Privacy Policy

The data controller responsible for processing personal data under this Policy is CODE4CHANGE TECHNOLOGY CONSULTING AND SOLUTIONS CO., LTD. (tax code 0402138079), headquartered at 73 Nguyen Nhu Hanh Street, Hoa Khanh Ward, Da Nang City, Vietnam, legally represented by Mr. Pham Hoang Anh Tuan ("Code4Change", "we", "us").

This Policy applies to: (i) visitors of quaysotrungthuong.vn; (ii) Organizers who create and manage events on the Luck4You platform; and (iii) Attendees who participate in events via QR code, web app, or the mobile app. This Policy does not apply to third-party websites or apps we may link to.

Depending on how you use the Service, we may collect the following categories of data:

• Account information: full name, email, phone number, password (encrypted), avatar.
• Business information (for Organizers): company name, tax code, invoicing address.
• Event and attendee data: guest lists, QR check-in codes, voting/lucky-draw results uploaded or collected by Organizers via check-in features.
• Payment information: bank-transfer transaction content and status (we do not store full bank card numbers; purchases via Apple/Google are processed entirely by Apple/Google).
• Technical data: IP address, device type, operating system, browser, device identifiers, access logs, crash/diagnostic data.
• Approximate location data if an event feature requires location and you allow it.
• Contact content: content you submit via contact form, email, Zalo, Messenger, or hotline.

We do not intentionally collect sensitive data (religion, health, biometrics, etc.) unless an Organizer actively collects such data for their own event purposes, in which case the Organizer is solely responsible for having a valid legal basis to do so.

We process personal data for the following purposes, on the corresponding legal basis under Decree 13/2023/ND-CP:

• Providing the Service (account creation, event operation, check-in, lucky draw, voting) — basis: performance of the service contract with you.
• Processing payments and issuing VAT invoices — basis: contract performance and legal obligations regarding accounting and tax.
• Customer care and complaint handling — basis: contract performance and your legitimate interests.
• Sending service notices, renewal reminders, transaction confirmations — basis: contract performance.
• Analytics and service improvement — basis: our legitimate interest, without adversely affecting your rights.
• Fraud prevention and system security — basis: legitimate interest and legal obligation.
• Sending promotional information or newsletters (if any) — basis: your consent; you may opt out at any time.

We do not use your personal data for any purpose beyond those disclosed above without notifying you and seeking your consent first, except where required by law.

We use the data we collect to operate Luck4You's features: creating and managing events, QR check-in, lucky draws, live voting, exporting result reports, processing payments and invoices, and technical support. Attendee data collected by an Organizer is made visible to that same Organizer so they can operate their own event; Code4Change acts solely as the technical platform provider and does not use attendee data for its own purposes beyond operating and maintaining the system.

We do not sell your personal data to third parties for commercial purposes.

We only share personal data in the following cases:

• Event Organizers — attendee data for their own events, so they can operate check-in, lucky draws, and view results.
• Infrastructure and technology partners — cloud/server providers, Firebase (Google) for authentication, analytics, and push notifications; these partners process data under contract and solely to the extent needed to provide services to us.
• Payment partners — banks and payment gateways processing bank transfers (SePay/Techcombank); Apple (App Store) and Google (Google Play) for in-app purchase transactions.
• Competent state authorities — where legally required under Vietnamese law (inspection, investigation, court order, etc.).
• Business acquirers/successors — in the event of restructuring, merger, or transfer of part or all of our business, provided the recipient continues to comply with this Policy.

We require all of the above third parties to commit to confidentiality and to process data strictly for the authorized purpose.

Our Service may use cloud infrastructure and third-party services (e.g., Firebase/Google Cloud) whose servers may be located in Vietnam or in other countries where our infrastructure providers operate data centers. Where processing personal data of Vietnamese citizens involves a transfer outside Vietnam, we implement appropriate safeguards (data processing agreements, encryption, access controls) and comply with the obligation to prepare and retain a cross-border data transfer impact assessment dossier, as well as notify the competent authority under Article 25 of Decree 13/2023/ND-CP where required by law.

