TS68

Personal data collection, processing and protection policy

How TS68 collects, processes, stores, shares and protects personal data, and the rights and responsibilities of each party.

Updated: 01/11/2026

TS68 respects and is committed to protecting customers' personal data and privacy rights as data subjects. This Personal Data Collection, Processing and Protection Policy (the "Policy") is established by TS68 and applies to all customers, including individuals, representatives of organizations, organizations and customers interacting with TS68 systems, when using TS68 services and platforms. This includes, without limitation, using TS68 products and services, accessing ts68.vn, and using other tools, features and utilities that TS68 makes publicly available.

This policy explains how TS68 collects, processes, stores, shares and protects personal data and each party’s rights and obligations. TS68 determines an appropriate processing basis for each purpose; where consent is needed, TS68 provides clear notice and records verifiable consent. Reading or accepting this policy does not replace separate consent for advertising or other purposes where required by law.

This Policy forms an integral part of the Service Agreement published by TS68 under Terms of use and other related documents. TS68 may update or amend this Policy to comply with legal requirements or improve personal data protection in response to changes. TS68 will notify you of material changes through appropriate channels.

Chapter I. Definitions

Personal data: information in the form of symbols, writing, numbers, images, sounds or similar forms in an electronic environment that relates to or helps identify an individual under personal data protection law. Personal data includes basic personal data and sensitive personal data.

Business data: non-personal data relating to a business that an organizational customer, or an individual customer acting as its representative, creates, stores, transmits or processes while using TS68 services.

Data processing: one or more operations performed on data, including collection, recording, analysis, confirmation, storage, modification, access, retrieval, sharing, backup, restoration, deletion, destruction or other activities prescribed by law.

Personal data subject: a customer who uses or manages one or more TS68 products or services and is the individual to whom the personal data relates.

Personal data controller and processor: TS68 acts as both controller and processor when collecting, recording, verifying, storing, using, sharing and processing personal data for domain registration, management, maintenance and transfer, SSL certificate provision and other services for which TS68 determines the purposes and means of processing under the law or by the nature of the service.

Data processor: the data processor is TS68 for Hosting, Email and Cloud Server services within its role as an intermediary infrastructure provider, where TS68 stores, transmits, backs up and restores data uploaded by customers to TS68 systems according to customer instructions, the contract or the Service Agreement.

Services: all products and services supplied by TS68, including current services and those added in the future: domain registration and management, Hosting, servers (Cloud Server, Cloud VPS and Dedicated Server), email, SSL certificates and other information technology services.

Data stored on services: all data created, uploaded, stored, transmitted or processed by customers on Hosting, VPS, Cloud Server, Email or other infrastructure services supplied by TS68.

Chapter II. Legal framework

TS68's collection and processing of customers' personal data complies with the law, specifically:

  • Law on Personal Data Protection No. 91/2025/QH15, adopted by the National Assembly of the Socialist Republic of Vietnam on 26/06/2025, effective from 01/01/2026;
  • Law on Cybersecurity No. 116/2025/QH15, adopted by the National Assembly of the Socialist Republic of Vietnam on 10/12/2025, effective from 01/07/2026;
  • Government Decree No. 147/2024/ND-CP on the management, provision and use of internet services and online information, issued on 09/11/2024, effective from 25/12/2024;
  • Government Decree No. 356/2025/ND-CP detailing certain articles and measures for implementation of the Law on Personal Data Protection, issued on 31/12/2025, effective from 01/01/2026;
  • Government Decree No. 174/2026/ND-CP on administrative penalties in postal services, telecommunications, radio frequencies, electronic transactions and information technology, issued on 15/05/2026, effective from 01/07/2026;
  • Circular No. 48/2025/TT-BKHCN of the Ministry of Science and Technology on the management and use of internet resources, issued on 25/12/2025, effective from 10/02/2026;

