Vietnam supplement — privacy

Last updated 28 August 2026

This supplement applies to Vietnam and prevails over the general privacy policy for everything it covers. It carries only what Vietnam adds under the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, the framework in force since 1 January 2026: what we collect, why we may hold it and how we protect it is in the general policy, and stays in force.

Sensitive data, and the consent we ask for

Vietnamese law treats the details of a bank account as sensitive personal data. We ask a finder for those, and for the 12-digit personal identification number on their Căn cước công dân — the identifier that replaced the individual tax code — only when there is a reward to pay, and only to pay it and to meet the tax rules attached to it. We protect both to the sensitive standard.
Consent to that is asked for on the screen where the details are entered, against the words shown there — never folded into the terms, and never taken as given because you accepted something else.
We record the moment consent was given and a fingerprint of the exact disclosure that was on screen, so neither side has to remember what it said.
To withdraw it, press the button on your own account page and the payout record is destroyed there and then. Writing to hello@univmenu.com does the same thing, and we act on it within the times below.
Withdrawing means we can no longer pay you: a reward still pending cannot be disbursed once the details are gone.

Full detail — sensitive data under the Law on Personal Data Protection

Under the Law on Personal Data Protection No. 91/2025/QH15, information about a financial account is sensitive personal data. A tax identification number is personal data, and we hold it to the same standard because it travels with the account details. Consent to process them is obtained separately from acceptance of the terms, at the point of collection, expressed in a form that can be printed and reproduced, and recorded in its own row with the time it was given and the SHA-256 fingerprint of the disclosure text displayed. Consent is not a condition of using anything else on UnivMenu; declining it leaves the rest of the service working, though we cannot pay a reward without payout details.

These data are used to make the payment and to meet the withholding and declaration duties attached to it, and for nothing else. They are not used to profile anyone, and they are disclosed only to the payment and banking providers that must see them to move the money, and to a tax authority where the law compels the disclosure.

Withdrawal of consent is effective from the moment we act on it and stops all further processing that rests on it. It does not undo a payment already made and does not erase the accounting record of that payment, which Vietnamese tax law requires us to keep.

Your rights, and how fast we answer

Know and access — what we hold about you, and a copy of it. Correct what is wrong. Delete what the law does not make us keep.
Withdraw a consent, restrict or object to a processing, ask us to stop providing your data to anyone else, and complain or claim damages if the law was broken.
Write to hello@univmenu.com from the address on the account, or tell us enough for us to be sure the account is yours.
We answer every request within 72 hours of receiving it — that is our own undertaking, and we keep to the statutory deadlines as well. Where a request is complex we say within that time what is holding it up and give a date. None of it costs money.
If we refuse a request, in whole or in part, we say which part, why, and what your next step is.

Full detail — how a Vietnamese request is handled

The Law on Personal Data Protection No. 91/2025/QH15 gives a data subject the rights to know, to access, to withdraw consent, to erase, to restrict, to obtain data, to object to processing, to complain, to denounce, to sue and to claim damages. We give effect to each of them, and we do not ask for identity documents beyond what is needed to be certain we are answering the right person.

A request to withdraw consent, to erase or to restrict processing is executed within 72 hours of a verified request — our own undertaking, not the outer limit of the law — save where a legal retention rule overrides it — in which case we name the records affected and how long they must be kept.

Exercising a right never costs money and never worsens the service you receive. A complaint may be made to us at any time and, if we do not put it right, to the competent Vietnamese authority named at the foot of this page.

