1. Information of the Data-Collecting and Data-Managing Entity

2. Purpose and Scope of Information Collection

2.1 Purpose of Information Collection

The website goldencoastresort.com.vn collects customer information in order to:

• Create, manage, confirm and fulfil bookings for rooms, restaurant services, tours or other related services provided by Golden Coast Resort & Spa;
• Contact and confirm with customers when a transaction is made on goldencoastresort.com.vn;
• Process payments, verify transactions, reconcile with banks, process refunds, process service cancellations, manage vouchers, and carry out related accounting operations;
• Transfer necessary information to Golden Coast Resort & Spa’s specialized departments and service partners in order to hold reservations, confirm services, and arrange transportation, accommodation, sightseeing tickets, insurance, tour guides, or on-site assistance at the destination;
• Contact and work with customers in special circumstances;
• Manage the goldencoastresort.com.vn website and send customers website updates, promotional programs, and special offers/loyalty benefits;
• Prevent activities that damage a customer’s user account or fraudulent activities;
• Manage, analyze and evaluate data in order to build appropriate sales and customer-service policies;
• Detect and remedy incidents and fix errors in the services provided, and develop new technology features;
• Process customer payments and detect fraud in both payment and service-usage activities;
• Receive customer feedback, suggestions, proposals and complaints in order to improve the quality of goldencoastresort.com.vn‘s services;
• Refrain from using a member’s personal information for any purpose other than confirmation and contact related to transactions on goldencoastresort.com.vn;
• Where required by law: Golden Coast Resort & Spa is responsible for cooperating and providing members’ personal information when requested by judicial authorities, including the procuracy, courts, or police investigation agencies, in connection with a customer’s alleged violation of the law. Other than such cases, no party has the right to intrude upon a member’s personal information.

2.2. Scope of Information Collected

Personal information is collected on the basis of information customers voluntarily declare when registering for services on goldencoastresort.com.vn. Depending on the circumstances, the information collected may include, but is not limited to:

• Basic identification information: full name, gender, date of birth, phone number, email address, contact address, country/region of residence, preferred language;
• Service-booking information: full name, email, phone number, booking details, length of stay, check-in and check-out dates;
• Payment information: payment method, amount, transaction code, payment time, payment status, credit/debit card information, refund information, voucher usage history;
• Technical information: IP address, device type, browser, operating system, cookies, pages viewed, access time, website interaction behavior, and system logs;
• Correspondence information: emails, messages, calls, and content of consultations via hotline, Zalo, Messenger, the website contact form, or other official support channels.

We only collect information that is necessary and consistent with the stated purpose of use, and we do not require users to provide information unrelated to the provision of products/services, except where otherwise required by law or voluntarily provided by the user.

3. Scope of Information Use

Users’ personal information is used for the following purposes:

• Contacting users to confirm transactions and provide services upon request;
• Providing service information to customers upon request;
• Sending marketing and promotional emails about the services we provide;
• Sending notifications about activities on the website;
• Contacting and working with users in special circumstances;
• Refraining from using a user’s personal information for any purpose other than confirmation and contact related to transactions;
• Responding to requests from judicial authorities, including the procuracy, courts, or police investigation agencies, in connection with an alleged violation of the law by a customer.

In addition, transaction information — including transaction history, transaction value, correspondence content, and payment method — is also stored by goldencoastresort.com.vn in order to resolve any issues that may arise in the future.

4. Data Retention Period

• We will store personal information provided by customers on our internal systems for as long as we are providing services to the customer, until the collection purpose has been fulfilled, or until the customer requests that the information provided be deleted.
• Booking, payment, invoice, accounting-document, reconciliation, and refund/cancellation information may be retained for the period required under applicable laws on accounting, tax, electronic transactions, tourism, and consumer-rights protection.
• Golden Coast Resort & Spa may continue to retain a limited portion of data where necessary to prevent fraud, protect lawful rights, resolve disputes, or fulfil legal obligations.

5. Organizations and Individuals That May Access Personal Information

A user’s personal information may be accessed by the following parties, to the extent necessary:

• The front-desk, management, customer-care, sales, technical, accounting, or other relevant departments of goldencoastresort.com.vn;
• Partners under contract to perform part of the services for goldencoastresort.com.vn (e.g. technical partners, transportation partners). These partners will receive information as agreed under the relevant contract (which may be partial or full information depending on the contract terms) in order to support users in using the services provided by goldencoastresort.com.vn;
• Banks, transaction-reconciliation providers, fraud-prevention providers, and providers of technical infrastructure, email, SMS, CRM, website analytics, or system security, to the extent necessary;
• Competent state authorities, where lawfully required under applicable regulations;
• Other organizations or individuals with the user’s consent or as required by law.

Parties granted access to a user’s personal information are responsible for maintaining its confidentiality and may only use the information to the extent necessary to perform the related work, service, or obligation.

We do not sell, exchange, rent, or otherwise disclose users’ personal information to third parties for commercial purposes without the user’s consent, except as otherwise required by law.