Chapter III. Data categories and TS68 roles by service

TS68 collects only data that is appropriate, necessary and limited to the minimum required to achieve the processing purposes within the scope of each service, as follows:

ServiceData categoryTypes of data collected and processed
Domain namesBasic personal dataFull name; date of birth; gender; telephone number; personal identification number (citizen identity card), passport or other lawful identity document; permanent, temporary or contact address; place of origin; nationality; email address.
Sensitive personal dataPayment data and transaction history; biometric data for electronic identity verification (eKYC); images of citizen identity cards or identity documents; behavioral data relating to service use (IP address, browser type, operating system and interface actions); and other sensitive personal data as defined by applicable law from time to time.
SSL certificatesBasic personal dataFull name; agency, organization or business information; email address; telephone number; contact address.
Technical service dataDomain name for SSL registration; Certificate Signing Request (CSR); DNS records for domain validation; domain validation email address (Validation Email).
Service-specific verification dataInformation about the legal representative or person authorized to receive verification requests from the CA; the organization's legal documents; verification documents required for the relevant certificate type (DV, OV or EV); and other information required by the certificate authority (CA) or by law.
Hosting, Cloud Server, Cloud VPS, Email and other infrastructure servicesBasic personal dataFull name; information about the agency, organization or business using the service; email address; telephone number; contact address.
Sensitive personal dataPayment data and transaction history; biometric data for electronic identity verification (eKYC); images of citizen identity cards; behavioral data relating to service use (IP address, browser type, operating system and access times); and other sensitive personal data as defined by applicable law from time to time.
Business dataAgency, organization or business name; enterprise registration number or tax number, if any; registered office address; legal representative or authorized representative information; service administration information; and other information necessary to enter into, manage and perform the service contract.
Note: For data that customers create, upload, store, transmit or process on Hosting, Cloud Server, Cloud VPS, Email Hosting and similar infrastructure services, TS68 only processes data as necessary to provide the services requested by the customer under the Service Agreement. Control over, and decisions regarding, the purposes and content of that processing remain with the customer or other legally entitled party.

TS68's role for each service is defined as follows:

No.ServiceTS68's role
1Domain names (including Vietnamese ".VN" and international domain names)Data controller and processor
2SSLData controller and processor
3Hosting, Email, Cloud Server, Cloud VPSData processor

The processor role for Hosting, Email, Cloud Server and Cloud VPS concerns content uploaded by customers whose processing purposes they determine. For account, contact, transaction and log data collected by TS68 for registration, payment, support and system security, TS68 acts as controller or controller-and-processor according to the actual activity and applicable legal basis.

Chapter IV. Purposes of data use

4.1 Service initialization, customer verification, operation and security

Service initialization information: registering and maintaining services in accordance with sector-specific requirements.

Customer information verification and assessment to meet legal obligations: verifying the identity of service registrants and users, legal documentation and service eligibility under Vietnamese law for each service, sector-specific requirements or lawful requests from competent state authorities.

Creation and management of service accounts: creating and maintaining accounts and authenticating account holders when they sign in, access or use services.

Preparation of legal contracts: creating the legal contracts required for each service to manage registration information and establish service ownership.

Transaction and payment processing: conducting payment, invoice and documentation transactions to fulfill tax and accounting obligations under the law.

Necessary notifications during service operation, management and use: service initialization notices, renewal reminders, system maintenance and emergency service interruption notices; updates to legal policies, the Service Agreement and compliance requirements when they change.

Customer care and support: receiving, verifying and processing support requests to ensure they reflect the service holder's instructions, and responding to or resolving complaints and disputes arising from service use.

System operation, security and safety: monitoring system activity and preventing, detecting and addressing fraud, attacks, unauthorized access and other risks affecting customers' or TS68's interests;

Personal data processed for service provision, operation and maintenance includes, without limitation:

  • Service registration and use information and contract information: full name, date of birth, gender, telephone number, personal identification number (citizen identity card), name of the organization registering the service, contact address, place of origin, nationality and customer contact email;
  • Payment transaction information and transaction history;
  • Biometric data for electronic identity verification (eKYC).

