This privacy policy describes how Quỳnh Ngô Land collects, uses, stores and protects your personal data when you use our website, in accordance with Decree 13/2023/ND-CP on the protection of personal data.

1. Data controller

The controller of personal data is Quỳnh Ngô Land. For any request, complaint, or exercise of data-subject rights, please contact:

Phone: 0393 659 430
Zalo: https://zalo.me/84393659430
Messenger: https://m.me/quynhngoland

2. Data we collect

Relevant API endpoints: /api/leads (ContactLeadSchema) — active; /api/property-leads (PropertyLeadSchema) — currently disabled (handler returns HTTP 410, no data stored); /api/demand-leads (DemandLeadSchema) — currently disabled (handler returns HTTP 410, no data stored). The fields of the two disabled endpoints are still listed below so that this policy always reflects the full scope of processing that may occur. When those interfaces are restored, the 410 short-circuit will be removed and the form will include a consent mechanism equivalent to /lien-he.

2.1. Via the general contact form (`/lien-he` → `/api/leads`)

User inputs:

name — full name (required)
email — email address (required)
phone — phone number (optional)
message — message body (required)

Hidden fields (not displayed in the UI, attached automatically based on the originating page):

source — records the form's origin (contact, hero_search, or listing_inquiry)
listingId — UUID of the listing being viewed, if the form is submitted from a listing detail page

Consent fields (required, new):

consent — your acknowledgement of this policy via the consent checkbox in the form
policyVersionAcknowledged — the policy version you saw at submission time
consent_policy_version — stored in the database with the same value as above
consent_given_at — submission timestamp recorded by the server

Account linkage (when applicable):

user_id — when the submitter is signed in (via Supabase Auth), the lead record is saved with that account's user_id so contact history is aggregated.

2.2. Via the property listing form (`/api/property-leads`)

Currently disabled — returns HTTP 410, no data stored. When restored, the form will collect:

intent — transaction type (sell/rent)
address — property address
areaSqm — area (m²)
bedrooms — number of bedrooms
priceVnd — price (VND)
description — description
contactName — contact full name
contactPhone — phone number
contactEmail — email (optional)

When the UI is restored, the form will include a mandatory consent mechanism equivalent to /lien-he.

2.3. Via the property demand form (`/api/demand-leads`)

Currently disabled — returns HTTP 410, no data stored. When restored, the form will collect:

intent — demand type (buy/rent)
district — desired area
minBedrooms — minimum bedrooms
maxPriceVnd — maximum budget (VND)
notes — notes
contactName — contact full name
contactPhone — phone number
contactEmail — email (optional)

When the UI is restored, the form will include a mandatory consent mechanism equivalent to /lien-he.

2.4. Via traffic analytics (Google Analytics)

Activated only when you click "Accept" on the cookie banner:

Cookies _ga, _ga_<id> (stored in your browser, encoding an anonymous identifier)
Truncated IP, pages viewed, device, browser

If you click "Decline" or have not made a choice, Google Analytics receives none of your data.

2.5. Via error monitoring (Sentry — enabled in production)

For technical purposes only, not marketing:

URL where the error occurred
User-agent
Stack trace

2.6. Stored in your browser (localStorage)

qnl_consent — your accept/decline cookie choice (stored locally, never sent to the server)

3. Purpose of use

We use the data above for the following purposes:

Respond to contact requests and provide suitable real-estate advice.
Analyse website performance and optimise user experience.
Improve the quality of our advisory and brokerage services.

We do NOT sell, and do NOT lease, your personal data to any third party for commercial purposes.

4. Data processors

To operate the website and process the data above, we use the following service providers:

Supabase — PostgreSQL database. Server region per project configuration, located outside Vietnam.
Vercel — hosting and global edge network.
Google — Google Analytics (only when you consent).
Sentry — technical error monitoring.

Details of each party's data processing can be found in their privacy policy on their own website.

5. Cross-border data transfers (outside Vietnam)

The data processors above operate infrastructure outside Vietnam's territory. Under Decree 13/2023/ND-CP, cross-border data transfers require the informed consent of the data subject and the creation and retention of a Transfer Impact Assessment (TIA) by the data controller.

Legal basis for the transfer: to perform your request (submitting contact details, storing information, and measurement once you have consented via the cookie banner). We do not rely on "implied consent through use of the service".

Your consent: by ticking the consent box on the contact form, you confirm that you have been notified that the submitted content will be stored on the infrastructure of the processors listed above, including transfer outside Vietnamese territory. You may withdraw consent at any time via the contact channels in §1; we will delete or anonymise the data within 72 hours of receiving the request.

Impact assessment records (DPIA/TIA): we maintain internal records of data processing and cross-border transfers in accordance with Articles 24 and 25 of Decree 13/2023/ND-CP. A summary may be provided when requested by a competent authority.

6. Retention period

Leads (contact forms): kept for a maximum of 24 months from the most recent contact. After this period, data is anonymised or deleted, unless the law requires longer retention.
Google Analytics: 14 months (per Google's default retention configuration).
Sentry: 90 days (per Sentry's default configuration).
localStorage qnl_consent: stored until you manually clear it via your browser settings.

7. Data-subject rights

Under Article 9 of Decree 13/2023/ND-CP, you have the following rights regarding your personal data:

Right to know about the processing of your personal data.
Right to consent or withhold consent to the processing of personal data.
Right of access to view, edit, or request correction of your personal data.
Right to withdraw consent.
Right to delete or to request deletion of your personal data.
Right to restrict processing of your data.
Right to request provision of your personal data.
Right to object to processing.
Right to complain, denounce, or sue under the law.
Right to claim damages under the law.
Right to self-protection under the Civil Code and other applicable laws.

To exercise these rights: please contact us by phone, Zalo, or Messenger as listed in §1. We will respond within 72 working hours.

Competent authority: the Cyber Security and High-Tech Crime Prevention and Control Department (A05), Ministry of Public Security — the agency responsible for the protection of personal data under Decree 13/2023/ND-CP.

8. Children

Our service is not directed at users under the age of 16. We do not knowingly collect children's personal data. If you are a parent or guardian and discover that your child has provided personal data to us, please contact us via the channels in §1 so that we may delete it.

9. Cookies and similar technologies

Item	Type	Purpose	Lifetime
`_ga`, `_ga_<id>`	Cookie (third-party — Google)	Measure traffic	Only when you click "Accept" on the cookie banner
`qnl_consent`	localStorage (first-party)	Remember your accept/decline cookie choice	Stored until you clear it manually

How to decline or change your choice:

Click "Decline" on the cookie banner (shown on first visit).
Clear qnl_consent via your browser settings — the banner will reappear on the next visit.
Adjust browser cookie settings (Chrome/Safari/Firefox all provide tools).

10. Changes to this policy

We may update this policy from time to time. The current version and effective date are recorded at the top of the page. For material changes (expanded collection scope, new data processors, changes to purpose), we will notify you via a banner on the home page and ask you to re-confirm consent.

11. Contact

For any question, rights request, or complaint regarding this privacy policy, please contact:

Phone: 0393 659 430
Zalo: https://zalo.me/84393659430
Messenger: https://m.me/quynhngoland