the law.

When processing children's personal data, VinaBos and the relevant operator will comply with the requirements regarding notice, the consent of the parent or guardian, and the consent of the child in cases where required by law, while prioritizing the protection of children's rights and interests in accordance with the law.

VinaBos does not actively use children's personal data for advertising, marketing or the promotion of commercial services unrelated to tenancy and residence management.

If VinaBos discovers that a child's personal data has been provided or processed in a manner inconsistent with the purpose of the system or not in compliance with legal requirements, VinaBos will coordinate with the data provider, parent, guardian or relevant operator to take appropriate measures.

11. Changes to this Privacy Policy

VinaBos may update or amend this Privacy Policy when necessary to reflect changes in the law, app functions, operating methods, security measures or services provided on the platform.

When the Policy is updated, VinaBos will publish the new version on the website, in the app or through other appropriate means. The effective date or most recent update date of the Policy will be shown so that users can identify the version currently in effect.

For changes that significantly affect how VinaBos collects, uses, shares or processes personal data, VinaBos will provide notice and, where required by law, obtain users' consent again before applying the relevant processing activities.

A user's continued use of the service after the Policy is updated will not be deemed consent to data processing activities that, under the law, require the user's separate consent.

Contact

VinaBos Company Limited

Tax code: 0123456789

Address: 1358/28/12 Quang Trung Street, An Hoi Tay Ward, Ho Chi Minh City, Vietnam

Privacy email: info@vinabos.com

Support email: info@vinabos.com

Phone: 0918 993 459