The purposes in this subsection and the associated personal data are considered necessary for legal compliance and TS68's legal obligations when providing services, independently of consent. If a customer does not provide this mandatory data, provides inaccurate data or withdraws consent regarding it, TS68 may refuse, suspend or terminate services under the law and the service terms.

4.2 Marketing, advertising and surveys

TS68 uses data for advertising, product introductions or promotions only with appropriate separate consent covering the disclosed content, method and frequency. Customers are provided with an opt-out method; advertising complies with applicable advertising and anti-spam laws.

Market research, user behavior surveys, and assessment of business performance and product development strategies.

Customers may refuse or withdraw consent to processing for these purposes at any time without affecting the provision, use or maintenance of services.

4.3 User experience optimization and service improvements

Analyzing customer usage behavior, interactions, access history and feedback to improve interfaces, features and system performance, maintain usage state and resolve technical errors. This purpose is limited to improving service quality and the user experience, and excludes marketing or advertising without the customer's separate consent.

4.4 Sharing with authorized third parties

In certain cases under sector-specific requirements, TS68 may share personal data with partners to the extent necessary to complete a customer's service registration request.

Data is processed only for the purposes stated above. Otherwise, TS68 processes personal data only as permitted by law or after clear notification and the customer's lawful consent, except where the law permits processing without consent.

Chapter V. Data collection, processing and protection

5.1 Methods of data collection

TS68 may collect customers' personal data directly or indirectly while supplying products and services, from sources including, without limitation:

When customers search for, register, purchase or use TS68 products and services, or open an account with TS68;

The website and utilities provided by TS68 at https://ts68.vn and its subdomains under ts68.vn, through collection of information about services of interest, devices, access logs and technical location data with the user's consent;

Communications, consultations and support between TS68 and customers in person, by telephone, live chat, email, call center, forms, social media interactions or other electronic means;

Customer participation in surveys, competitions or promotional programs sponsored by TS68;

Cookies and behavioral analysis tools;

Data sources from competent state authorities and lawful public sources permitted by law.

5.2 Sharing personal data

To the extent prescribed by law or necessary to fulfill the purposes in this Policy, TS68 may share personal data with or in the following circumstances:

Within TS68 for service registration, management and renewal reminders under internal procedures;

Other third parties with the customer's consent or at its direction;

Assignment of service rights and obligations at the customer's request and with its consent;

A transfer, division or merger of TS68's business in accordance with the law;

The Vietnam Internet Network Information Center under the Ministry of Science and Technology for registration and management of national ".vn" domain names as required by law;

Lawful requests from competent state authorities.

5.3 Processing personal data without the data subject's consent

Under Article 19 of the 2025 Law on Personal Data Protection, TS68 may process or share personal data without the data subject's consent in the following cases:

Protecting the life, health, honor, dignity or lawful rights and interests of the data subject or another person in an urgent situation;

Addressing an emergency or a threat to national security;

Serving the activities of state agencies and state administration as prescribed by law;

Performing agreements or contractual obligations involving the customer, including domain registration, dispute resolution and technical support requests, in accordance with the law;

Where personal data must be publicly disclosed by law;

Other cases prescribed by law.

Data subjects registering international domain services are also subject to ICANN's requirements for disclosure requests.

5.4 Cross-border transfers of personal data

To provide internationally standardized services and comply with common principles for registering and initializing international services, TS68 may transfer customers' personal data abroad in accordance with the law and transfer impact assessment (TIA) requirements.

Transferred data may include full name, email and contact address.

Recipients may include ICANN and international registries for international domain services;

TS68 undertakes to work only with partners whose data protection measures are equivalent to or higher than the standards required by Vietnamese law.