Taking your data out of Vietnam

QuikForge is a Hong Kong company and the servers that run the portal and host the menus are outside Vietnam. Data you give us is transferred abroad and processed there.
The destination is named, not left vague: your personal data goes to a virtual private server we rent from Hostinger International Ltd. in Kuala Lumpur, Malaysia. That is the machine the portal runs on and the machine the database sits on. Published menu pages, which carry no personal data, are served from Hostinger shared hosting in the United Kingdom.
Consent to that transfer is a condition of registering, and it is taken on a box you tick yourself. The box is empty when the page loads, we never tick it for you, and a registration sent without it is refused — no account exists and nothing about you is stored. This applies to a restaurant owner and to a finder alike.
Using the service means accepting that transfer. If you are not willing for your data to leave Vietnam, we cannot provide the service to you.
The Law on Personal Data Protection requires the party transferring personal data abroad to prepare an impact assessment of that transfer, to keep it available for inspection, and to send a copy to the competent authority within 60 days of the transfer being carried out. Those are the rules this transfer is handled under.

Full detail — cross-border transfer

Personal data collected through UnivMenu is stored and processed on servers outside the territory of Vietnam and is accessible to QUIKFORGE LIMITED in the Hong Kong Special Administrative Region. By creating an account, claiming a menu, subscribing or giving us payout details, you consent to that cross-border transfer, which is necessary for the service to be provided at all.

The Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP require a dossier assessing the impact of transferring personal data abroad, kept available at all times for inspection, with a copy sent to the specialised personal data protection agency within 60 days of the cross-border transfer being carried out. That is the framework this transfer is handled under, and it is why the flow is set out exactly below rather than in general terms.

The transfer this dossier covers is a single, specific flow, and we state it here so that what is assessed and what is published are the same thing. A person in Vietnam opens the portal in a browser; the data they type — email address, password, restaurant name, payout details, the consents they give — travels to portal.univmenu.com, which resolves to a virtual private server rented from Hostinger International Ltd. and physically located in Kuala Lumpur, Malaysia. It is stored there, in a database on that machine, and it is read from there by QUIKFORGE LIMITED in the Hong Kong Special Administrative Region. Consent to that flow is a condition of registration: it is taken on an unticked box at the moment the account is made, it is recorded against the version of these terms the person was shown, and a registration without it is refused rather than accepted and remembered.

The categories of recipient are those set out in the general policy: infrastructure and hosting providers, the provider that delivers an email where one is sent to you, payment and banking providers, and the model providers that read and translate a menu.

There is a second transfer, and it is separate from the one described above. A menu photograph and the dish text read from it are transmitted to OpenRouter, which routes them to the provider operating the vision or language model concerned, and the result is returned to us. That transfer carries the photograph and the menu text and nothing else: no account data, no payout details, no consent or audit record, no guest order and no dietary selection made by a guest is included in it. Both transfers are covered by the assessment this section describes.

How long records stay in Vietnam

Payout details are destroyed three months after an account goes quiet, and the account itself is erased six months after that same point. A scheduled job does both, and a signed-in person can run either immediately from their own account page.
What the law makes us keep — the payments made, the tax withheld and declared, and the minimum identifying detail a tax declaration needs — is kept for ten years, the period the Accounting Law 2015 sets for an accounting document used directly to record the books and the financial statements. Management and operational documents are kept five years. Then they are destroyed too.
They are kept for that purpose alone. They are not used for anything else, and they are not what an erasure reaches. Payment records are append-only: never deleted, never edited.
Where an account has money movements in a tax year whose annual finalisation has not yet passed, erasing the identity waits until that finalisation date — 31 March of the year after — so the full year can still be declared. That is why an erasure can fall later than six months.

Who to complain to

Write to us first: hello@univmenu.com. We would rather fix it than be told to.
If we do not put it right, the competent authority is the Department of Cybersecurity and Hi-tech Crime Prevention and Control (A05) of the Ministry of Public Security, which supervises personal data protection in Vietnam.
Data controller: QUIKFORGE LIMITED, Business Registration No 79555262, Unit 2A, 17/F, Glenealy Tower, No.1 Glenealy, Central, Hong Kong S.A.R. · +370 665 10325.

General privacy policy → · Vietnam terms supplement → · General terms →