The Association only processes data required for website operation, record verification, professional communication and the performance of its duties in compliance with the law. It does not sell personal data, nor does it set up advertising profiling or cross-site marketing tracking. When personal data is involved in record verification, email correspondence, works or event materials, the association will manage it in accordance with the clear purpose, necessary scope, authorization boundaries and retention period.
- Operating entity
- Hoa Nhip Association for the Development of Culture, Sports and the Arts (HCSA)
- Office location
- Pacific Place，83B Lý Thường Kiệt，Hoàn Kiếm，Hà Nội，Việt Nam
- Data protection contact
- contact@hcsa-org.com
1. Operating entities and applicable laws and regulations
HCSA Sports and Art Development Association is responsible for the processing of personal data in this website and the record verification service controlled by the association, and assumes the corresponding responsibilities of the personal data controller, processor or controller and processor according to the specific processing relationship.
This policy is formulated in accordance with Vietnam's Personal Data Protection Law 91/2025/QH15, Data Law 60/2024/QH15, Cybersecurity Law 116/2025/QH15 and other applicable regulations. When relevant laws or implementation rules are adjusted, the Association will review this policy and actual processing activities simultaneously.
2. Scope of application and processing role
This policy applies to accessing the association’s main website, using member and award inquiry services, contacting the association through public emails, and submitting cooperation, exhibition, research, review or content correction materials to the association.
When the website links to third-party services that are not controlled by the Association, such third parties are responsible for the data they independently collect and process. The Association will prompt external links at identifiable locations, but the privacy rules of third parties are not replaced by this policy.
3. Personal data processed by the association
Website access and security logs
When the website or query service is running, IP addresses, access times, browser and device types, requested pages, source pages, error messages and security event records may be generated for operation and maintenance, access control, troubleshooting and abuse prevention.
Query and verify record data
The query service will process the record number, registration name or organization name you submitted, and display the record status required to complete the verification of the person or organization when the information is matched at the same time. Member inquiry is only available to the member himself or the authorized contact person of the institutional member, and does not provide members’ public list, fuzzy search or other people’s record inquiry.
Email, collaboration and professional activity data
When contacted by email or through channels confirmed by the Association, the Association may process your name or title, email address, affiliation, position, content of the letter, work information, professional resume and attachments you actively submit. Please do not send complete images of ID documents, financial account, health, biometric or other sensitive personal data unrelated to the matter via regular mail.
4. Cookies, local storage and browser sessions
The main site does not use advertising cookies or cross-site marketing tracking. Websites use browser local storage to save language preferences; you can clear site data in your browser and the website will return to the default language state.
Verification results are temporarily saved in the session storage of the current browser session for display purposes; this temporary copy is removed when the browser session is closed or site data is cleared. Restricted administrative areas may use session cookies necessary to maintain login and prevent forged requests, and are not used for advertising or behavioral profiling.
5. Purpose and legal basis of processing
The Association processes personal data for the purpose of responding to inquiries, arranging professional communications, verifying membership and award records, maintaining public archives, managing exhibitions and work authorizations, ensuring website and data security, handling complaints and corrections, and fulfilling its obligations under Vietnamese law.
Depending on the specific circumstances, the association will process the data based on the valid consent of the data subject, processing the request made by the data subject or performing relevant agreements, fulfilling legal obligations, protecting the legitimate rights and interests of the data subject or other subjects, and other basis permitted by Vietnamese law. When relying on consent, the Association ensures that the consent corresponds to a specific purpose and maintains channels for withdrawing consent in accordance with the law.
6. Verification of membership and award records
The inquiry center is used by members themselves or authorized contacts of institutional members to verify membership records, and provide honour record verification to relevant entities and the public who hold valid numbers and registered names. In order to prevent enumeration and abuse, both types of queries require the record number and registration name or institution name to be provided at the same time, and audit information such as IP address, query type, record number, and whether there is a hit are recorded.
The association only displays the information required to complete the current verification and does not display personal contact information, ID number, date of birth, financial information or other irrelevant sensitive data in the results. The subject of the record can make a request for verification, correction, restriction of display or deletion of the status or displayed content; files that must be retained by law will be processed in accordance with applicable rules.
8. Cross-border processing and overseas services
Website hosting, email, backup or technical support may involve offshore infrastructure or service providers. When cross-border processing of personal data occurs, the Association will evaluate the purpose of processing, data categories, recipients, security measures and data subject risks in accordance with Vietnam's Personal Data Protection Law and Data Law, and perform applicable impact assessment, recording, updating and regulatory cooperation obligations.
The Association will not use cross-border processing to change the intended purpose, nor will it reduce the protection of the rights of Vietnamese data subjects and the security of personal data.
9. Retention period, deletion and anonymization
Personal data will only be kept for as long as necessary to fulfill the purposes of processing, to maintain valid professional records, to resolve disputes, or to comply with legal obligations. The period of different data depends on the matter of correspondence, record validity period, authorization period, security audit needs and Vietnamese legal regulations.
When the purpose of processing is completed and there is no basis for continued storage, the association will delete, destroy or anonymize relevant data; when it is necessary to retain historical versions or professional archives, access and subsequent use scope will be restricted. Browser local or session storage is controlled by the visitor's device and can be cleared through browser settings.
10. Security Measures and Personal Data Incidents
The association takes measures such as access rights, authentication, least privileges, transmission and storage protection, log auditing, backup and recovery, vulnerability repair and service provider management based on the nature and risks of the data, and continuously evaluates and improves the level of protection from the beginning of processing.
When an incident that may affect the security of personal data occurs, the Association will promptly control the impact, save necessary evidence, assess risks, take remedial measures, and notify or report to relevant authorities and affected data subjects in accordance with Vietnamese law.
11. Data subject rights and request methods
Within the scope provided by Vietnamese law, data subjects may learn about and access data related to themselves, request correction, supplementation, provision, deletion or restriction of processing, refuse or object to inappropriate processing, withdraw consent, and file complaints, reports, lawsuits or requests for damages in accordance with the law.
When making a request, please indicate your name or subject identity, relevant pages or records, requested matters and necessary verification information via a public email address. The Association only requires information necessary to complete identity verification and prevent fraudulent use, and will process it within the time limit and scope specified by Vietnamese law; for requests involving other people's rights, legal obligations, or file integrity, the Association will explain the corresponding processing basis.
12. Data of children and specially protected subjects
This website does not serve children as its main target. When involving youth culture, sports, art activities or work exhibitions, the association will follow the principle that is most beneficial to children and obtain the consent of the legal representative in accordance with Vietnamese law; when publicizing or disclosing the private life or personal secrets of children over 7 years old, the association will obtain the consent of both the child and the legal representative.
The legal representative may exercise relevant rights on his behalf in accordance with the law. When the association discovers that data processing may infringe upon the legitimate rights and interests of children or other specially protected subjects, it will stop the corresponding processing and take necessary protective measures.
13. Contact, Complaints and Safety Reports
Personal data rights requests, privacy complaints or security concerns should be sent to contact@hcsa-org.com. Please indicate "Personal Data Request" or "Security Report" in the email, and describe the relevant page, record number or matter, and your specific request.
If you still have objections to the association's handling results, you may complain, report or file a lawsuit to the competent authority in accordance with Vietnamese law.
14. Policy update
The Association will update this policy due to changes in website functions, data processing methods, service providers or applicable rules in Vietnam. The new version will be published on this page and marked with the effective and updated dates; changes that have an important impact on the rights or processing methods of data subjects will be notified through page prompts or other appropriate methods.