5.5 Deletion of personal data

When a customer stops using TS68 services and submits a valid personal data deletion request consistent with the legal requirements applicable to the service, TS68 will delete all or part of the personal data provided by the customer or collected by TS68 during the customer's use of its services.

Personal data cannot be deleted in the following cases:

Data required for administration or legal compliance, retained only for the necessary period:

  • For Vietnamese domain services, personal data about registrants of national ".vn" domain names is retained for 25 years under applicable regulations.
  • For international domain services, personal data about international domain registrants is retained for 10 years under applicable regulations.
  • For Hosting, Cloud Server, Cloud VPS and Email, information about the service holder and basic data is retained for a minimum of 01 year under applicable regulations.
  • TS68 retains system logs concerning access and data processing for a minimum of 12 months for administration and cybersecurity purposes as prescribed by law.

Personal data processed and shared by competent state authorities for state agency activities in accordance with the law;

Personal data made public in accordance with the law;

Personal data processed for scientific research or statistical purposes as prescribed by law;

Emergencies involving national defense, national security, social order and safety, major disasters or dangerous epidemics; threats to security or defense that have not reached the threshold for declaring an emergency; prevention and control of riots, terrorism, crime or legal violations;

Responding to emergencies threatening the life, health or safety of the customer or another individual..

5.6 Personal data storage and security

TS68 stores customers' personal data on appropriate servers and backup systems within Vietnam in accordance with the law.

TS68 retains personal data for the period necessary to fulfill the purposes agreed with the customer or required by law, and applies appropriate technical and organizational measures to protect it throughout storage.

5.7 Personal data protection principles

Personal data is processed lawfully, fairly, openly, transparently, for the stated purposes, within the necessary scope and in accordance with applicable law.

Personal data is collected and processed only for specific, clear and lawful purposes notified in this Policy or agreed with the customer, and is not processed for other purposes unless otherwise provided by law.

Personal data is retained only within the scope and period necessary for the processing purpose, legal obligations or requests from competent state authorities under the law.

TS68 applies appropriate technical and organizational measures to provide the necessary level of personal data security and confidentiality, including prevention of unauthorized or unlawful access and risks of accidental loss, destruction or damage.

TS68 ensures that processed personal data is accurate, complete and updated as necessary. Inaccurate or incomplete data, or data no longer necessary for processing purposes, will be corrected, supplemented or deleted in accordance with the law.

To the extent required by law, TS68 is responsible for selecting and managing relevant partners, suppliers and data processors, and requiring them to comply with Vietnamese personal data protection law.

Chapter VI. Data subject rights and responsibilities

6.1 Rights of personal data subjects

Personal data subjects have the following rights to control their personal information:

Right to be informed: customers receive clear information from TS68 about data processing when using TS68 services or utilities.

Right to consent or withdraw consent: customers may decide whether to allow TS68 to process data for optional purposes, such as promotional communications. Data subjects may withdraw this consent at any time.

Right of access and correction: data subjects may access and view their data and ask TS68 to correct inaccurate identification information to ensure the accuracy of their records.

Right to request deletion (right to be forgotten): when customers no longer use TS68 services, they may request deletion of all personal data, except where the law or TS68's legal obligations require otherwise.

Right to restrict or object to processing: data subjects may ask TS68 to stop using their data for advertising or marketing.

Right to complain and bring legal proceedings under the law if they believe their personal data protection rights have been infringed.

6.2 Responsibilities of personal data subjects

Personal data subjects have the following responsibilities to ensure information security:

Provide truthful and accurate information and promptly notify TS68 of changes. This is mandatory when registering for TS68 services, particularly during citizen identity card eKYC verification. Inaccurate information may cause the data subject to lose service ownership or leave TS68 without sufficient grounds to protect the data subject's interests in a dispute.

Protect accounts and devices: data subjects must safeguard their TS68 account passwords, enable secure authentication methods such as OTP, and protect personal devices used to access service administration.

Be responsible for data uploaded, stored or processed on TS68 systems.

