Chính sách Bảo mật Dữ liệu Cá nhân
Personal Data Privacy Policy

Definitions and Scope

This Policy applies to:

• Client: Any organization or individual registered to use LinkLeads.vn services — acting as the Data Controller.
• End User / Data Subject: Any individual whose email address is included in a Client's mailing list.
• Repu / LinkLeads: Acting as the Data Processor — processing data strictly on the instructions of the Client.

This Policy applies to all LinkLeads services including: linkleads.vn (marketing and product information site) and em.linkleads.com.vn (the Email Marketing software platform where Clients log in to use the service). Both domains are hosted on Linode infrastructure in Singapore.

Personal data under this Policy includes: email addresses, full names, and email behavior data (open rates, clicks, bounces) of End Users.

Data We Collect and Purpose of Processing

Legal Basis for Processing

Repu processes personal data based on the following legal grounds under the Law on Personal Data Protection 2025:

• Performance of contract: Processing is necessary to deliver the agreed services to the Client.
• Legitimate interests: Maintaining system security and preventing spam and fraud.
• Legal compliance: Retaining logs and records as required by competent authorities.

Clients, as Data Controllers, are responsible for ensuring a valid legal basis (including obtaining End User consent where required) before uploading any email list to LinkLeads.

Data Storage and Cross-Border Transfers

Client data is stored and processed through the following infrastructure:

The use of infrastructure in Singapore and Finland constitutes a cross-border transfer of personal data under Article 20 of the Law on Personal Data Protection 2025. Repu has implemented appropriate safeguards including Data Processing Agreements (DPAs) with the above providers and Transfer Impact Assessments (TIAs) as required by law.

Rights of Data Subjects

End Users have the following rights under the Law on Personal Data Protection 2025:

• Right to be informed: Know how their data is being processed.
• Right of access: Request to view stored personal data.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of personal data.
• Right to restriction: Request suspension of processing in certain circumstances.
• Right to object: Object to processing for direct marketing purposes.
• Right to withdraw consent: Unsubscribe at any time via the unsubscribe link included in every email.

To exercise these rights, End Users should contact the organization that sent the email (the Client — Data Controller), or submit a request directly to Repu at the contact below. Repu will acknowledge within 72 hours and complete the request within 30 days.

Data Security

Repu implements the following technical and organizational measures to protect personal data:

• TLS 1.2+ encryption for all data in transit
• Encryption at rest for stored data
• Least-privilege access control
• Mandatory two-factor authentication (2FA) for all admin accounts
• 24/7 system monitoring and access logging
• Regular data backups with tested recovery procedures

Data Breach Notification: In the event of a security incident affecting personal data, Repu will notify affected Clients and the competent authority (Department of Cybersecurity — A05, Ministry of Public Security) within 72 hours of discovery, in accordance with Article 29 of the Law on Personal Data Protection 2025.

Data Protection Officer (DPO)

Repu has designated a Data Protection Officer in accordance with Article 33 of the Law on Personal Data Protection 2025:

Policy Updates

Repu reserves the right to update this Policy in response to changes in law or data processing activities. For material changes, we will:

• Notify Clients by email at least 30 days before the change takes effect
• Update the "Last updated" date at the top of this document
• Archive previous versions for reference

Continued use of LinkLeads after the effective date of any update constitutes acceptance of the revised Policy.

Governing Law and Dispute Resolution

This Policy is governed by the laws of Vietnam, including:

• Law on Personal Data Protection No. 91/2025/QH15
• Decree 356/2025/NĐ-CP implementing the Law on Personal Data Protection
• Decree 90/2008/NĐ-CP on anti-spam
• Law on Cybersecurity No. 24/2018/QH14

Any disputes arising in connection with this Policy shall be resolved by the competent People's Court in Vietnam.

Contact Us

For any requests, complaints, or questions regarding this Privacy Policy, please contact: