Personal data protection policy

1. Scope & commitments

This policy explains how Lexdata Consulting Co., Ltd (“Lexdata”), the owner and operator of the GomShip product (“GomShip”), processes the personal data of users of the GomShip website, dashboard and mobile app, in accordance with Law No. 91/2025/QH15 on Personal Data Protection (effective 1 January 2026), Decree 356/2025/ND-CP and related legislation.

For shop account data and service usage activity, Lexdata (through the GomShip product) is the controller and processor of personal data. For recipient data entered by shops, see section 7.

2. Data we process

To create orders, coordinate shipping and reconcile COD, GomShip processes the following categories of data:

• Shop account information: the shop owner’s full name, store/business name, phone number (if provided), email, password (stored only as a one-way hash) and pickup warehouse addresses.
• COD bank account information: bank name, account number and account holder name. GomShip protects this category with stricter access controls than ordinary data (it is sensitive personal data of a financial nature).
• Recipient information: full name, phone number and delivery address provided by the shop.
• Order & shipping data: waybill number, description and value of goods, weight, dimensions, COD amount, tracking status and reconciliation session.
• Technical data: IP address, device/browser type, access logs, push notification tokens and crash reports from the mobile app, and the cookies/session needed to keep you signed in.
• Content you send to support: emails, messages, images and documents when you file a complaint or request support.

GomShip does not actively collect biometric data, continuous location data or other sensitive categories of data beyond the bank account information described above.

3. Purposes & legal basis

GomShip processes personal data only for the following purposes:

1. Creating and managing accounts, authenticating logins, resetting passwords and verifying shop owners.
2. Generating waybill numbers and passing the necessary information to the selected carrier for pickup and delivery.
3. Sending notifications about your account and order journey by email and app push notifications.
4. Reconciling cash-on-delivery (COD) money and transferring it to the shop’s bank account.
5. Customer support, handling complaints and compensating for damaged or lost parcels.
6. Securing the system, detecting and preventing fraud, fixing errors and improving service performance.
7. Meeting legal obligations (accounting, tax, requests from competent state authorities).

Consent: when you sign up, you are informed of this policy and agree that GomShip may process your data for the purposes above. Consent is recorded so that it can be verified, is given voluntarily and is not a condition for anything unnecessary to the service. You may withdraw your consent at any time (see section 6); withdrawal does not affect processing carried out before it, but GomShip may no longer be able to provide the features that need that data. Some processing is also based on performing our service contract with you or on GomShip’s legal obligations.

4. Data recipients & transfers abroad

GomShip shares data only to the minimum extent necessary with:

• The carrier handling the order: receives sender and recipient details, addresses and parcel information for pickup and delivery.
• Banks/payment processors: receive the name and number of the receiving account to transfer COD money.
• Infrastructure and technical service providers: hosting, transactional email, push notifications and app error reporting. GomShip signs agreements or applies data protection terms with these parties, who may process data only on GomShip’s instructions.
• Competent state authorities: upon a written request made in accordance with the law.
• Advisors, lawyers and auditors: where necessary for legal compliance, and bound by confidentiality.

Transfers abroad: some of the technical service providers above may process data on systems located outside Vietnam. In that case GomShip transfers only the data needed, applies appropriate safeguards and carries out the cross-border data transfer obligations under the Law on Personal Data Protection.

5. Storage & protection

Retention: account data and waybill history are kept while the account is active. After an account is deleted or terminated, GomShip deletes or de-identifies data once the purpose of processing has ended, except for data the law requires us to keep (such as financial records, COD reconciliation sessions and complaint files) for at least the periods set by accounting, tax and dispute-resolution rules.

Safeguards:

• Transmission is encrypted with HTTPS/TLS; passwords are stored only as one-way hashes.
• Role-based access control; only personnel who need the data can access it, and they must keep it confidential.
• Access logs and anomaly monitoring to detect unauthorized access.
• Backups and controlled operating environments.

Incident handling: if a data breach occurs that could harm your lawful rights and interests, GomShip will notify the personal data protection authority under the Ministry of Public Security no later than 72 hours after discovery, prepare an incident report, remedy the consequences and notify the affected data subjects as required.

6. Rights of data subjects

Under the Law on Personal Data Protection, you have the following rights over your personal data:

• The right to be informed about the processing of your personal data.
• The right to consent, refuse or withdraw consent to processing.
• The right to view and correct your data, or to request correction. You can update it yourself in Account settings.
• The right to request a copy of your data. Order history and reconciliation sessions can be exported to Excel in the dashboard.
• The right to request deletion of your data, including deleting your account. For the steps, the data deleted or retained and the retention periods, see Account deletion request.
• The right to request restriction of processing and to object to processing in cases permitted by law.
• The right to complain, report, bring a lawsuit and claim compensation for damage in accordance with the law.
• The right to ask the competent authority to apply measures to protect your personal data.

How to exercise your rights:

1. Send a request to the personal data protection contact (section 9) or through GomShip’s support channels, stating the right you wish to exercise and the data concerned.
2. GomShip verifies your identity to make sure the request comes from you (especially for account deletion requests, since an account is tied to orders and COD money).
3. GomShip handles and responds within the period required by law. If more time is needed, we will tell you.

Limits: GomShip may refuse or only partly carry out a request where the law requires data to continue to be kept (for example financial records), where a reconciliation session or complaint is still open, or where doing so would harm the lawful rights and interests of others. We will tell you the reason.

Your obligations: provide complete and accurate information, protect your login credentials, and respect and protect other people’s personal data.

7. Recipient data provided by shops

When a shop enters a buyer’s/recipient’s information to create an order, GomShip processes that data on the shop’s instructions and only to deliver the parcel, collect COD and support the order. The shop is responsible for having a lawful basis to provide this data (such as having informed the buyer and obtained their consent when they placed the order) and for entering only accurate and necessary information.

If you are a parcel recipient and want to exercise your rights over your data, contact the shop that sent the parcel or send a request to the personal data protection contact in section 9; GomShip will cooperate within the scope of the data it holds.

8. Children’s data

GomShip’s services are intended for individuals and businesses and are not directed at children. GomShip does not knowingly collect children’s data to create accounts. If we find that a child’s data has been provided without the consent of their legal representative, we will stop processing it and delete it. Parents or representatives may contact us at section 9 to make a request.

9. Personal data protection contact

GomShip is a product of Lexdata Consulting Co., Ltd, a company that provides consulting and services on personal data protection. Lexdata is also GomShip’s personal data protection department: it monitors compliance, receives and handles data subjects’ requests, and is the point of contact with competent authorities. You can contact it directly with any question, request or complaint about personal data:

Exemptions and reductions: GomShip is among the businesses entitled to certain exemptions and reductions of obligations under Article 38 of the Law on Personal Data Protection (such as preparing a data processing impact assessment file). This does not reduce your rights described in this policy; Lexdata still complies with the principles of data processing and protection and maintains the personal data protection department described above.

If you are not satisfied with how a matter is resolved, you may file a complaint with the personal data protection authority under the Ministry of Public Security or bring a lawsuit in accordance with the law.

10. Changes to this policy

GomShip may update this policy when the law or the way the service operates changes. For significant changes (such as a new purpose of processing or a new data recipient) we will notify you on the website, in the dashboard or by email, and ask for your consent again where the law requires. The effective date of the current version is shown at the top of the page.