Respect other data subjects' data: do not use TS68 infrastructure to collect data unlawfully or infringe third-party privacy.

Cooperate promptly with TS68 and competent state authorities in information security incidents or in response to lawful investigation or verification requests.

Monitor, keep up to date with and comply with this Policy and the Service Agreement throughout service use.

6.3 Timeframes for TS68 to receive and process data subject requests

Under Decree No. 356/2025/ND-CP, TS68 undertakes to comply with statutory response deadlines when personal data subjects request to exercise their rights, through the following procedure:

  • Step 1: email your request to TS68 at support@ts68.vn, including your contact details and the matter to be addressed.
  • Step 2: TS68 receives, identifies and responds to the request.

o TS68 informs the data subject about the procedure, receipt and processing of the request within 02 working days;

o Valid data update or correction requests: TS68 completes processing within 02 days and no later than 10 days after receiving a valid request.

o Valid requests to withdraw consent or restrict processing: TS68 responds within 02 days and no later than 15 days after receiving a valid request.

o Personal data deletion requests: TS68 verifies and responds within 02 days and no later than 20 days after receiving a valid request.

o Refusal to delete: a response is provided within 02 days after receiving a valid request.

Chapter VII. TS68 rights and responsibilities

7.1 TS68's rights

TS68 may collect and process data to initialize services, verify customers, operate services and ensure service security.

TS68 may refuse a customer's data deletion request where retention is mandatory under the law, required by an appropriate request from a competent state authority or required by other legal provisions.

If a customer withdraws consent for data used for essential purposes, TS68 may suspend or terminate services because the legal requirements for service provision, management and operation can no longer be met.

Before fulfilling data subject rights, such as access, correction or deletion, TS68 may require verification information to ensure that the request comes from the correct data subject and to protect data security.

TS68 updates its data protection policy under the notice and application procedure in Chapter XI; changes to processing grounds or purposes must meet the corresponding legal requirements.

7.2 TS68's responsibilities

When collecting and processing data, TS68 must clearly inform customers about the types of data collected, collection purposes, processing methods and relevant third parties.

Implement technical and organizational measures, including internal rules, to prevent unauthorized access and data leakage risks.

TS68 appoints a dedicated data protection unit with personnel meeting the personal data protection requirements in Article 13, Chapter II of Government Decree No. 356/2025/ND-CP, and implements access logging mechanisms appropriate to each system and its risk level.

Prepare and retain data processing impact assessments and cross-border transfer impact assessments for services connected to international providers where data is shared, if applicable. TS68 assesses compliance with personal data protection requirements and updates impact assessment records every 01 year or whenever material processing changes occur.

Demonstrate that data processing complies with the law.

In a data leakage incident, TS68 notifies the specialized authority and customers within 72 hours of detection, following the procedure: Detection, Assessment, Containment, Remediation, Notification and Lessons Learned.

Chapter VIII. TS68 responsibilities for each service

8.1 Cloud Server, Hosting and Email services

For Hosting, Cloud Server and Email services, in its role as data processor and in addition to the provisions of the Service Agreement Terms of use, TS68 makes the following commitments and assumes the following responsibilities:

Apply appropriate technical measures, such as 2FA, passkeys, WAF and zero trust, to the fullest extent of TS68's capabilities to protect against unauthorized access or modification, data destruction, malware and cyberattacks.

Access is permitted only with the customer's consent and authorization for service support, assistance with data subject rights, system management or operation, incident resolution, or lawful requests from competent state authorities. Only personnel assigned by TS68 receive access permissions. All access must be logged and traceable for the prescribed period. Access for personal purposes is strictly prohibited.

If a leak, data loss or unauthorized access is detected, TS68 assesses, contains and remedies the incident and provides notification under section 7.2 and applicable statutory deadlines; ongoing investigation alone does not justify delaying notification.

