Personal Data Protection Policy — PetID247

Appendix — supplement under Law No. 91/2025/QH15 on Personal Data Protection and Decree 356/2025/ND-CP

Version 2026-09-30 (section 8 — linking online cards to partner clinics; added section 9 — Partnership requests; section 8 — Online cards and viewer messages since 27/09; section 7 — Advertising since 25/09) · applies to PetID247 (petid247.com) · supersedes passages above with the same subject if they differ.

1. Data controller and contact point

Thuy San 247 Media Co., Ltd. (business registration no. 0315690903), head office at 56/5 Tran Hung Dao, Tan Son Nhi Ward, Ho Chi Minh City. Person responsible for personal data protection: Ms. Ho My Thuyen — Director. All personal data requests should be sent to [email protected] or phone 0349977247; we acknowledge receipt within 72 hours.

2. Storage location and third parties abroad

Your data is stored on servers managed directly by the company in Vietnam; backups are encrypted and also located in Vietnam. The company's mailboxes and off-site backups are provided by GMO-Z.com Runsystem (TenTen), with servers in Hanoi. In providing the service, part of the data passes through the following platform providers outside Vietnam, each bound by data protection terms:

• Brevo (Sendinblue SAS, France) — standby channel for transactional email; since 08/09/2026 all mail goes through domestic servers, and this channel is not used in operation.
• Zoho Corporation — only holds the archive of old mail received before 08/09/2026; since that date the company's mailboxes are located in Vietnam and no new mail passes through this provider.
• Cloudflare, Inc. (United States) — content delivery network and HTTPS protection: data is in transit when you visit; no database content is stored.
• Google, Apple, Mozilla — relay browser push notifications if you turn them on: device token only, without name/email.

Roadmap: we are gradually moving email services to a domestic provider (TenTen, Hanoi); when completed, this policy will be updated to a new version and you will be notified.

The company has prepared an impact assessment dossier for the transfer of personal data abroad as required and does not sell or share your data with any other party.

3. Retention period and deletion

• Account and data linked to the account: up to 12 months from the last activity; when this period expires, the system automatically deletes it permanently (with a record).
• Access logs containing IP addresses: 12 months. Sent mail in the queue: 3 months. Backups: daily copies up to 30 days, monthly copies up to 3 months.
• If you delete your account yourself, the data is deleted immediately; we keep only minimal evidence of consent (hash, time, policy version) to demonstrate legal obligations.

4. Your rights and how to exercise them

You have the right to be informed, to consent, to access, to correct, to delete, to restrict processing, to object, to withdraw consent, to request provision of data and to complain under Law 91/2025. Exercise them directly in your account (account/settings section) or send a request to the contact point in section 1; we respond within the statutory time limit and free of charge. Withdrawing consent does not affect lawful processing carried out before it. The service is for businesses and people aged 16 or over; we do not intentionally collect children's data.

5. Possible risks and protective measures

The main risk is disclosure of email address/full name or its use for sending spam or scams. We mitigate this by: collecting only the minimum data needed for the stated purposes, one-way password hashing with a random salt (nobody can read it, including us), end-to-end HTTPS, access control, administration logs, timely deletion and periodic security reviews. If an incident affects your data, we notify the competent authority and you within 72 hours of discovery, following our internal incident response procedure.

6. Cookies and technical logs

We only use a login session cookie and a cookie that remembers your language choice; we do not use third-party behavioural tracking tools and do not track email opens/clicks. The server records technical logs (IP address, time, page visited) for security, deleted after 12 months. For advertising slots, see section 7.

7. Advertising

Where ads appear. (a) The public page of an online card: one slot below the card and, on phones, a bar stuck to the bottom of the screen — this bar can be collapsed or closed. (b) The card owner's management page (“My pets”) for every type of card: one fixed ad slot below the greeting; when there are several ads, the banners slide through in turn. The public page of a laser-engraved tag has no ads. Every ad is labelled “Ad”.

Who serves them and on what basis. Ads are served by the company's own ad system (ads.aqua247.com, servers in Vietnam); content may be PetID247's own or a partner's. Ad selection is based only on the slot position and the page language — not on your information, your pet's information or the health book, and no behavioural profile is built.

Related data. The ad system does not set cookies. It counts the total number of impressions and clicks of each banner; advertisers receive only these totals, no personal data. When you click a banner, your IP address is kept in the server's temporary memory — not written to the database — only to avoid counting duplicate clicks within 60 seconds; otherwise the ad server records technical logs as in section 6. Whether you collapsed/closed the ad bar is stored in your browser's session storage (not a cookie, not sent to the server) and disappears when you close the browser tab. Clicking an ad opens the advertiser's page; data processing on that page follows that party's policy.

8. Free online cards and viewer messages

• Online cards. To create an online card you only provide an email address and a password. We do not ask for your name, phone number or address. The email is used to sign in, confirm your sign-up and reset your password; we do not send marketing email to it. An online card page shows only the pet information you enter, never information about you. If you sign up but do not confirm via the email, the account is deleted automatically after 7 days.
• Linking an online card to a partner clinic (from 30/09/2026). When you agree (by scanning a clinic's or pet shop's invite QR code or sending a link request), the online card page shows that clinic's details. The clinic sees your pet's name and your name (which you enter when linking) — not your email or phone number, and the link does not open your pet's health book. A request to link an existing card takes effect only once the clinic approves. You can unlink at any time on your pet's page; the clinic can also unlink. Consent and unlinking are recorded in the consent log.
• Viewer messages (laser tags only). Visitors may leave a display name, a message and one photo. This content goes only to the pet's owner and appears publicly only if the owner approves it. Rejected messages are deleted immediately; messages not approved are deleted automatically after 30 days. To prevent spam, the system stores a shortened trace of the IP address with each message.
• Reporting a page. Anyone can report a page. We do not store the reporter's name, email or IP address.
• Moving to a laser tag. When you activate a laser tag and choose to move your data, the pet's profile, photos and health book move to the new tag; the old online card no longer holds data and redirects to the new tag.
• Download and deletion. Under Account you can download all your data and delete your account yourself. Deleting the account removes online cards, photos and health books immediately; laser tags return to the not-activated state.
• Users outside Vietnam. Data is stored and processed in Vietnam under Vietnamese law.

9. Partnership requests (vet clinics, pet shops, pet spas)

• Data collected. When you fill in the Become a partner form you provide: business type and name, the contact person's name, phone number and email, city/province, the kind of partnership you are interested in and an optional message. We do not store the sender's IP address; to prevent spam the server only counts submissions in temporary memory and never writes them to the database.
• Purpose. Only to get back to you and discuss the partnership. The system sends one confirmation email to the address you gave and alerts our partnership team through the company's internal notification channel. We do not use this data for advertising and do not sell or share it with anyone else.
• Who can see it. Only PetID247 administrators in the login-protected admin area; every action on a request is logged.
• Retention. Up to 24 months after our last exchange, after which it is deleted automatically. If we sign a partnership, the contact details move to the business account and section 3 applies.
• Your rights. You may ask to see, correct or delete immediately what you sent by contacting the point of contact in section 1.