Privacy policy
English customer information for the published Giftdee policies, version 2026-10-24.4, effective 24 October 2026. International shipping arrangements below reflect the destination-specific quote process; no domestic flat shipping charge is applied to international requests. Mandatory consumer rights remain applicable.
1. Controller and contact
Website operator
Legal name: Hộ Kinh Doanh Lương Kim Hiếu. Household business registration 01O8052356, issued 5 June 2024. Tax ID: 8059198668-001.
Registered address: Số 4 ngách 43/23 tổ 1 Văn Phú, Phường Kiến Hưng, Tp Hà Nội, Vietnam. Return location: Xưởng in 86colors, Thôn Cầu, Xã Bình Minh, Tp Hà Nội, Vietnam. Please contact the shop before returning a parcel.
Email: luongkimhieu@gmail.com. Phone / Zalo: +84 935 237 932. Support: 09:00–17:00 Monday to Friday, Vietnam time (UTC+7), excluding public holidays.
2. Data and purposes
Giftdee processes account identifiers and contact details, order/quote and delivery details, artwork, original images, previews, approvals, necessary payment references and security/session information. These are used for requested account functions, design preparation, quotes, production, fulfilment, reconciliation, support, fraud prevention and applicable legal obligations. An international shipping request includes the supplied destination, contact details and artwork so the shop can assess the service.
3. Choice, lawful basis and third-party images
Processing is limited to disclosed purposes, valid consent where required, the transaction you request and applicable duties. Silence or browsing is not blanket consent. Refusing necessary delivery details can prevent fulfilment, but does not justify requiring marketing consent. Ensure you may lawfully share recipient information or images. Children’s and represented persons’ data require appropriate authority, consent and safeguards; the shop may seek clarification or decline unsupported processing.
Order artwork is not automatically authorised for advertising, social publication, design resale or AI training. Separate appropriate permission or other lawful grounds are required for another purpose, with applicable withdrawal options. Automatic AI image generation is not currently activated on this site.
4. Storage and retention
Design drafts and the basket are stored in the browser. Submitted requests, originals and previews are sent to the server. Clearing the browser does not erase submitted records. Accounts are retained while used; account closure or a valid deletion request is assessed against continuing legal obligations or unresolved matters.
Order/contract records and final proofs are retained for at least 1 year under the applicable household-business arrangement for no more than five years from establishment. If that arrangement ceases to apply, the contract-access period is adjusted to at least three years as required. Accounting, tax, invoice and disputed records follow longer applicable retention duties. Original production images are reviewed for deletion or anonymisation after 90 days from completion unless needed as lawful evidence. Security logs are kept for up to 90 days unless a case requires investigation; backups rotate over 30 days.
Retention and deletion involve administrative review, legal duties and pending cases. These periods are not a claim that an automatic deletion feature already exists. Deleted data in backups remains restricted until the backup cycle ends, subject to lawful preservation requirements.
5. Recipients and cross-border processing
Assigned staff, production providers and essential service providers receive only the necessary information. Carriers need recipient, address, contact and relevant collection details, not all original artwork unless needed. Payment providers such as payOS/Casso and banks process data relevant to the payment service actually used. International carrier assessment may require the destination and relevant parcel information.
Hosting is provided by Hostinger, with the current server in Malaysia. Submitted information may therefore be stored or processed outside Vietnam. Giftdee must address applicable cross-border privacy requirements and provider management; publishing this page alone does not establish completion of those obligations. Zalo chat is an external service governed by its own policies. Data shared there is used for order handling only within the notified purpose. The site does not currently send Zalo OTPs or marketing emails. New recipients or purposes require notice and applicable consent. Lawful authority requests may require disclosure.
6. Security and incidents
Controls include HTTPS, protected sessions, password hashing, request-origin checks and order/file access controls. Payment secrets stay on the server. These measures do not mean absolute security or that all stored information is encrypted. The shop reviews and addresses incidents, limits harm and notifies affected people or authorities when required. Report concerns to the contact above.
7. Your rights
Subject to applicable law, you may seek information, give or refuse consent, withdraw consent, access, obtain, correct or delete data, restrict or object to processing, complain and request protection or compensation. Contact support with the relevant account/request and the action sought. Giftdee verifies identity only as necessary and does not request a password or OTP for these rights. Initial response is within one working day; specific legal response periods also apply. Where data must be retained, the shop explains the basis and restricted use. Withdrawal does not invalidate previously lawful processing.
8. Cookies, device storage and domains
Session cookies support sign-in, guest identity and request security: currently up to 30 days for guests, seven days for members and one hour for administrators. Affiliate referral cookies last 30 days. Browser drafts use localStorage or IndexedDB until cleared. Blocking cookies or clearing storage may remove drafts or require sign-in again. The .vn and .com domains use separate browser sessions and device storage; an account record can be used on either domain but sign-in and baskets are not automatically shared across them.
The published scope does not include optional advertising or analytics tools. If non-essential tools are enabled, appropriate information and choice must be provided. Marketing and public-image permission are not preselected or bundled into buying.
9. Updates
Versions identify their effective date. Material changes to processing purposes, scope or recipients require notice and renewed consent where necessary; a new notice does not legitimise processing beyond an existing permission.