When a customer's service plan expires and is not renewed, TS68 deletes data under its data retention policy and the relevant TS68 Service Agreement provisions, except for data required by law for state administration or by competent authorities.

Cooperate with state agencies upon lawful requests from investigative bodies, state regulators or other competent authorities.

Keep data stored on service plans confidential; do not use or analyze its contents for commercial purposes or beyond service operation; and do not sell, share or exploit customers' data contents.

As an intermediary service provider, TS68 is not responsible for data content. The service holder bears legal responsibility for the accuracy, lawfulness, ownership and rights of use of stored data.

TS68 is not obliged to routinely monitor the content of data that customers store or process on Hosting, Cloud Server, Email or other infrastructure services. Customers' use of services to store, transmit or process data does not make TS68 responsible for that data's lawfulness, accuracy, ownership or content. However, where there are grounds to believe that data or service use violates the law or the Service Agreement, or a competent state authority makes a lawful request, TS68 may take necessary measures such as temporarily restricting access, isolating systems, suspending services or cooperating in handling the matter under the law.

TS68 processes data only under lawful customer instructions, as necessary to provide services under the contract or Service Agreement, or upon requests from competent state authorities in accordance with the law.

Providing infrastructure for data storage, transmission or processing does not grant TS68 ownership, control or disposal rights over data created or stored by customers on the services. Ownership and decisions on processing purposes remain with the customer or other legally entitled party.

8.2 Data collection and processing for domain registration services

As both data controller and processor for customers registering, managing and maintaining domain names, TS68 may collect, record, store, use, update, modify, verify, share, retain and process customer personal data to the extent necessary to provide these services under Vietnamese law, requirements of domain authorities and international domain management organizations, and relevant service conditions.

Processing follows the principle of collecting only the minimum data necessary, consistent with the processing purpose and without exceeding the scope needed to supply the service.

Data collected may include, without limitation:

  • Full name;
  • Date of birth, if required by law or registry policy;
  • Citizen identity card number, passport number or other lawful identification document;
  • Enterprise registration number, enterprise registration certificate or equivalent legal documents;
  • Permanent, contact or registered office address;
  • Email address;
  • Telephone number;
  • Registrant, domain administrator, technical contact, billing contact and other contact information required for the domain type;
  • Payment, invoicing and other information needed to supply the service.

TS68 may process this data for the following purposes:

a) Domain registration, management, maintenance, renewal, ownership transfer, registrar transfer or changes to registrant information;

b) Registrant verification through eKYC, identity document checks, and verification of business information or legal representatives;

c) Registration record management, data storage and customer care;

d) Fulfillment of obligations under Vietnamese law and the requirements of VNNIC, ICANN, registries or relevant domain management organizations;

e) Handling registrant verification requests, abuse reports, domain disputes, complaints, allegations or other issues arising during service provision;

f) Fulfilling reporting, inspection, examination, investigation or information disclosure obligations upon lawful requests from competent state authorities.

To the extent necessary for these purposes, TS68 may share or transfer customer data to:

  • The Vietnam Internet Network Information Center (VNNIC) for national ".vn" domain names;
  • The registry or registry operator managing international domain names;
  • ICANN and organizations or entities designated or authorized by ICANN;
  • Registrar backend providers;
  • Domain dispute resolution organizations under policies applicable to each domain type;
  • Competent state authorities or other organizations where prescribed by law or where sharing is necessary to supply the service.

TS68 may refuse registration, suspend, withdraw or terminate services where registration information is inaccurate, falsified or unverifiable, where customers violate the law or service conditions, or upon lawful requests from competent state authorities, VNNIC, ICANN or a registry.

TS68's responsibilities

TS68 collects and processes data only to the extent necessary to supply services and fulfill legal obligations. It does not collect or process data beyond the purposes notified to customers unless otherwise provided by law.

TS68 applies appropriate technical and organizational safeguards, including access permissions, user authentication, encryption where necessary, access logging, backups, system monitoring and other safeguards under TS68's internal standards.