6. Measures to Secure Users’ Information and Data

We apply appropriate technical and management measures to protect users’ personal information, including but not limited to:

• Controlling access rights to data-storage systems;
• Limiting personnel with access to personal information according to their scope of work;
• Maintaining access logs, data-change logs, payment logs, and booking-processing logs to support auditing, reconciliation, and fraud prevention;
• Regularly reviewing, inspecting, and updating security measures as needed;
• Requiring partners and relevant third parties to commit to safeguarding information under the applicable agreement and legal requirements.

Users are responsible for safeguarding their own account information, passwords, authentication codes, and login credentials where the website offers account functionality. Users should notify us immediately if they discover or suspect that their personal information has been exposed, misused, or shows signs of a security breach.

Although we make every effort to apply the necessary security measures, no data transmission or storage system on the Internet can be guaranteed to be completely secure. In the event of an incident affecting personal data, we will promptly take remedial action and provide notification in accordance with applicable law.

7. Method and Procedure for Users to View, Update, or Request Correction of Data

Customers have the right to review, view, update, correct, or request the correction of their personal information provided on the website.

Users may do so through the following method:

• Contact the website’s customer-care department by phone at: (84 – 252) 384.6666 / 384.6665 / 384.6670, or by email at: allsales@goldencoastresort.com.vn, or through other contact channels published on the website, to request assistance in viewing or correcting personal data.

The customer’s request should clearly state the content of the request, including the information to be viewed or corrected or the reason for the request (if any), and the contact information needed for the website to respond.

After receiving a request, the website may ask the customer to provide information necessary to verify their identity, to ensure the request is made by the rightful data subject. If the request is valid, the website will process it within an appropriate scope and notify the customer of the outcome within a reasonable time.

If a request cannot be fulfilled in whole or in part because it is invalid, lacks sufficient verification, or falls under circumstances in which the website is required to continue retaining or processing the data under applicable law, the website will notify the customer of the reason.

8. Method and Procedure for Receiving Requests to Delete, Cancel, or Restrict the Processing of Personal Data

Users have the right to request the deletion, cancellation, or restriction of processing of their personal data in circumstances permitted under applicable law.

Users may submit such a request through the following method:

• Contact the website’s customer-care department by phone at: (84 – 252) 384.6666 / 384.6665 / 384.6670, or by email at: allsales@goldencoastresort.com.vn, or through other contact channels published on the website, to request assistance with deleting, cancelling, or restricting personal data.

The customer’s request should clearly state: the contact information needed for the website to respond; the specific action requested (deletion, cancellation, restriction of processing, or the scope of data to be processed); identity-verification documents/information, if requested; and the reason for the request, if any.

After receiving the request, we will review, verify, and process it in accordance with applicable law. If the request is valid, we will carry out the deletion, cancellation, or restriction of data processing within an appropriate scope.

We reserve the right to decline a request in the following circumstances:

• The data must be retained in order to fulfil a legal obligation;
• The data relates to resolving a dispute, complaint, or violation, or to protecting the lawful rights and interests of us, the user, or a third party;
• The request lacks sufficient grounds to verify that the requester is the data subject or their lawful representative;
• Other circumstances as provided by law.

9. Method and Procedure for Receiving and Resolving Complaints, Requests, and Feedback Related to Information Security

In the event of a complaint, feedback, or request relating to the collection, use, storage, security, or processing of personal information, users may contact us through:

The complaint-handling procedure is as follows:

If the user does not agree with the outcome of the resolution, the user has the right to file a complaint or denunciation, initiate legal proceedings, or request resolution by a competent authority in accordance with applicable law.

10. Our Commitment to Information Security

We are committed to:

• Collecting and processing personal information strictly for the stated purposes and within the stated scope;
• Not disclosing, transferring, or providing users’ personal information to third parties without the user’s consent, except as otherwise required by law;
• Applying the necessary measures to protect users’ personal information;
• Supporting users in exercising their rights to view, correct, delete, cancel, or restrict the processing of their personal data in accordance with applicable law;
• Receiving and promptly addressing feedback and complaints relating to information security.

11. Customer Rights

Customers have the following rights:

• To request access to, correction of, or deletion of their personal information;
• To decline to receive advertising or promotional information from the platform;
• To file a complaint in the event of a breach relating to the security of their personal information;
• To choose and control their privacy settings, including: the right to access their data, the right to correct information provided, the right to request deletion of information, the right to restrict part or all of their personal data, and the right to object to the use of information for purposes other than those stated by Golden Coast Resort & Spa’s services;
• To configure preferences regarding how their personal data is processed, and to file a complaint or request resolution regarding their personal data with Golden Coast Resort & Spa’s Customer Support Center at any time while using the service;
• To have all personal data directly provided when registering a Golden Coast Resort & Spa account protected by appropriate technical and organizational measures.

12. Changes to This Privacy Policy

We reserve the right to amend or supplement this Privacy Policy from time to time to suit operational needs, changes to our services, or applicable legal requirements.

The updated version will be published on the website and will take effect from the date of publication, or from another date specified in the corresponding update notice.

Customers are encouraged to check this Privacy Policy periodically for any updates.

13. Contact Information

For any requests, questions, feedback, or complaints relating to this Privacy Policy, please contact: