Legal
Privacy Policy
1. Who We Are
TEMPO House ("we", "us", "our") operates a specialty café, cocktail bar, art gallery, and events space located in Ho Chi Minh City, Vietnam, and the website at tempohouse.com.vn.
Data Controller
TEMPO House · Ho Chi Minh City, Vietnam
Data protection enquiries: info@tempohouse.com.vn
This policy is governed by the Law on Personal Data Protection, Law No. 91/2025/QH15 (effective 1 January 2026), Decree No. 356/2025/NĐ-CP, the Law on Cybersecurity No. 24/2018/QH14, the Law on Protection of Consumers' Rights No. 19/2023/QH15, and Decree 91/2020/NĐ-CP on anti-spam.
2. Data We Collect and Why
2.1 Reservations and Table Bookings
What: Name, phone, email, party size, date/time, special requests or dietary requirements.
Why: To confirm and manage your reservation; to contact you about changes or cancellations.
Legal basis: Performance of a booking contract.
Note: Dietary or health-related requirements constitute sensitive personal data and are collected only with your explicit consent. You may decline without affecting your booking.
2.2 Event and Private Function Bookings
What: Name, phone, email, company name (if applicable), billing address, event details, headcount, payment information.
Why: To plan, confirm, and invoice your event.
Legal basis: Performance of contract; payment processing necessary for billing.
Note: Financial and payment data is classified as sensitive personal data under Vietnamese law.
2.3 Email Marketing and Newsletter
What: Name, email address.
Why: To send updates, event announcements, promotions, and news about TEMPO House.
Legal basis: Your explicit, separate opt-in consent. This is never a condition of making a booking.
Unsubscribe: Via the link in any email or by emailing info@tempohouse.com.vn at any time.
Anti-spam compliance: Commercial emails are labelled “QC” per Decree 91/2020/NĐ-CP. We send no more than 3 commercial messages per day.
2.4 Website Enquiry Form
What: Name, email address, message content.
Why: To respond to your enquiry.
Legal basis: Your consent at the time of submission.
2.5 Website Analytics (Google Analytics 4, Google Tag Manager)
What: IP address, device type, browser, pages visited, session duration, referral source.
Why: To understand how visitors use our website and improve the experience. Google Tag Manager is a container that loads our analytics and advertising tags below — it does not itself collect additional data beyond what those tags collect.
Third-party processor: Google LLC, USA.
Cross-border transfer: Data is transmitted to Google servers in the USA.
Note: Website behavioural data is classified as sensitive personal data under Vietnamese law. See Section 7 for how this tracking is currently configured, and Section 6 for how to object to it.
2.6 Advertising and Remarketing (Meta, Google Ads, TikTok, Microsoft, Cốc Cốc)
What: Browsing behaviour on our website (pages viewed, forms started or submitted, ad clicks), linked to your account on the relevant advertising platform where applicable.
Why: To measure advertising effectiveness, avoid showing you irrelevant ads, and show our ads to people similar to our past visitors and customers.
Third-party processors: Meta Platforms, Inc. (Meta Pixel, browser-side) and Google LLC (Google Ads remarketing) are the primary processors; TikTok Pty. Ltd./TikTok Inc., Microsoft Corporation (Bing Ads), and Cốc Cốc JSC (Cốc Cốc Ads) receive a narrower set of the same browsing-behaviour data where their respective tags are active on a given page.
Meta Conversions API: In addition to the browser-side Meta Pixel, we send a small number of enquiry/reservation/booking events to Meta directly from our server (the Meta Conversions API), using your hashed (irreversibly encoded) email address and/or phone number, plus your IP address and browser identifier, so that Meta can match the event to help measure ad performance even if the browser-side Pixel is blocked. Meta receives the hashed value only, never your email or phone number in plain text.
Cross-border transfer: Data is transmitted to servers in the USA (Meta, Google, Microsoft) and other jurisdictions depending on the provider.
Note: This data is classified as sensitive personal data under Vietnamese law. See Section 7 for how this tracking is currently configured, and Section 6 for how to object to it.
2.7 Session Recording and Heatmaps (Microsoft Clarity)
What: Mouse movement, clicks, scroll behaviour, and page interactions, used to generate anonymised heatmaps and session recordings of how visitors use our website. Clarity is configured to mask form field input.
Why: To identify usability issues and improve the website.
Third-party processor: Microsoft Corporation, USA.
Cross-border transfer: Data is transmitted to Microsoft servers in the USA.
2.8 CCTV and Security Surveillance
What: Video footage of our venue premises (café, bar, gallery, event spaces, and entry areas).
Why: Security, safety, and protection of guests, staff, and property.
Legal basis: Legitimate interests in maintaining a safe premises.
Retention: Footage is retained for 90 days, then permanently deleted, unless required for an active security or legal matter.
Access: Authorised TEMPO House management only, or law enforcement where legally required.
Notice: CCTV signage is displayed at all entry points to our venue.
2.9 Payment Records
What: Transaction amount, date, payment method, reference number. We do not store raw card numbers or bank credentials.
Why: Billing, accounting, and legal record-keeping obligations.
Processor: Payments are processed by our payment gateway providers, Xendit (international/domestic cards and e-wallets) and SePay (local bank transfer/QR, Vietnam). Data processing agreements are in place with both.
Retention: 10 years per Vietnamese accounting law (Law No. 88/2015/QH13).
2.10 WhatsApp Messaging
What: Your phone number and the content of reservation/enquiry confirmation messages we send you.
Why: To confirm reservations and respond to enquiries by WhatsApp message, where you have provided a phone number for this purpose.
Third-party processor: Meta Platforms, Inc. (WhatsApp Business Platform), USA.
Note: Messages sent via WhatsApp are also subject to WhatsApp's own terms and privacy policy.
2.11 Social Media and Direct Enquiries
What: Name, message content, and any information you share when contacting us via Instagram, Facebook, TikTok, or other platforms.
Why: To respond to your enquiry.
Note: Social media platforms also collect data under their own privacy policies, which we do not control.
3. How We Share Your Data
We do not sell your personal data. We share data only with the following parties:
| Service | Provider | Country | Purpose |
|---|---|---|---|
| Website analytics | Google LLC (GA4, Google Tag Manager) | USA | Usage analytics |
| Advertising pixels & server-side conversion tracking | Meta Platforms, Inc. (Pixel, Conversions API) | USA | Ad measurement & remarketing |
| Advertising remarketing | Google LLC (Google Ads) | USA | Ad measurement & remarketing |
| Advertising pixels | TikTok, Microsoft (Bing Ads), Cốc Cốc JSC | USA / Vietnam | Ad measurement & remarketing |
| Session recording & heatmaps | Microsoft Corporation (Clarity) | USA | Usability analysis |
| Email marketing | Klaviyo, Inc. | USA | Marketing communications |
| Messaging | Meta Platforms, Inc. (WhatsApp Business Platform) | USA | Reservation & enquiry confirmations |
| Payment processing | Xendit; SePay | Vietnam | Secure payment collection |
We have data processing agreements with all third-party processors, limiting their use of your data strictly to the stated purpose.
We may also disclose personal data to law enforcement, regulatory authorities, or courts when required by Vietnamese law — including the Ministry of Public Security under the Law on Cybersecurity — or to protect the safety of persons on our premises.
4. Cross-Border Data Transfers
Some of our service providers are based outside Vietnam (primarily in the USA). When personal data is transferred internationally, we:
- Disclose the transfer to you in advance (as set out in this policy);
- Obtain your explicit consent where required;
- Maintain data transfer agreements with all receiving parties;
- Have filed or will file Transfer Impact Assessments (TIA) with the Ministry of Public Security (Department A05) as required by Law No. 91/2025/QH15 and Decree 356/2025/NĐ-CP.
5. Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| Reservation records | 3 years | Operational records requirement |
| Event bookings and contracts | 5 years | Contract and tax law |
| Payment and transaction records | 10 years | Law on Accounting No. 88/2015/QH13 |
| Email marketing contacts | Until consent is withdrawn | Consent-based processing |
| Website analytics data | Up to 14 months | GA4 configured retention |
| CCTV footage | 90 days | Security and safety purposes |
| Enquiry and contact records | 2 years | Purpose fulfilment |
On expiry, data is securely deleted or irreversibly anonymised. You may request early deletion by exercising your Right to Delete (see Section 6).
6. Your Rights
Under the Law on Personal Data Protection (Law No. 91/2025/QH15), you have the following eleven rights:
- 1.Right to Know: To be informed about how your personal data is collected, used, stored, and shared.
- 2.Right to Consent: To give or withhold consent before your data is processed. Consent is never assumed.
- 3.Right to Access: To request a copy of all personal data we hold about you.
- 4.Right to Withdraw Consent: To withdraw consent at any time, without affecting the lawfulness of prior processing.
- 5.Right to Delete: To request erasure of your personal data when the original processing purpose is fulfilled or no longer necessary.
- 6.Right to Restrict Processing: To request we limit how we use your data. We will respond within 72 hours.
- 7.Right to Data Portability: To receive your personal data in a structured, commonly used, transferable format.
- 8.Right to Object: To object to processing, including direct marketing. We will respond within 72 hours.
- 9.Right to Complain: To lodge a complaint with the Ministry of Public Security (A05) or other competent Vietnamese authorities.
- 10.Right to Claim Damages: To seek compensation for any unlawful processing of your personal data.
- 11.Right to Self-Defence: As provided under Vietnamese civil law provisions.
To exercise any right: Email info@tempohouse.com.vn. We will acknowledge within 3 business days and resolve within 30 days (or 72 hours for restriction and objection requests).
7. Cookies and Tracking Technologies
| Type | Purpose | Consent Required |
|---|---|---|
| Essential cookies | Website functionality | No |
| Analytics cookies (GA4, Microsoft Clarity) | Usage pattern analysis | Consent sought where required by law |
| Advertising pixels (Meta, Google Ads, TikTok, Bing, Cốc Cốc) | Ad targeting and measurement | Consent sought where required by law |
Current status: we do not yet operate a cookie-consent banner that blocks these scripts until you actively opt in — analytics and advertising tags listed in Sections 2.5–2.7 load when you visit the site, in the same way as most Vietnamese small-business websites at this stage. We are working towards adding a consent-management banner. In the meantime, you can still exercise control by: (a) using your browser's cookie settings or a tracker-blocking extension to prevent these scripts from running; (b) using the opt-out tools each advertising platform provides (for example, Meta's Ad Preferences or Google's Ad Center); or (c) exercising your Right to Object under Section 6, which we will honour by disabling the relevant tag for you on request.
8. Data Security and Breach Notification
We implement appropriate technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. Our IP surveillance systems comply with Circular QCVN 135:2024/BTTTT.
In the event of a data breach affecting your rights or legitimate interests, we will:
- Notify the Ministry of Public Security (A05) within 72 hours of discovery;
- Notify affected individuals as required by Vietnamese law;
- Take immediate corrective action and maintain breach records.
9. Children's Privacy
Our venue and services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, contact us immediately at info@tempohouse.com.vn.
10. Marketing Consent — Separate From Bookings
In compliance with the Law on Protection of Consumers' Rights No. 19/2023/QH15, consent to receive marketing communications is always separate from any booking or service contract. You can use our services fully without consenting to marketing.
11. Contact and Data Protection
TEMPO House — Data Protection Contact
Email: info@tempohouse.com.vn
Ho Chi Minh City, Vietnam
We acknowledge all requests within 3 business days and resolve within 30 days.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via our website. The “Last updated” date at the top of this document reflects the most recent revision. Continued use of our services following a material update constitutes acceptance of the revised policy.