TS68 ensures data is processed for the proper purposes and within the proper scope, and does not disclose, trade or use customer data for purposes other than service provision without customer consent, unless otherwise provided by law.

TS68 enables customers to exercise their statutory data subject rights, including access, updating, correction, supplementation, restriction of processing and other rights to the extent permitted by law.

8.3 Data collection and processing for SSL certificate services

To provide SSL certificate services, TS68 may collect and process necessary information such as domains, CSR (Certificate Signing Request), validation email addresses, DNS records, business information, legal representative information, legal documents and verification materials required for each certificate type (DV, OV or EV).

TS68 may share this data with certificate authorities (CA), verification partners, SSL service intermediaries or relevant organizations for certificate verification, issuance, renewal, revocation or management under CA/B Forum requirements, individual CA policies and applicable law.

TS68 must keep verification records confidential, process data only within the necessary scope, refrain from using it for other purposes and apply appropriate technical and organizational measures to safeguard data throughout certificate issuance and management.

8.4 Processing payment transaction data

TS68 protects transaction information and does not retain complete payment card data or CVV/CVC codes. Transactions through payment service providers follow the security standards applicable to those services, and data transmission is protected through appropriate technical measures.

Chapter IX. Data controls

TS68 may use cookies and similar technologies to record access information and interactions on its website to improve the user experience and service quality. Customers may configure their browsers to reject cookies or warn when they are used, although doing so may affect certain website or service features.

Customers may access and update information directly in the TS68 service management area or email support@ts68.vn to exercise their personal data rights. In some cases, TS68 may require identity verification before processing a request under the law.

TS68 does not provide services to minors as defined by law, unless lawful or written consent is provided by a parent or guardian in accordance with applicable law.

TS68 websites and services may contain links to third-party websites or services reviewed by TS68. However, depending on the service and each party's policies, TS68 is not responsible for those third parties' content, privacy policies or data protection measures. Customers must independently review and comply with the privacy policies of the relevant websites.

Chapter X. Confidential information and business data

For Hosting, Email, Cloud Server and Cloud VPS, TS68 is an information technology infrastructure provider that only performs storage, transmission, backup, operation or technical activities necessary to supply services at the customer's request. TS68 does not determine the purposes, content or methods of the customer's data use unless otherwise required by law or requested by the customer in writing.

"Confidential Information and Business Data" means all information, documents and data in any form lawfully owned, managed or used by the customer, not publicly disclosed and valuable to the customer's business, technical or operational activities, that is stored, transmitted or processed on TS68 Hosting, Email, Cloud Server or Cloud VPS infrastructure. Customers upload this data to TS68 systems or accumulate it during service use. TS68 does not control the lawful content of the data or determine the customer's purposes for using it. Customers bear legal responsibility for the lawfulness, accuracy, ownership, rights of use and content of data stored, transmitted or processed on TS68 infrastructure.

10.1 Subjects and scope of protection of Confidential Information and Business Data

Confidential information and business data include non-public information of business, technical or operational value stored by customers on TS68 infrastructure. Where a dataset also contains personal data, personal data protection obligations apply concurrently and are not displaced by its business-data classification. Examples include:

  • Trade secrets: business plans, strategies, business data, partner lists and other internal documents.
  • Technical data: software source code, system design documents and database structures.
  • Operational data: the customer's own customer databases and specialized business information.
  • Financial and accounting information: financial records, accounting reports, invoices and documents relating to the customer's cash flow.

10.2 Non-disclosure commitment

TS68 applies appropriate technical and organizational measures to protect confidential information within the committed service scope and does not disclose, supply or share it with third parties except in the following cases:

  • With written consent or authorization, including electronic authentication, from the customer as the holder of the Confidential Information and Business Data;
  • As required by a competent state authority or applicable Vietnamese law.

