Privacy Policy

1. Introduction

BBVN ("we") is committed to protecting your privacy in accordance with the Personal Data Protection Law No. 91/2025/QH15 (PDPL 2025) and Decree 356/2025/NĐ-CP. This policy describes how we collect, use, store and protect personal information when you use the BBVN bus ticket booking platform.

2. Information we collect

• Booking contact information: Contact phone number (required to book tickets and receive notifications), full name, email address (optional).
• Booking information: Passenger name, contact phone number, contact email, pickup point, trip details.
• Payment information: Payment status, bank transaction reference. We do not store bank card numbers or bank login credentials.
• Technical data: IP address (used for access rate-limiting), browser user agent, access logs.

3. Purposes of use

• Process and confirm bus ticket bookings.
• Send email notifications (ticket confirmation, trip reminders).
• Support customers and resolve disputes.
• Improve service quality and detect fraud.

4. Legal basis

We process data based on: (a) your consent when booking; (b) performance of the booking contract; (c) legal obligations under accounting and record-keeping regulations.

5. Data sharing

We only share personal information with:

• Bus operators: Passenger name, contact phone number and pickup point — to serve the trip.
• Payment partners: Processing bank transfer transactions (VietQR). We do not store bank card numbers or bank login credentials.
• State authorities: Upon request in accordance with Vietnamese law.

6. Storage and security

Data is stored on servers in Singapore (Vercel, Neon, Upstash). We apply AES-256 encryption for sensitive information, SSL/TLS connection encryption, and strict access controls. Passwords are one-way hashed and never stored in plaintext.

6a. Cross-border data transfer

In accordance with Article 25 of the PDPL 2025 (Điều 25 Luật PDPL 2025) and Decree 356/2025/NĐ-CP, we notify you that your personal data is processed by cloud service providers in Singapore:

• Vercel: Application server (compute) — Singapore region (sin1).
• Neon: PostgreSQL database — Singapore region.
• Upstash: Redis cache — Singapore region.

This cross-border data transfer complies with the cross-border data transfer impact assessment (CDTIA) requirements under the PDPL 2025.

7. Retention period

• Booking contact information: until you request deletion or the legal retention obligation ends.
• Booking history and payment records: at least 5 years under accounting regulations.
• Access logs: 90 days.

8. Your rights

Under the PDPL 2025, you have the following rights:

To exercise these rights, please send an email to privacy@bbvn.vn.

Note: booking history and payment records are still retained under legal obligations even after personal data is deleted.

8a. Data breach notification

In the event of a personal data breach, we will notify the authorities within 72 hours, and within 24 hours if a cyberattack is involved, in accordance with the PDPL 2025.

9. Cookies and tracking technologies

We use technical cookies (login session, CSRF verification, seat holds) necessary to operate the service. We do not use advertising tracking cookies or third-party cookies.

10. Contact

Personal data protection officer — Email: privacy@bbvn.vn

If you are not satisfied with how a complaint is handled, you have the right to contact the Competition and Consumer Protection Authority (VCCA) or the competent authority in accordance with the Complaint Resolution Policy.