Chính sách bảo mật thông tin

1. Purpose and scope

The Capital Coffee respects the privacy and rights to personal data of customers, website visitors, partners and individuals who interact with us. This policy explains the categories of data that may be processed, the purposes of processing, the scope of sharing, retention periods, protection measures and how individuals can exercise their rights.

This policy applies to personal data processed through the website thecapitalcoffee.com, the processes of creating and managing accounts, ordering, payment, delivery, customer support, subscription to communications and official online channels that refer to this policy.

2. Data controller and processing roles

Depending on the specific activity, The Capital Coffee may be the party that determines the purposes and means of processing personal data, directly process data or coordinate with service providers to perform part of the processing activities. Service providers may only access data to the extent necessary to provide their services and must comply with confidentiality, data security obligations and applicable law.

3. Categories of data that may be collected

Identification and contact information: full name, phone number, email, delivery address, billing address and similar information you provide.
Account information: display name, login history, account preferences and information necessary to maintain the account.
Transaction information: products, quantity, order value, order status, payment method, delivery information, returns and complaints.
Interaction information: contact content, support requests, feedback, product reviews and history of communications with customer service.
Technical information: IP address, browser type, device, operating system, access time, technical logs and security-related information as required.
Information about choices and consents: language preferences, cookie preferences, subscription or unsubscription to marketing communications.

The Capital Coffee does not proactively request customers to provide bank passwords, PINs, CVV/CVC card codes or OTP codes via email, phone, social media or channels outside official payment processes.

4. Sources of data collection

Data you provide directly when filling out forms, creating an account, placing an order, making a payment, contacting us or submitting feedback.
Data generated during your use of the website and when carrying out transactions.
Data received from carriers, payment gateways, banks or service providers to the extent necessary to complete a transaction or process a request.
Technical data created by cookies or similar technologies according to applied choices and configurations; details are set out in the Cookie Policy.

5. Purposes of data processing

Receiving, confirming, processing and fulfilling orders.
Processing payments, reconciliation, refunds and preventing fraudulent transactions.
Organizing delivery, verifying delivery status and supporting returns.
Managing accounts and maintaining user-requested functions.
Receiving and resolving support requests, feedback, complaints or disputes.
Ensuring website security, detecting unusual behavior, preventing unauthorized access and handling incidents.
Analyzing performance and improving the website, products, services and user experience.
Sending marketing information or promotions when there is a lawful basis and when users have the right to opt in or opt out.
Fulfilling accounting, tax obligations, record retention, complying with the law and lawful requests from competent authorities.

6. Legal bases and processing principles

The Capital Coffee only processes data when there is an appropriate legal basis under applicable law, such as the consent of the data subject when necessary, the performance of a transaction or a customer request, compliance with a legal obligation, protecting lawful rights and interests, or other bases permitted by law.

Data is processed for legitimate purposes, to the extent necessary, with appropriate access restrictions and will not be used for new incompatible purposes without a corresponding legal basis.

7. Payment data

Payment information may be transmitted directly to banks, card issuers, payment gateways, PayPal or the payment service providers shown at the checkout step. The Capital Coffee only retains transaction information necessary for verification, reconciliation, support and compliance with legal obligations; we do not claim to store full payment card data if such data is processed directly by the payment provider.

8. Sharing and recipients of data

Data may be shared to the extent necessary with:

Carriers and logistics partners.
Banks, card issuers, payment gateways and payment service providers.
Website infrastructure providers, hosting, security, email, customer service, analytics or other necessary technology services.
Professional consultants, auditors or legal support when necessary and subject to appropriate confidentiality obligations.
State authorities with jurisdiction when there is a lawful request or when providing data is required by law.

The Capital Coffee does not sell customers' personal data as a commodity. Sharing data with third parties must be linked to a specific purpose and limited to what is necessary.

9. Cross-border transfers and services involving foreign elements

Some infrastructure, payment, analytics or online service providers may operate systems outside Vietnam. When processing activities involve cross-border transfers of personal data, The Capital Coffee will carry out applicable requirements for assessment, documentation, safeguards or procedures necessary under current law.

10. Retention period

Data is retained for the time necessary to achieve the processing purposes, maintain transactions and services, resolve complaints, protect lawful rights and fulfill legal retention obligations. Specific periods may vary depending on the type of data and related obligations. When there is no longer a purpose or legal basis for retention, data will be deleted, destroyed, anonymized or processed by other appropriate means.

11. Data subject rights

To the extent permitted by applicable law, you may have rights such as:

To be informed about personal data processing activities.
To consent or refuse, and to withdraw consent where processing is based on consent.
To request access to, inspect or receive information about your personal data.
To request correction of inaccurate data or to update data.
To request deletion of data, restriction or to object to certain processing activities where the legal conditions are met.
To request data portability or to exercise other rights as provided by applicable law.
To complain, report, initiate legal action or seek compensation if there are grounds to believe that personal data rights have been violated.

Some requests may be limited or cannot be immediately fulfilled if the data must be retained to complete a transaction, comply with legal obligations, protect lawful rights, prevent fraud or resolve disputes.

12. How to exercise rights

You may submit requests through the official contact channels published on the website. To protect data, The Capital Coffee may require identity verification or necessary information before processing a request. We will receive and handle requests within a timeframe appropriate to the type of request and applicable legal requirements.

13. Children and individuals requiring special protection

The website is not designed to knowingly collect personal data from children for inappropriate purposes. When processing activities involve children or persons requiring special protection, The Capital Coffee will apply conditions, consent mechanisms and safeguards in accordance with the law.

14. Data security and protection

Restricting access by role and business need.
Applying authentication, backup, monitoring and system protection measures appropriate to the level of risk.
Controlling service providers and requiring confidentiality obligations when they process data on behalf of The Capital Coffee.
Monitoring, detecting and handling data security incidents according to internal procedures and legal obligations.

No online system can guarantee absolute security. The Capital Coffee maintains reasonable measures and continuously improves them according to risk, technology and legal requirements.

15. Cookies and similar technologies

The website may use cookies, local storage or similar technologies to maintain necessary functionality, remember choices and, where applicable, measure performance or analytics. Detailed information on cookie types, purposes and management is set out separately in the Cookie Policy. This privacy policy does not repeat the detailed list of cookies.

16. Marketing and user choices

If The Capital Coffee sends marketing emails, messages or information based on consent or another lawful basis, recipients may use an unsubscribe mechanism or contact us to change their preferences. Notices necessary for transactions, account security or legal obligations are not considered marketing communications.

17. Links and third-party services

The website may integrate with or link to third-party services. When you leave the website or interact directly with a third-party service, their data processing activities may be governed by their own policies. The Capital Coffee recommends that users read the policies of the respective providers.

18. Changes to the Privacy Policy

The policy may be updated when laws, technology, business models or data processing activities change. The version and update date are published on this page. If changes give rise to a requirement to notify or obtain renewed consent, The Capital Coffee will act in accordance with applicable regulations.