This English version is a translation provided for reference. If there is any inconsistency, the Vietnamese version prevails.
Effective date: [dd/mm/yyyy] · Version 1.0
This Policy explains how NLP Law Firm (Công ty Luật TNHH NLP) processes personal data when you visit the luatnlp.com website, submit the “Book a consultation” form, call the hotline or email the Firm: which data is processed, for what purposes, who receives it, where it is stored, how long it is kept and how you can exercise your rights.
1. Scope
This Policy applies to personal data that NLP Law Firm (the “Firm”) processes when you:
- visit the luatnlp.com website, including its English and Chinese versions;
- submit the “Book a consultation” form;
- call the hotline 0825 108 668, send an email to nlplawfirm.hn@gmail.com or send a message to the Firm before signing a legal services contract.
This Policy does not apply to:
- data processed in the course of performing a legal services contract. Such data is processed in accordance with the legal services contract and lawyers’ duty of confidentiality under the Law on Lawyers;
- websites and applications of other organisations that you open from links on the website, including Zalo, Facebook and LinkedIn.
2. The Firm and contact point
| Item | Details |
|---|---|
| Name | NLP Law Firm (Công ty Luật TNHH NLP; “NLP Law”) |
| Certificate of Registration of Operation | No. 01072223/TP/ĐKHĐ, first issued on 17/07/2023 |
| Legal Representative | Lawyer Nguyễn Duy Linh, Director |
| Head office | Ground Floor, No. 10 Cầu Đất Street, Hồng Hà Ward, Hà Nội |
| Contact point for personal data requests | Email nlplawfirm.hn@gmail.com · Hotline 0825 108 668 · Written requests sent to the head office |
For the data described in this Policy, the Firm is the personal data controller and processor under Clause 9, Article 2 of the Law on Personal Data Protection No. 91/2025/QH15: the Firm determines the purposes and means of processing and processes the data directly. The service providers listed in Section 7 process data under the terms of service between each provider and the Firm.
3. Data processed
3.1. Data you enter in the “Book a consultation” form
| Data | Required |
|---|---|
| Full name | Yes |
| Phone number or email (at least one) | Yes |
| Area you need advice on | No; defaults to “Other area / Not yet determined” |
| Preferred contact language: Vietnamese, Chinese or English | No |
| Short message, up to 300 characters | No |
| Time of submission; the page from which you submitted the form and the language of that page; the fact that you ticked the consent box and the version of the notice you consented to | Recorded automatically |
When handling a request, the assigned lawyers and staff also record on the spreadsheet the processing status, the person in charge and brief notes on getting back to you.
The form has a hidden field to prevent spam; ordinary users do not see or fill in this field. The form also sends the time between your opening the page and clicking submit, in order to identify spam; this information is not stored. The form does not accept file attachments.
When you click submit, your browser connects directly to Google’s servers. Google receives your IP address and browser information in order to handle that connection.
3.2. Data you provide by phone, email or message
Your phone number, email address, full name or display name, and the content of your communications with the Firm.
3.3. Technical data when you visit the website
IP address, browser and device information, and other technical information in the access request, such as the page accessed and the time of access. This data is processed by Cloudflare when delivering and protecting the website (Sections 6 and 7).
3.4. Data the Firm does not collect through the website
The website has no user accounts, does not accept payments, does not accept files, does not use cookies for tracking and does not use analytics tools. The Firm does not ask you to provide sensitive personal data through the website, by phone or by email at the consultation booking stage (Section 13).
4. Purposes of processing
| Purpose | Data used |
|---|---|
| Handling your request to book a consultation, including: getting back to you; forwarding the request to an appropriate lawyer or staff member according to the area and language; checking for conflicts of interest before discussing the details of the matter; scheduling the consultation | Section 3.1 |
| Answering questions and requests you send by phone, email or message, including checking for conflicts of interest and scheduling a consultation | Section 3.2 |
| Handling your requests to exercise your rights in respect of personal data | Data in the request and related data |
| Delivering the website to your device; protecting the website against unauthorised access, attacks and spam | Section 3.3; anti-spam field |
Checking for conflicts of interest helps ensure that the Firm does not provide legal services to parties with opposing interests in the same matter.
The Firm does not sell personal data, does not use the data described above to send advertising and does not process it for any purpose other than those listed above. Where processing for a new purpose is needed, the Firm notifies you and seeks your consent before processing, unless the law provides otherwise.
5. Basis for processing
- Form data: your consent, given by ticking the consent box yourself before submitting. The box is not pre-ticked; if it is not ticked, the form cannot be submitted. The Firm records the time of submission and the version of the notice you consented to.
- Data received by phone, email or message: your consent, when you contact the Firm on your own initiative and provide information so that the Firm can respond to your own request.
- Requests to exercise rights: to enable the Firm to handle the request in accordance with the law on personal data protection.
- Technical data: processed to the extent necessary to deliver the web pages you request and to protect the website. The Firm does not use this data to identify you.
In addition, the Firm may process personal data without your consent in the cases provided for in Article 19 of the Law on Personal Data Protection, for example to serve the activities of state agencies as provided by law.
6. How data is collected and the tools used
Website. The luatnlp.com website is a static website, hosted and delivered through the Cloudflare Pages service of Cloudflare, Inc. (United States) on Cloudflare’s global server network. The website server does not store form data.
The “Book a consultation” form.
- Your browser sends the data described in Section 3.1 to a Google Apps Script application under the Firm’s Google Workspace account (domain luatnlp.net).
- The application writes a row of data to a Google Sheets spreadsheet in the Firm’s Google Drive.
- The application sends a notification email containing the request to the Firm’s mailbox on Google Workspace (domain luatnlp.net).
Hotline. You call 0825 108 668.
Email. The mailbox nlplawfirm.hn@gmail.com uses the Gmail service of Google LLC (United States).
Zalo, Facebook and LinkedIn links. These icons on the website are links only; the website does not embed code from those platforms. When you click on them, you leave the website and the platform processes data in accordance with its own policies. If you message the Firm through these platforms, the Firm processes your display name and message content as data under Section 3.2.
7. Recipients and processors of data
| Recipient | Activity | Data |
|---|---|---|
| Lawyers and staff assigned by the Firm | Receiving requests, getting back to you, checking for conflicts of interest, scheduling consultations, handling requests to exercise rights | Sections 3.1, 3.2 |
| Google, through the Firm’s Google Workspace services (Google Apps Script, Google Sheets, Google Drive, Gmail mailbox on the luatnlp.net domain) | Receiving and storing form data and sending notification emails as configured by the Firm | Section 3.1; IP address and browser information when the form is submitted |
| Google LLC (United States), through the Gmail service for the mailbox nlplawfirm.hn@gmail.com | Receiving, storing and sending emails between you and the Firm | Emails and the content of communications |
| Cloudflare, Inc. (United States), through the Cloudflare Pages service | Hosting, delivering and protecting the website | Section 3.3 |
| Network operators and messaging platforms you choose when calling or messaging the Firm | Transmitting calls and messages under the terms of those operators and platforms | Section 3.2 |
| Competent state agencies | Where requested in accordance with the law | Data requested |
8. Transfer of data outside Vietnam
The services described in Sections 6 and 7 are operated by foreign providers. Your personal data may therefore be stored and processed outside the territory of Vietnam:
- Form data, notification emails and email communications are stored on Google’s server systems; the servers may be located outside Vietnam.
- Technical data is processed by Cloudflare, Inc. on its global server network, which may be outside Vietnam, including in the United States.
- Messages you send through other organisations’ platforms are stored on those platforms’ systems in accordance with their policies; some platforms have servers outside Vietnam.
Processing by the providers is carried out under the terms of service between each provider and the Firm. According to documentation published by Google, data on Google Workspace is encrypted by Google at rest and in transit.
9. Retention period
| Data | Retention period |
|---|---|
| Form data (spreadsheet rows and notification emails); emails and messages exchanged before a contract is signed | Up to 12 months from the date the Firm receives them, if no legal services contract is entered into. At the end of this period, the Firm deletes them from the spreadsheet and mailbox. |
| Your data, where you have signed a legal services contract with the Firm | Transferred to the matter file and processed in accordance with the legal services contract (Section 1). |
| Records of requests to exercise rights in respect of personal data | Up to 12 months from the date the request is resolved. |
| Technical data | Kept by Cloudflare in accordance with Cloudflare’s policies; the Firm does not store this data separately. |
If you withdraw your consent before the end of the retention period, the Firm stops processing and deletes the form data; if you request deletion, the Firm deletes the data. The time limits for doing so are set out in Section 10.3, unless the law provides otherwise. Copies on service providers’ systems are deleted in accordance with the providers’ procedures after the Firm deletes the data.
10. Your rights and how to exercise them
10.1. Your rights
Under Clause 1, Article 4 of the Law on Personal Data Protection No. 91/2025/QH15, you have the right to:
- be informed about the processing of your personal data;
- give or refuse consent, and request the withdrawal of consent, to the processing of your personal data;
- view, correct or request the correction of your personal data;
- request the provision or deletion of your personal data or the restriction of its processing; submit a request objecting to the processing of your personal data;
- lodge complaints and denunciations, bring lawsuits and claim compensation for damage in accordance with the law;
- request competent authorities, or agencies, organisations and individuals involved in processing personal data, to implement measures and solutions to protect your personal data in accordance with the law.
10.2. How to submit a request
- Send a request in writing, including by email, to nlplawfirm.hn@gmail.com or to the Firm’s head office. The request should state: your full name; the phone number or email you provided to the Firm; and what you are requesting. To withdraw consent, please use the email subject line “Rút lại sự đồng ý” (Withdrawal of consent).
- For guidance, please call the hotline 0825 108 668.
- To prevent data from being provided or deleted at someone else’s request, the Firm may ask you to confirm the request via the phone number or email you provided.
10.3. Time limits for handling requests
The time limits for responding to and carrying out requests are those set out in Article 5 of Decree No. 356/2025/NĐ-CP of the Government dated 31/12/2025, counted from when the Firm receives a request submitted as described in Section 10.2, as follows:
| Request | Response | Implementation | Extension (no more than once) |
|---|---|---|---|
| Withdrawal of consent; restriction of processing; objection to processing | 02 working days | 15 days; 20 days if processors or third parties need to be asked to stop processing | No more than 15 days |
| Viewing, correction or provision of data | 02 working days | 10 days; 15 days if processors or third parties need to be asked to make corrections | No more than 10 days |
| Deletion of data | 02 working days | 20 days; 30 days if processors or third parties need to be asked to delete data | No more than 20 days |
| Implementation of measures to protect your personal data | 02 working days | 15 days | No more than 15 days |
Where an extension is needed, the Firm informs you of the reason for it.
10.4. Limits on your rights
- Withdrawal of consent and restriction of processing do not apply to processing carried out before you submit your request.
- Requests to withdraw consent, restrict processing or delete data do not apply in the cases provided for in Article 19 of the Law on Personal Data Protection or where the law provides otherwise.
- Under Clause 3, Article 4 of the Law on Personal Data Protection, your request must be aimed at protecting your own lawful rights and interests, must not cause difficulty for or obstruct the exercise of the Firm’s legal rights and the performance of its legal obligations, and must not infringe the lawful rights and interests of the State or other agencies, organisations or individuals. The Firm does not provide data if doing so could harm national defence, national security, social order and safety, or infringe upon the life, health or property of others.
- Where data cannot be corrected or deleted for legitimate reasons, the Firm informs you accordingly.
10.5. Complaints
You may send a complaint to the Firm as described in Section 10.2. You may also notify or report to the specialised personal data protection authority under the Ministry of Public Security, or through the National Personal Data Protection Portal, where your rights are not ensured, or lodge complaints and denunciations or bring lawsuits in accordance with the law.
11. Protection measures in place
- The form contains only the fields needed to get back to you, does not accept files and asks you not to send details of your matter, documents or sensitive information.
- The website is a static website with no user accounts; form data is not stored on the website server.
- The website and the form use HTTPS connections, which encrypt transmission between your browser and the server.
- Form data is stored in the Firm’s Google Workspace account. According to documentation published by Google, data on Google Workspace is encrypted at rest and in transit.
- The Firm’s lawyers are obliged not to disclose information about matters or clients that they learn in the course of their practice, unless the client consents in writing or the law provides otherwise; the Firm is responsible for ensuring that its staff do not disclose such information, under the Law on Lawyers.
Where it detects a breach of personal data protection regulations that must be notified, the Firm notifies the specialised personal data protection authority in accordance with the law.
12. Cookies and analytics tools
- The website does not use the Firm’s own cookies, does not use analytics tools, does not embed maps, does not load fonts from third parties and does not embed social media code.
- In some cases where the website needs protection, for example when checking unusual traffic, Cloudflare may set technical cookies necessary for its security features. These cookies are not used for analytics or advertising.
- The “Get directions” button opens Google Maps in a new tab; Google then processes data in accordance with Google’s policies.
- You can block cookies in your browser settings; the website will still display its content.
- Before using cookies, analytics tools, embedded maps or other third-party services, the Firm updates this Policy and seeks your consent where required by law.
13. Sensitive personal data and children’s data
Sensitive personal data. The Firm does not request sensitive personal data at the consultation booking stage. Please do not enter in the form, emails or messages any information falling within the categories of sensitive personal data in Article 4 of Decree No. 356/2025/NĐ-CP, for example: health status; information about private life, personal secrets or family secrets; bank card details or bank account transaction history; images of identity cards or citizen identity cards.
The “Area you need advice on” field is optional. Some options, such as Criminal or Marriage and family, may reveal information about your private life; you can keep the option “Other area / Not yet determined” and discuss it when the Firm calls you back. If you have entered sensitive information, the Firm uses it only to get back to you, and you may request its deletion under Section 10.
Children’s data. The form is intended for adults. If you need advice on a matter involving children, such as child custody or maintenance, the parent or legal representative should book the consultation and enter only their own contact details. Please do not enter children’s information in the form.
14. Other information you should know
- Your obligations. Provide complete and accurate personal data about yourself; protect your own personal data; respect the personal data of others. Please do not enter other people’s personal data, including that of other parties involved in your matter.
- If you do not consent. The form cannot be submitted unless the consent box is ticked. You can still call the hotline 0825 108 668 or send an email to book a consultation.
- If you withdraw your consent. The Firm no longer uses the form data to get back to you or to schedule a consultation. If you still need advice, you can call the hotline or send an email.
- Legal services relationship. Submitting the form, calling the hotline or sending an email does not create a legal services relationship between you and the Firm. See also Terms of Use and Disclaimer.
- Language. This Policy is available in English and Chinese. If there is any inconsistency, the Vietnamese version prevails.
15. Changes to this Policy and effective date
- This Policy takes effect from [dd/mm/yyyy].
- The Firm may amend this Policy when it changes the way it processes data or when the law changes. Amended versions are published on this page with the new effective date and version.
- When changing the purposes, types of data or recipients, or starting to use cookies or analytics tools, the Firm updates this Policy before applying the change and seeks your consent again where required by law.