10.3 Limits on information use

TS68 undertakes to limit access to the minimum necessary for the following purposes, at the customer's request and with its consent:

  • Service operation: initializing, providing, maintaining and optimizing service infrastructure performance as agreed.
  • Technical support: resolving incidents or performing technical customization directly requested by the customer through support tickets or email.
  • Safety: preventing cyberattacks, fraud or risks affecting customer data and TS68's shared systems.

TS68 will never use this data for its own commercial purposes, unfair competition or infringement of the customer's intellectual property rights.

10.4 Exclusions from confidentiality obligations

The confidentiality exceptions below apply only to information meeting the relevant conditions and to the extent permitted by law; they do not displace personal data protection duties:

  • Information lawfully made public without a breach of confidentiality by TS68.
  • Information lawfully held before customer disclosure, lawfully received from a third party with no confidentiality duty, or independently developed without using customer confidential information.
  • Information lawfully made public by the customer. Private disclosure to a third party does not automatically remove confidentiality.
  • For loss caused by customer credential disclosure, application faults or deletion, responsibility follows causation and each party’s fault; TS68 must still protect retained data as committed.

10.5 Effectiveness and policy amendments

TS68 undertakes to apply appropriate technical, management and organizational measures to protect customers' Confidential Information and Business Data against unauthorized access, use, disclosure, modification, destruction or loss within the scope of TS68 services.

Confidentiality duties begin when TS68 receives information and continue while TS68 retains or processes it, including after service expiry or termination and for retained backups. Data is deleted under the applicable schedule; documents and information with a lawful retention basis are kept only within the necessary scope, purpose and duration and may not be reused for unlawful purposes.

TS68 may update this Policy to reflect changes in legal requirements or state administration requirements. Policy changes do not affect TS68's confidentiality commitments regarding customers' Confidential Information and Business Data during service provision.

Chapter XI. Policy amendments

TS68 may update, amend or supplement this Policy to comply with the law, requests from competent state authorities, changes in service operations, or to improve data protection and customers' rights and interests.

For material changes affecting customer rights, TS68 gives at least 10 days’ notice through its website, service portal or registered email. If earlier application is necessary to comply with law, a competent authority’s requirement or an urgent system security risk, TS68 gives notice as soon as practicable and explains the reason.

Continued service use is not implied consent to new processing purposes or advertising. TS68 provides notice and obtains and retains evidence of consent where required by law; customers may withdraw consent in accordance with the applicable legal grounds.

Where the law requires explicit, separate consent or particular conditions before applying a provision, TS68 will provide notification and obtain the customer's consent in a lawful, appropriate form before processing data or applying the change.

A new policy version applies to new orders confirmed after its publication on the website. Previously confirmed orders and entitlements remain subject to the version accepted by the customer, unless the parties lawfully agree otherwise or mandatory law requires otherwise. Adverse changes do not automatically apply retroactively to a paid service term.

Chapter XII. General provisions

Customers undertake to comply fully with this Policy. For matters not addressed here, the parties agree to follow applicable law and guidance from competent state authorities in effect at the relevant time.

This Policy is agreed in good faith between TS68 and the customer. Any dispute arising during its implementation will first be addressed through negotiation and mediation. If mediation fails, the dispute will be referred to the competent People's Court for resolution under the law.

Customers should read the rights and responsibilities in this policy. Consent, where needed, is recorded for the purposes and through the procedures described above. For questions or to exercise data rights, customers may contact TS68 as follows:

  • Write to 68 Technology Solution Company Limited at Office 01, Floor 9, Pearl Plaza Building, 561A Dien Bien Phu Street, Thanh My Tay Ward, Ho Chi Minh City.
  • Email: support@ts68.vn.
  • Call: 0911.717.669 - 0939.504.390.

The update date and version are published on the website. Changes are applied under Chapter XI, lawful processing grounds and customer rights; they do not automatically expand previously accepted processing purposes.

Updated on: 01/11/2026