1. Data controller
1.1 Operator identity
This Privacy Policy describes how Trip Express Vietnam Company Limited (Business Registration and Tax ID: 0402217820, headquartered at 210 Diep Minh Chau, Da Nang City, Vietnam) collects, isolates, processes, and protects personal data across DING OS (getding.io and api.getding.io) in compliance with the General Data Protection Regulation (GDPR), CCPA, PDPA, and applicable Vietnamese Personal Data Protection laws.
1.2 Dual role separation
Because DING OS operates as multi-tenant commerce infrastructure, data protection responsibilities are divided into two distinct roles:
- Company as data controller (Workspace account data): We act as the Data Controller strictly for Merchant account registration, staff authentication, workspace configuration, and SaaS subscription billing records.
- Merchant as independent data controller (Customer CRM data): For all buyer profiles, phone numbers, reservation histories, order folios, and loyalty balances collected through a Merchant's storefront or counter ("Merchant Customer Data"), the Merchant acts as the independent Data Controller and Trip Express Vietnam Company Limited acts solely as a Data Processor operating under the Merchant's instructions.
2. Information collected
2.1 Data processing schedule
We process the following categories of structured data depending on your interaction with the Platform:
| Data category | Examples of data elements | Privacy role | Primary purpose |
|---|---|---|---|
| Workspace staff | Name, work email, role, OneUID sub identifier, booking.owner attribution | Controller | Account authentication, role security, operational performance attribution |
| Customer CRM | Buyer name, phone number, email, VIP tier, cashback point balance | Processor | Order fulfillment, phone lookup, first-party loyalty redemptions |
| Order folios | Scanned Unit code, ordered items, Open-Tab audit logs, tax invoice details | Processor | Counter dispatch, split billing, statutory tax invoice generation |
| Synced emails | Sender address, guest name, booking reference, schedule, item breakdown | Processor | Automated order extraction from emails forwarded to @getding.io |
| Market insights | De-identified bucket (sector, zone, window, fulfillment, USD-normalized AOV, item count) | Controller | Regional demand benchmarking enforcing k-Anonymity >= 15 with zero buyer PII |
| System telemetry | IP address, browser user-agent, WebSocket latency, API request logs | Controller | Fraud prevention, rate limiting, edge routing reliability |
3. Legal basis
3.1 Workspace operations
We process Workspace Staff and billing data based on contractual necessity (to deliver the subscribed services under our Terms of Service) and legal obligation (statutory tax and accounting compliance).
3.2 End-customer processing
We process Merchant Customer Data strictly under our Data Processing obligations to the Merchant. Each Merchant is independently responsible for establishing a lawful basis (such as contract performance or affirmative opt-in consent) before collecting customer details or sending re-selling communications.
4. Data isolation
4.1 Multi-tenant row-level security
Every database table, search index, and API endpoint in api.getding.io enforces strict row-level scoping by organization_id. Customer profiles and order histories belonging to one Merchant are cryptographically and logically isolated from all other workspaces.
4.2 Staff attribution privacy
To protect employee privacy on shared counter terminals, front-desk views and account switchers conceal individual performance balances and compensation figures, restricting detailed booking.owner and role attribution reports to authorized management views and private staff profile pages.
4.3 Market insights anonymization
When an order is settled, api.getding.io records a de-identified statistical entry (sector, zone, window, channel, fulfillment, revenue_usd, and items_count) stripped of all customer names, phone numbers, email addresses, unit codes, and payment identifiers. Regional Market Insights benchmarks (Purchasing Power AOV, Peak Hours When, Zone Mix Where, and Category Velocity What) are computed and displayed only when a geographic zone and sector cohort contains at least fifteen (`k >= 15`) distinct active merchant organizations, ensuring no individual venue's revenue or buyer identity can ever be inferred or reverse-engineered.
5. AI confidentiality
5.1 Zero public model training
Customer conversations with the AI Sales Specialist and reservation emails parsed by Universal AI Email Ingest are processed solely to answer buyer inquiries and generate dispatch tickets for your workspace. We never use Merchant Customer Data or private workspace catalogs to train public foundation models.
5.2 Zero-Knowledge SSO integration
Authentication via OneUID (uid.one) exchanges only the cryptographic subject identifier (sub) and user-consented identity claims. OneUID never stores or accesses your workspace's customer CRM, order folios, or loyalty ledgers.
6. Sub-processors
To deliver global edge routing, cloud database hosting, and AI inference, we engage vetted infrastructure providers bound by strict Data Processing Agreements (DPAs), confidentiality obligations, and standard contractual clauses (SCCs). Payment QR codes and external checkout links route directly to the Merchant's designated bank or payment gateway; DING OS never stores raw payment card numbers (PAN) or CVV security codes.
7. Data security
7.1 Encryption standards
All network traffic across getding.io, custom merchant domains, and api.getding.io is encrypted in transit using TLS 1.3. Workspace databases, API tokens, and credentials are encrypted at rest using AES-256.
7.2 Ingestion loop suppression
Inbound emails processed by @getding.io compute a 30-day SHA-256 idempotency fingerprint (organization_id paired with reference) and inspect X-Ding-Generated headers to prevent duplicate ticket creation or mail loops.
7.3 Voucher encryption
Pre-generated bearer ticket codes and digital vouchers uploaded to the Voucher Vault are encrypted immediately upon ingestion using AES-256-GCM envelope encryption and indexed via an HMAC-SHA256 blind index (code_hash). Staff interfaces display only masked representations (BNH-****-8921); plaintext decryption occurs strictly inside an atomic database lock upon verified order settlement.
8. Data retention
- Active workspaces: Merchant workspace and CRM records are retained for the duration of your active subscription. Operational audit logs are retained according to your subscribed plan tier (7 days on Free, 30 days on Starter, 365 days on Business, and 7-year immutable audit vault (`2,555 days`) on Enterprise).
- Post-termination: Following subscription cancellation, workspace data is retained for up to 36 months solely where required for statutory tax, financial audit, or legal compliance, after which it is permanently erased or anonymized.
- Immediate export and deletion: Merchants may export their CRM and order ledgers to CSV/JSON or purge specific customer records at any time via Workspace Settings.
9. Privacy rights
Under GDPR, CCPA, PDPA, and Vietnamese Personal Data Protection laws, individuals have the right to access, rectify, export, restrict, or erase their personal data:
- Merchants and staff: You may exercise your rights directly within your account settings or by emailing
[email protected]. - End-customers of a venue: Because the Merchant is the Data Controller for its customer list, buyers seeking to view, update, or delete their data with a specific venue should contact that Merchant directly. If you submit a request to
[email protected], we will promptly forward it to the relevant Merchant workspace.
10. Contact
For privacy inquiries, Data Processing Agreement (DPA) requests, or data protection matters, please contact our Data Protection Office:
- Legal entity: Trip Express Vietnam Company Limited
- Address: 210 Diep Minh Chau, Da Nang City, Vietnam
- Tax ID: 0402217820
- Email:
[email protected] - Telephone:
+84 888 724 777