This policy explains how ThreeTrees (Three Trees Group Co., Ltd.) collects, uses, stores and protects your personal data when you use the website threetrees.com.vn, in accordance with Decree 13/2023/NĐ-CP on personal data protection.
1. Data we collect
- When you order: full name, phone number, email (if provided), delivery address, notes, the products ordered and the payment method.
- When you book an appointment: full name, phone number, preferred date, needs and notes.
- If you have an account (optional): your sign-in email, plus your full name, phone number, date of birth and address if you save them; the history of orders placed while signed in; your member tier.
- In your browser: your shopping bag and sign-in session are stored on your own device so the website can work. The website currently does not use advertising cookies or behavioural tracking tools.
ThreeTrees does not collect card numbers, bank passwords or bank OTP codes. The website has no passwords: you sign in to your account with a 6-digit code sent to your email.
2. How we use it
- To confirm, prepare and deliver orders; reconcile payments; handle returns and warranty.
- To contact you to confirm appointments and give advice at your request.
- To maintain your account: sign-in, showing order history, filling in delivery details, assessing member tiers and benefits.
- To prevent fraud and spam, and to protect our systems.
- To meet accounting and tax obligations and requests from competent state authorities.
ThreeTrees only sends promotional messages with your separate consent. ThreeTrees does not sell your personal data.
3. Where it is stored and who processes it with us
- Google (Google Workspace): where orders, appointments and account profiles are stored and sign-in code emails are sent. Only staff assigned to the task can see them.
- Hostinger and Cloudflare: the server that runs the website and the network that delivers and protects the connection. The information you enter is sent straight to Google and is not stored on the web server.
- VietQR: generates the bank transfer QR code image and receives only the amount and order number.
- Couriers: receive your name, phone number and address when delivering an order.
Google, Hostinger and Cloudflare servers may be located outside Vietnam. By agreeing to this policy, you agree that your data may be stored on those servers; ThreeTrees carries out the procedures for transferring data abroad as required by regulations.
4. How long we keep it
- Orders: kept for the period required by accounting and tax law, even if you delete your account.
- Appointments: up to 24 months from submission; ThreeTrees reviews and deletes them periodically.
- Accounts: until you delete them. Accounts not signed in to for more than 36 months may be deleted after ThreeTrees gives notice by email.
- Sign-in codes: expire after 10 minutes. Sign-in sessions expire after 30 days.
5. Your rights
You have the right to be informed, to give or withdraw consent, to view, correct and delete your data, to request restriction of processing, to object to processing, to receive a copy of your data and to lodge complaints as provided by law. If you have an account, you can view and edit your information and delete your account yourself on the Account page. For other requests, contact ThreeTrees as described in section 7; ThreeTrees will respond within the period required by law (for deletion requests or withdrawal of consent: within 72 hours).
Withdrawing consent does not affect processing carried out before then, and for orders in progress ThreeTrees still needs your contact details to complete or cancel the order.
6. Protecting your data
- The entire website uses encrypted HTTPS connections.
- Sign-in uses one-time codes instead of passwords: a code is cancelled after 5 incorrect attempts and code requests are limited; the server only keeps a hash of the session code.
- Data is only open to staff who need it to process orders and appointments; admin accounts use two-step verification.
- Prices and totals are calculated by the server, independent of information sent from the browser.
In the event of a data breach, ThreeTrees will notify the competent authorities and affected customers within the period required by law. No method of online transmission or storage is completely secure; if you suspect your account has been used without permission, sign out and tell ThreeTrees immediately.
7. Cookies and measurement tools
The website uses Google Analytics, Google Ads and Meta Pixel to measure visits, orders and appointment requests and to improve advertising. On your first visit you choose Accept or Decline:
- Accept: these tools may set cookies in your browser; Meta Pixel only runs if you accept.
- Decline: no advertising or analytics cookies are set; Google only receives anonymous signals that are not linked to you.
If you have chosen Accept, when an order or appointment request succeeds the website sends Google Ads the email and phone number you just entered in one-way encrypted form (SHA-256 hashed, cannot be reversed) together with the order code and amount, so Google can match conversions from ads ("enhanced conversions"). Your name and address are not sent. Meta Pixel and Google Analytics only receive the order code and amount. To change your choice, clear the site data for threetrees.com.vn in your browser and the website will ask again on your next visit.
8. Contact about personal data
Email [email protected], phone 024 3928 8725, or visit the store at 15 Nhà Thờ, Hàng Trống, Hoàn Kiếm, Hà Nội. When this policy changes, ThreeTrees updates the date at the top of the page and announces important changes on the website.
For help, please contact ThreeTrees by email at [email protected], by phone on 024 3928 8725 or in person at 15 Nhà Thờ, Hàng Trống, Hoàn Kiếm, Hà Nội.