Privacy and personal data protection policy

This policy describes how Ha Long Diamond Bay Co., Ltd, trading as Diamond Bay (“Diamond Bay”, “we”), collects, uses, stores, shares and protects the personal data of visitors, customers, passengers, partners, agents and users of the websites, sub-domains, applications and online platforms it owns and operates.

The policy applies to:

• The Diamond Bay corporate website;
• The Diamond Bay Travel pages and landing pages;
• The Diamond Bay Cruises pages and landing pages;
• The Diamond Bay booking and B2B partner management system;
• Registration forms, quotation requests, booking, payment, newsletter, customer-care and other online channels linked directly to the platforms above.

Third-party websites or platforms linked from the Diamond Bay website are governed by their own policies, unless clearly published otherwise.

Depending on how you interact with us and which service you request, Diamond Bay may collect the following categories of data.

Diamond Bay may collect data:

• Directly from you when you create an account, complete a form, register as a partner, request advice, book, pay, complain or otherwise contact us;
• From the person booking on your behalf, a group leader, tour operator, agent or organisation booking for passengers;
• From the suppliers involved in delivering a booking, such as cruises, hotels, transport operators, restaurants, guides, insurers or payment gateways;
• Automatically through cookies, server logs, analytics tools and similar technologies when you visit the platform;
• From public sources or competent authorities, within the limits allowed by law.

Anyone providing another person's data, including that of group members, confirms that they have informed that person of this policy and hold the right, consent or lawful basis to provide the data to Diamond Bay. For children or people who require a legal representative, the provider must be a parent, guardian or lawfully authorised person.

Diamond Bay processes personal data only as far as necessary for one or more of the following purposes:

1. 01Receiving and answering requests for advice, quotations or availability;
2. 02Creating, confirming, amending, delivering and managing bookings;
3. 03Providing cruise, tour, accommodation, transport, restaurant, experience and related travel services;
4. 04Contacting customers before, during and after a journey and handling changes, incidents, emergencies, feedback or complaints;
5. 05Passenger and accommodation declarations, ticketing, insurance, immigration and other mandatory formalities;
6. 06Processing deposits, payments, refunds, invoicing, reconciliation, outstanding balances and fraud prevention;
7. 07Registering, verifying, classifying, tiering, managing and supporting B2B partner accounts;

Diamond Bay seeks the data subject's consent before collecting or processing personal data, except where the law permits processing without consent.

Consent must be:

• Given freely, clearly, specifically and verifiably;
• Informed as to the data processed, the purpose, the controller and the rights of the data subject;
• Separated by purpose where necessary;
• Never inferred from silence, a pre-ticked box or a failure to reply;
• Withdrawable by the means set out in the section on viewing, correcting, deleting or restricting data.

Refusing or withdrawing consent to marketing does not affect your ability to book and use our services. However, if you do not provide the data required to verify identity, declare passengers, pay or fulfil a booking, Diamond Bay may be unable to provide all or part of the service.

As far as necessary and consistent with the purpose of processing, data may be accessed by or shared with:

1. 01Authorised Diamond Bay staff, departments and units;
2. 02Cruises, hotels, transport operators, restaurants, attractions, guides, insurers and suppliers directly involved in the booking;
3. 03Banks, payment gateways, payment intermediaries and reconciliation providers;
4. 04Providers of hosting, cloud computing, email, SMS, call centre, CRM, analytics, cyber-security, technical support and website operation services;
5. 05Auditors, accountants, legal advisers or other professional advisers bound by confidentiality;
6. 06The agency or tour operator that made the booking, as far as necessary to manage and care for the customer;
7. 07Competent state authorities on lawful request;

Some infrastructure, cloud storage, email, analytics, customer support or technology providers may host servers or process data outside Vietnam. Where personal data is transferred or processed across borders, Diamond Bay carries out the measures and procedures required by Vietnamese law, selects providers with appropriate security commitments and transfers only what the notified purpose requires.

Diamond Bay keeps data for as long as needed to fulfil the purpose of processing and to meet its legal obligations. Retention is determined as follows:

• Advice or quotation requests that did not lead to a booking: at most 12 months from the last interaction, unless you agree to continued care;
• Marketing data: until you withdraw consent or unsubscribe, or after at most 24 months without interaction, whichever comes first, unless the law allows another period;
• User and partner accounts: while the account is active and for a reasonable period afterwards to settle balances, complaints, disputes and related obligations;
• Bookings, contracts, invoices, payments, accounting and tax records: for the duration of the transaction and the retention period required by the relevant legislation;
• Passenger documents: only for as long as needed to deliver the service, complete mandatory formalities and satisfy retention required by law or by a lawful request of a competent authority;

Diamond Bay applies organisational, technical and physical measures proportionate to the type of data, the scale of processing and the level of risk, including:

• Role-based access control and least-privilege permissions;
• Account authentication, password management and access logging;
• Encryption of data or transmission where appropriate;
• Backup, recovery, monitoring and protection against malware and unauthorised access;
• Testing, patching and updating of systems;
• Internal rules, confidentiality undertakings and staff training;
• Selection, assessment and contractual security obligations for suppliers;
• Procedures to detect, respond to, remedy and notify personal data incidents.

Within the limits set by law, data subjects have the right to:

• Be informed about the processing of their personal data;
• Give, refuse or withdraw consent;
• View, request a copy of, correct or update their data;
• Request deletion, destruction or restriction of processing;
• Object to processing;
• Complain, denounce, sue and claim compensation;
• Require the organisations and individuals concerned to apply the data protection measures required by law.

Data subjects must:

• Provide complete, accurate and current information;

Diamond Bay may use:

• Essential cookies: to make the website work, keep a session open, provide security and remember mandatory choices;
• Functional cookies: to remember language, region and user preferences;
• Analytics cookies: to measure traffic, performance and how users interact with the website;
• Advertising and marketing cookies: to measure campaigns and show relevant content, where the user has consented.

The website must provide a tool for users to accept, refuse or adjust non-essential cookies. Essential cookies may be used to keep the website running without separate consent, as far as the law allows. You can also delete or block cookies in your browser, though some functions may then not work fully.

The specific list of cookie names, providers, purposes and lifetimes is maintained on the cookie settings page once the website implementation is complete.

Diamond Bay sends marketing emails, messages or content only with the recipient's consent or on another basis permitted by law. Consent to marketing is kept separate from the consent needed to make a booking.

You can stop receiving marketing by:

• Clicking “Unsubscribe” in an email;
• Changing the settings in your account;
• Emailing the Diamond Bay support address;
• Calling the hotline.

After you unsubscribe from marketing, Diamond Bay may still send necessary notices about your account, booking, payment, itinerary changes, safety or legal obligations.

Diamond Bay may need to process children's data to make a booking, apply pricing policies, declare passengers and keep the journey safe. Processing is carried out only as far as necessary, in the best interests of the child, and with the consent of a parent, guardian or lawful representative where the law requires it.

Anyone booking for a child confirms that they are lawfully entitled to provide the data. If children's data appears to have been provided without authority, Diamond Bay may suspend processing and require verification or deletion as provided by law.

On detecting an incident that could affect personal data, Diamond Bay takes the steps needed to contain it, assess it, limit the harm, remedy it and prevent recurrence. Diamond Bay notifies the specialist authority and the data subjects in the cases, with the content and within the deadlines required by law.

The website may link to third-party websites, social networks, maps, payment gateways or services. Diamond Bay does not control and is not responsible for their privacy practices. Please read their policies before providing data.

Where Diamond Bay engages a third party to process data in order to deliver a service, appropriate security and processing obligations are imposed by contract and by law.

Complaints, requests or reports about personal data may be sent to the personal data email address, through the contact form, by hotline or to our head office.

The procedure is:

1. 01Receipt, with a request reference issued or confirmed;
2. 02Verification of identity and of the scope of the request;
3. 03Classification, investigation and coordination with the department or processor concerned;
4. 04Notification of the outcome or of progress;
5. 05Implementation of remedial measures, if any.

Diamond Bay gives an initial reply within 02 working days of receiving the necessary information and aims to resolve the matter within the statutory period. A complex case, or one requiring a third party, may take longer; Diamond Bay will report progress and explain why.

If you disagree with the outcome, you may continue to complain, denounce, sue or ask a competent authority to protect your rights under the law.

Diamond Bay may update this policy to reflect changes in law, technology or its business. A new version is published in a prominent place on the website, stating the update date and the effective date.

If a change materially affects the purpose or scope of processing or the rights of data subjects, Diamond Bay will give appropriate notice and seek consent again where the law requires. An updated policy is not applied retrospectively in a way that reduces the lawful rights of data subjects.

Before submitting a form, creating an account or booking a service, you are given a link to this policy and an appropriate way to express consent. By actively ticking the consent box and submitting your information, you confirm that you have read, understood and agree to the processing described, other than processing that does not require consent under the law.