We retain personal data only for as long as necessary to fulfill the purpose of collection, specifically:

• Account data: retained for as long as you continue to use the Service; deleted or anonymized within 30 days of account deletion.
• Event and attendee data: retained as instructed by the Organizer for the duration of the event and up to 12 months after the event ends to support result lookups, unless the Organizer requests earlier deletion.
• Payment and invoice data: retained for a minimum of 10 years as required under accounting, invoice, and record-keeping laws.
• Support and complaint records: retained for a minimum of 3 years from the date of resolution for reference purposes.

After the retention period, data is permanently deleted or anonymized so that the data subject can no longer be identified, unless the law requires longer retention.

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction, including: HTTPS/TLS encryption in transit, password hashing, role-based access control, system monitoring and logging, and regular backups. No method of electronic transmission or storage is completely secure; we make reasonable efforts to apply security standards appropriate to the scale and nature of the data processed.

Under Decree 13/2023/ND-CP, you have the following rights over your personal data:

• Right to be informed: to know about the processing of your personal data, unless otherwise provided by law.
• Right to consent/withdraw consent: to agree or disagree to the processing of your personal data, unless otherwise provided by law.
• Right of access: to request to view or correct your personal data.
• Right to erasure: to request deletion of your personal data, unless otherwise provided by law.
• Right to restrict processing: to request that processing of your personal data be restricted.
• Right to data provision: to request that we provide you with a copy of your personal data.
• Right to object: to object to processing of your personal data intended to prevent or restrict disclosure or use for marketing purposes.
• Right to complain, denounce, or litigate and right to claim damages in accordance with the law where your rights are violated.

To exercise the above rights, please send a request to hotro@quaysotrungthuong.vn, together with identity-verification information. We will acknowledge receipt of your request within 72 hours and respond with the outcome within a maximum of 30 business days. Certain requests (e.g., deleting data that must be retained under legal obligations relating to invoices or accounting) may only be partially fulfilled, and we will explain the specific reason.

You may request deletion of your account at any time:

• On the mobile app (iOS/Android): go to Settings → Account → Delete Account, and confirm following the in-app instructions.
• On the website: go to account settings or send a request to hotro@quaysotrungthuong.vn.

Upon account deletion, personally identifiable information (name, email, phone number) will be deleted or anonymized within 30 days; data legally required to be retained (invoices, payment records) is kept for the period specified in Section 7. Deleting an Organizer account does not automatically delete events already created where a contractual or legal obligation requires that data to be preserved.

Our website and app use cookies and similar technologies (local storage, Firebase/Google Analytics SDKs) to maintain login sessions, remember language/theme preferences, measure usage, and improve the Service. You may decline non-essential cookies through your browser settings; disabling cookies may affect certain website functions.

Luck4You is not directed at children under 16 and we do not knowingly collect personal data from children under 16 when creating Organizer accounts. As Attendees at an event may include persons under 16 (e.g., family or school events), the Organizer is responsible for ensuring valid consent from a parent or guardian before collecting a child's data through the platform. If you believe a child's data has been collected improperly, please contact us so we can promptly address and delete it.

In the event of a personal data protection breach (data leak, loss, etc.), we will notify the Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention) no later than 72 hours after discovering the breach, as required under Article 23 of Decree 13/2023/ND-CP, and will notify affected data subjects as soon as reasonably possible.

We may update this Privacy Policy from time to time to reflect changes to the Service or legal requirements. For material changes, we will provide at least 15 days' notice via email or in-app notification before the change takes effect.

If you have any questions, requests, or complaints regarding the processing of personal data, please contact:

• Entity: CODE4CHANGE TECHNOLOGY CONSULTING AND SOLUTIONS CO., LTD.
• Address: 73 Nguyen Nhu Hanh Street, Hoa Khanh Ward, Da Nang City, Vietnam
• Email: hotro@quaysotrungthuong.vn
• Hotline: +84 901 333 434
• Zalo: zalo.me/0706145483