Privacy Policy

1. Introduction

BBVN ("we") is committed to protecting your privacy in accordance with the Personal Data Protection Law No. 91/2025/QH15 (PDPL 2025) and Decree 356/2025/NĐ-CP. This policy describes how we collect, use, store and protect personal information when you use the BBVN bus ticket booking platform.

2. Information we collect

• Booking contact information: Contact phone number (required to book tickets and receive notifications), full name, email address (optional).
• Booking information: Passenger name, contact phone number, contact email, pickup point, trip details.
• Payment information: Payment status, bank transaction reference. We do not store bank card numbers or bank login credentials.
• Technical data: IP address (used for access rate-limiting), browser user agent, access logs.

3. Purposes of use

• Process and confirm bus ticket bookings.
• Send email notifications (ticket confirmation, trip reminders).
• Support customers and resolve disputes.
• Improve service quality and detect fraud.

4. Legal basis

We process data based on: (a) your consent when booking; (b) performance of the booking contract; (c) legal obligations under accounting and record-keeping regulations.

5. Data sharing

We only share personal information with:

• Bus operators: Passenger name, contact phone number and pickup point — to serve the trip.
• Payment partners: Processing bank transfer transactions (VietQR). We do not store bank card numbers or bank login credentials.
• State authorities: Upon request in accordance with Vietnamese law.

6. Storage and security

Data is stored on servers in Singapore (Vercel, Neon, Upstash). We apply field-level AES-256 encryption to the most sensitive data (bank account numbers, two-factor authentication secrets); other personal data is encrypted at rest at the database layer. Connections are SSL/TLS encrypted and access is strictly controlled. Passwords are one-way hashed and never stored in plaintext. Attachments (ticket PDFs, operator documents) are stored on Cloudflare R2 in the Asia-Pacific region.

6a. Cross-border data transfer

In accordance with Article 25 of the PDPL 2025 (Điều 25 Luật PDPL 2025) and Decree 356/2025/NĐ-CP, we notify you that your personal data is processed by service providers located abroad:

• Vercel: Application server (compute) — Singapore region (sin1).
• Neon: PostgreSQL database — Singapore region.
• Upstash: Redis cache — Singapore region.
• Cloudflare R2: File storage — Asia-Pacific region. Holds e-ticket PDFs (passenger name, contact phone, trip details) and operator identity documents submitted during registration. Files are accessible only via short-lived signed links (5–15 minutes).
• Google (Gemini): AI assistant processing chat messages — United States. Personal information is removed before sending.
• Anthropic (Claude) and Groq: AI assistant processing chat messages — United States. Personal information is removed before sending.
• Google: Sign-in with Google account (OAuth) — United States.
• Resend: Transactional email delivery (ticket confirmations, notifications) — United States.
• Sentry: Application error monitoring — United States. Receives technical error reports (IP address, browser user agent, page URL, error message); known personal-data fields are masked before sending.

This cross-border data transfer complies with the cross-border data transfer impact assessment (CDTIA) requirements under the PDPL 2025.

7. Retention period

• Booking contact information: until you request deletion or the legal retention obligation ends.
• Booking history and payment records: at least 5 years under accounting regulations.
• AI assistant conversation history: 90 days from the last message, or deleted immediately when you delete your account.
• Sent notification content (SMS/email): personal information is masked after 180 days.
• Charter (vehicle hire) requests: contact information is masked 365 days after the request is closed (by an admin decision or cancellation).
• E-tickets (PDF): deleted at the same time the booking's contact information is masked.
• Access logs: 90 days.

8. Your rights

Under the PDPL 2025, you have the following rights:

To exercise these rights, please send an email to privacy@bbvn.vn.

Note: booking history and payment records are still retained under legal obligations even after personal data is deleted.

8a. Data breach notification

In the event of a personal data breach, we will notify the authorities within 72 hours, and within 24 hours if a cyberattack is involved, in accordance with the PDPL 2025.

9. Cookies and tracking technologies

We use technical cookies (login session, CSRF verification, seat holds) necessary to operate the service. We do not use advertising tracking cookies or third-party cookies. For non-logged-in users, AI assistant conversation history is stored only temporarily in your browser (session storage) and is automatically cleared when you close the tab; this history is not stored on our servers. Messages are still sent to the server for processing as described in Section 6a.

10. Contact

Personal data protection officer — Email: privacy@bbvn.vn

If you are not satisfied with how a complaint is handled, you have the right to contact the Competition and Consumer Protection Authority (VCCA) or the competent authority in accordance with the Complaint Resolution Policy.