Privacy Policy

The data controller for the personal data described here is CÔNG TY TNHH VNSIR (VNSIR COMPANY LIMITED), enterprise code 0319672542, registered at 98/54 Vạn Kiếp, Phường Gia Định, Thành phố Hồ Chí Minh, Việt Nam, telephone 0907 781 789, trading as VNSIR.

For any question about this policy, or to exercise the rights set out below, contact privacy@vnsir.com. We answer data-protection requests within one month.

We collect four kinds of personal data, and nothing else:

Account data. Your email address, the name you give us, your company, and whether your account has been approved. You give us this when you request access.

Purchase data. Which report you bought, the amount charged, the tax collected, the currency, and the Paddle transaction reference. We do not receive or store your card number — see Who else sees it.

Enquiry data. Anything you write into our research brief or advisory forms, including the business context you choose to share.

Technical data. Your IP address, used to rate-limit our forms and sign-in endpoints against abuse, and a session cookie that keeps you signed in.

We do not run advertising trackers, we do not build behavioural profiles, and we do not sell or rent personal data to anyone.

To perform our contract with you (GDPR Article 6(1)(b)): creating your account, verifying access, delivering the report you paid for, and supporting you afterwards.

Our legitimate interests (Article 6(1)(f)): keeping the service available and secure, rate-limiting abuse, preventing unauthorised redistribution of reports, and responding to enquiries you send us.

Legal obligation (Article 6(1)(c)): retaining transaction records for tax and accounting purposes.

We use the following processors. Each is bound by a data-processing agreement and may only act on our instructions.

Paddle is our merchant of record. When you buy a report, your payment contract is with Paddle, not with us. Paddle collects and holds your payment details under its own privacy policy and is an independent controller for that data. Your card number never reaches our servers.

We also disclose personal data where the law requires it, or to establish or defend a legal claim.

Our infrastructure runs in the United States. If you are in the EEA, the UK or Switzerland, your personal data is transferred outside your country when you use the service. Those transfers rely on the European Commission's Standard Contractual Clauses, incorporated into our agreements with each processor listed above.

You can request a copy of the relevant safeguards from privacy@vnsir.com.

You should know this before you download anything. Every report PDF we deliver is individually stamped with your email address, the transaction reference, and the purchase date, in visible text on the document.

The purpose is to deter redistribution of a single-entity licence, and the legal basis is our legitimate interest in protecting the work. The practical consequence is that a copy of your report shared beyond your organisation identifies you as its source.

Account data — while your account exists, and for 12 months after your last sign-in. You may ask us to delete it sooner.

Purchase records — 7 years, because tax and accounting law requires it. A deletion request cannot remove these while that obligation stands.

Enquiry data — 24 months from your last contact with us.

Technical data — rate-limiting records expire within 24 hours. Session cookies expire when the session ends.

If the GDPR or UK GDPR applies to you, you have the right to: obtain a copy of your data (access); correct it (rectification); have it deleted (erasure); restrict how we use it; receive it in a portable format; object to processing based on legitimate interests; and withdraw consent where we relied on it.

Write to privacy@vnsir.com and we will respond within one month. We do not charge for this, and we will not ask you to justify the request.

If you think we have handled your data badly, you can complain to your national supervisory authority. In the UK that is the Information Commissioner's Office; in the EEA it is the authority in the country where you live or work.

We are a Vietnamese company, so Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and its implementing Decree No. 356/2025/ND-CP apply to us alongside the GDPR. Where the two give you different rights, the stronger of the two applies.

Under that law you may ask us to confirm what data we hold about you, to correct or delete it, to withdraw a consent you gave, and to restrict or object to processing. Send requests to privacy@vnsir.com. We answer within the time limits that law sets, and in any event within one month.

Our infrastructure is hosted outside Vietnam, so processing the personal data of people in Vietnam is a cross-border transfer. The safeguards for it are described under International transfers above.

We set one cookie: a session cookie that keeps you signed in after you click a sign-in link. It is strictly necessary for the service to function, so it does not require consent. Deleting it signs you out.

We set no analytics, advertising or third-party tracking cookies.

When we change this policy in a way that affects you, we update the date at the top of this page. If the change is material, we will email account holders before it takes effect.