1. Scope of Application and Responsible Entity
This policy governs the processing of personal data on the official website https://myjoytravel.vn/ and in the course of transactions for travel services, including: tour services, visa consulting, air tickets, transportation, tour guide/interpreter services, travel SIM/eSIM, purchasing agent (order) services and medical travel support at Joy Travel Co., Ltd (Enterprise code: 0110846677).
The Company determines its role in data processing according to its actual activities. For data where the Company itself decides the purposes and means and directly processes the data, the Company acts as the Personal Data Controller and Processor. Cooperating with or using the services of third parties does not reduce the Company's legal responsibility for protecting customer data.
Registered address: B07 The Boutique, No. 458 Minh Khai Street, Hanoi City, Vietnam.
Contact point for receiving personal data requests:
- Email: outboundop@myjoytravel.vn
- Hotline: 0845 549 369
The Company assigns dedicated personnel for personal data protection by internal document. The public hotline and email channels stated above serve the receipt of feedback and the handling of data subjects' requests in accordance with the law.
2. Types of Data Collected and Collection Methods
a) Consultation and service access stage: The Company collects basic information including Full name, Phone number, Email address and Request content, which customers provide voluntarily via online forms or official consulting channels.
b) Service confirmation and registration stage: To complete the service booking procedure, the Company collects information required by travel business operations, including: Date of birth, Nationality, Passport information, Travel itinerary, List of accompanying passengers, Financial invoice information and corresponding Payment documents.
c) Specific data and specialized records: For visa application records, children's information, health conditions or special support requests (such as dietary needs, separate access routes), the Company only receives them when truly necessary for performing the service and based on a lawful basis for processing.
Safety note: Customers must absolutely not provide personal passwords, OTP authentication codes, bank account login information or copies of unrelated documents through public consultation forms.
3. Purposes and Legal Basis for Data Processing
The Company processes personal data for the purposes of consulting, quoting, confirming orders, entering into and performing contracts, processing payments, issuing invoices, delivering and receiving documents, supporting customers and complying with current legal obligations.
Each processing activity is based on a clear legal basis. The Company does not apply a blanket form of consent for all purposes or data recipients. Where processing is based on the customer's consent, the Company will provide clear notice and retain authentic evidence before carrying it out. A representative booking services for a group does not automatically have the right to consent on behalf of other members without lawful authorization.
Marketing activities, loyalty programs or the use of images/videos for communication purposes are carried out on a voluntary opt-in mechanism, with no pre-selected options, and are not a mandatory condition for using the services. Customers have the right to withdraw consent at any time through the official contact channels.
The processing of children's data, as well as the publication of children's private life information/images, always strictly complies with legal regulations on child protection and requires the consent of the legal representative.
4. Data Recipients and Data Sharing
Only assigned and authorized personnel may access the data necessary for their work. The Company may share a minimum and necessary portion of data with partners providing services, including: carriers, accommodation establishments, tour/vehicle suppliers, tour guides, travel insurance providers, diplomatic missions/visa application receiving agencies and competent state authorities as prescribed.
For purchasing agent (order) services and SIM/eSIM, data is shared only for the purposes of supply, delivery and activation. For medical travel support services, the Company will clearly notify the identity of the receiving medical facility before transferring records.
Data processing agreements between the Company and partners clearly commit to roles, scope of processing, information confidentiality, incident response and obligations upon contract termination. Tour guides and drivers only receive contact information and support requests necessary to serve the group, and may not access copies or passport numbers of the entire group without a specific professional need.
Commitment: Joy Travel Co., Ltd absolutely does not sell, lease or trade customers' personal data in any form.
5. Cross-border Data Transfer and Sensitive Data Processing
a) Cross-border data transfer: Due to the nature of international travel services and visa consulting, personal data may be transferred to receiving partners abroad. Before transfer, the Company clearly identifies the recipient, receiving country, purpose, type of data and legal basis, and fully performs its notification obligations and complies with legal regulations on cross-border data transfer.
b) Processing of health data and medical travel: Health information and medical records are only collected for the agreed aesthetic travel/medical treatment support services. Before transferring records to a foreign medical facility, the Company specifically notifies the facility name, country, type of data, retention period and records the customer's consent. The Company does not use before/after treatment images or medical records for advertising purposes without separate written consent.
6. Data Retention Period
- General tour service information: Retained for a maximum of 12 months from the end of the tour program, except where retention is needed to fulfill legal obligations or resolve disputes.
- Copies of identity documents (Passport/Citizen ID): Deleted within 30 days after the end of the tour or after the corresponding visa procedure is completed.
- Health information and special requests: Deleted within 30 days after the end of the tour, unless retention is needed for insurance records or incident handling.
Accounting documents and invoices: Retained for the mandatory period under accounting and tax law.
Data handed over to partners or tour guides is recovered/deleted immediately upon completion of the task. All data backup systems apply an automatic deletion cycle according to internal regulations.
7. Rights of Data Subjects and Request Receiving Procedure
Customers have full rights under the law regarding their personal data, including the right to view, edit, request provision, delete, withdraw consent, restrict or object to data processing.
Valid requests sent to the email outboundop@myjoytravel.vn or the hotline 0845 549 369 will be verified and processed. The standard response time for valid procedures is within 02 working days.
Where there is a legal basis for not being able to fully fulfill a request (such as the obligation to retain tax documents), the Company will clearly notify the reason and the scope of data that continues to be retained. Withdrawal of consent does not affect the lawfulness of data processing activities carried out before.
8. Information Security Measures and Incident Handling
The Company applies appropriate technical and organizational measures to protect personal data, including: strict access authorization, multi-factor authentication (MFA) account management, transmission channel encryption, backup system protection and safe management of paper records.
Upon detecting a data security incident, the Company will immediately implement measures to prevent and minimize damage, conduct an investigation and fulfill the obligation to notify the state management authority as well as the data subject within the time limits prescribed by law.
9. Cookies and Third-party Tracking Technologies
The website uses Cookies necessary to ensure technical operation. Third-party analytics or advertising tools (such as Google Analytics, Meta Pixel) are only activated with the user's consent through the cookie settings form on the website. Customers can proactively manage or refuse cookies through their web browser settings.
10. Implementation Provisions and Updates
This policy takes effect from the date of official issuance. Any changes or additions will be publicly announced on the website https://myjoytravel.vn/. Continuing to use the services after updates are announced means that the customer has acknowledged and fully understood the amended contents.
