Twohearts Privacy Policy

Governing Language

This Privacy Policy is provided in English and Vietnamese for convenience. If there is any inconsistency, the Vietnamese version (immediately following each section) shall prevail for users in Vietnam.

1. Data Controller

Twohearts Technologies Email: chat@twohearts.vn

We process personal data in compliance with Vietnam's Decree 13/2023/ND-CP on Personal Data Protection and other applicable laws.

2. Data Collected

We may collect the following categories of data (depending on how you use the Service):

• Identity & Contact Data: name, phone number
• Social Identifiers: social media IDs (e.g., Zalo ID, Facebook PSID)
• Location Data: delivery address and coordinates for precise address identification
• Transaction Data: order history, timestamps, receipts/confirmation details
• AI Interaction Data: chat logs, preferences you express
• Device & Usage Data: device identifiers, IP address (where applicable)
• Payment Data: payment method selection and order payment status; we do not store any card details

For details on how we handle data received from Meta platforms (Facebook, Messenger), please see our Data Policy.

3. Purpose and Legal Basis of Processing

We process personal data for the following purposes and legal bases (as applicable):

• Order fulfillment: to process and fulfill orders (contractual necessity).
• Customer support: to respond to inquiries and disputes (legitimate interests and/or contractual necessity).
• Fraud prevention and security: to protect users and the platform (legitimate interests and legal obligations).
• Personalization ("Master Profile"): to remember preferences across merchants (consent where required).
• AI improvement: to improve service quality and accuracy using anonymized/aggregated data; where personal data is used, we seek consent where required.
• Legal compliance: to meet audit, accounting, and regulatory requirements (legal obligation).

Where consent is required, you may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing before withdrawal.

4. Data Sharing and Processors

We share data only as necessary to operate the Service, including with:

• Merchants: to fulfill your order (Merchants act as independent data controllers for data they receive).
• Payment providers: to process payments (e.g., ZaloPay, MoMo, VNPay).
• Logistics providers: to deliver your order.
• AI and cloud infrastructure providers: to process natural language and host systems.

We require processors to apply appropriate security measures and to process data only on our instructions, where applicable.

5. Cross-Border Transfers

Certain anonymized or pseudonymized data (and in limited cases, personal data where necessary to provide the Service) may be processed in other countries (e.g., Singapore, United States) by our processors.

Safeguards include:

• Encryption in transit and at rest
• Access controls and logging
• Contractual protections with processors

Where required by law, we will obtain your consent for cross-border transfers and implement required compliance steps.

6. Data Retention

We retain personal data only as long as necessary for the purposes described above and for legal compliance. When you request deletion (and we verify your request), we delete or de-identify personal identifiers, unless retention is required by law.

Anonymized and aggregated data may be retained indefinitely for AI training, analytics, system optimization, and financial auditing. Such data is not intended to reasonably identify you.

7. Your Rights

Under Decree 13 and applicable law, you may have the right to:

• Access your personal data
• Request correction
• Withdraw consent
• Request deletion (subject to legal requirements)
• Restrict or object to processing (where applicable)
• Complain to competent authorities

To exercise rights, contact: chat@twohearts.vn

For data deletion requests related to Meta/Facebook, please see our Data Policy — Deletion Requests. If you have a confirmation code from a previous request, you can check its status at `/deletion-status/your-code`.

8. Security

We use reasonable technical and organizational measures such as encryption, access controls, and monitoring to protect personal data. No system is 100% secure; however, we continuously improve our safeguards.

9. Updates to this Policy

We may update this Policy from time to time. We will post the updated version with a revised effective date. If changes are material, we will provide reasonable notice as required by law.

Contact

Contact / Liên hệ: chat@twohearts.vn