Privacy Policy

1. Scope

This document is effective as of 11 October 2026.

This Policy covers personal data that CMC Media Joint Stock Company ("we", "us") processes as the data controller: data of visitors to yofatik.com, of people who contact us for sales enquiries, and of account holders and Users belonging to Customer businesses (account, billing and support data).

For end-customer data that a business brings into Yofatik CRM (fanpage messages, orders, buyer details, etc.), that business is the data controller and we only process it on its instructions under the Data Processing Agreement. End customers who wish to exercise their rights should first contact the business that sold to them; we will assist that business.

This Policy is prepared in accordance with the Law on Personal Data Protection No. 91/2025/QH15, Decree 13/2023/ND-CP on personal data protection, the Law on Cybersecurity 2018 and related regulations of Vietnam.

2. Key terms

• Personal data: information relating to, or that helps identify, a specific individual, such as name, phone number, email or IP address.
• Data subject: the individual the personal data relates to.
• Data controller: the party that determines the purposes and means of processing.
• Data processor: the party that processes data on behalf of the controller, under a contract or instructions.

3. Data we collect, purposes and retention

We do not collect sensitive personal data (health, religion, biometrics, etc.) about website visitors or Users. The website does not use advertising cookies.

4. Processing principles

• We collect only what is needed for the stated purposes and do not use data for other purposes without notice or a lawful basis.
• We do not sell or rent personal data.
• We do not send marketing email without your consent; you can opt out at any time via the link in the email or by contacting us.
• Essential service notices (security, changes to terms, billing) continue to be sent during the subscription.

5. Sharing

We share personal data only in the following cases:

• Infrastructure providers: our server and data-centre infrastructure provider in Vietnam and, for some deployments, Cloudflare (CDN, DNS, proxy) — solely for hosting and transmission.
• Platforms the business connects: when a business connects Meta, TikTok, Google, Nhanh.vn, Viettel Post or Telegram, data is exchanged with those platforms according to the business's configuration. See the Data Processing Agreement for the full list.
• Competent authorities: when lawfully required.
• Corporate restructuring: in a merger, demerger or transfer, the recipient must continue to protect the data under an equivalent policy.

6. Storage location and cross-border transfer

Data is stored on servers located in Vietnam. Some Third-Party Platforms that a business chooses to connect (such as Meta, Google, TikTok, Telegram) process data on their own infrastructure outside Vietnam; such exchanges happen only when the business enables the corresponding connection. We carry out the formalities for cross-border transfer of personal data as required by law.

7. Security

• Connections are encrypted with HTTPS;
• Each business's data is isolated at the database layer (per-tenant row-level security);
• Passwords are stored hashed; access keys and tokens for connected platforms are encrypted at rest;
• Role-based access control, with the option to mask end-customer phone numbers from staff without permission;
• An immutable audit log of actions for accountability.

See the Security page for details. In the event of a personal data breach, we notify the competent personal data protection authority within 72 hours as required by law and inform affected parties where appropriate.

8. Your rights

Under Vietnamese personal data protection law, you have the right:

• to be informed about the processing of your personal data;
• to give or refuse consent, and to withdraw consent;
• to access, view and correct your data;
• to request deletion of your data;
• to request restriction of processing;
• to request a copy of your data;
• to object to processing;
• to complain, report, bring legal action and claim damages as provided by law.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Some rights may be limited where the law requires us to retain data (for example, accounting records).

9. How to make a request

1. Email support@cmcmedia.com.vn with the subject "Personal data request".
2. Include your name, the email or phone number you used, the right you wish to exercise and, if relevant, the business concerned.
3. We may ask you to verify your identity so that no one else can make a request in your name.
4. We respond within the time limits set by law, and normally acknowledge receipt within 72 hours.

Specific instructions for deleting data obtained from Facebook/Messenger are on the Data Deletion page.

10. Children

Yofatik CRM is a business service and is not directed at children. We do not knowingly collect data from children under 16; if we learn we have done so inadvertently, we will delete it as required by law.

11. Changes to this Policy

We may update this Policy when our processing or the law changes. The effective date at the top shows the latest version; material changes will be announced by email or in the application.

12. Contact information

Personal data requests, questions or complaints may be sent to:

You can also reach us through the Contact page.