Personal Data Protection Policy

1. Who is responsible for your data

The data controller, meaning the person who decides why and how your data is processed, is:

GocFix is run by one engineer. The person deciding how your data is used is the same person who reads and answers your message. In this policy, "I" means the controller named above.

2. What I collect

When you send the contact form:

When you send the form, your IP address is held in the server's memory for about 10 minutes to stop spam, then removed. It isn't written anywhere and isn't sent with your message.

When you contact me directly by email, Zalo or phone, I receive whatever you choose to send, along with your display name and phone number or email address.

I don't ask for sensitive personal data (health, financial, biometric, location…). Please don't send it, or any passwords or API keys, through the form.

3. What I use it for

• Replying to your enquiry.
• Discussing scope, quoting, and carrying out a Health Check if you go ahead.
• Keeping a record of our conversation so we can pick it up again later.
• Preventing spam and protecting the website.
• Counting page views to see which content is useful (only if you accept cookies).

I don't use your data for advertising, or for any other purpose without asking you first.

4. Your consent

I only receive and process what's in the form once you tick the consent box. The box is never pre-ticked, and the form can't be sent without it.

When you send it, the consent wording you saw, the time, the language and the version of this policy are stored with your message as proof of consent.

If we later sign a contract, processing needed for that contract follows what the contract says.

5. Cookies and browser storage

The site uses no advertising cookies. The only third-party tool is Google Analytics, and it is switched on only if you click Accept. Google then receives the pages you view, the time, your device and browser type, an approximate location derived from your IP address, and a random identifier stored in a cookie. What you type in the form is never sent to Google Analytics. Google Analytics advertising features are off. Fonts are served from the site's own server. What gets stored in your browser:

You can change your choice at any time with "Cookie settings" at the bottom of the page.

6. Who receives your data

I don't sell, rent or trade your data. To receive and store messages I use a few technical services, which process the data only on my instructions:

Beyond that, data is only disclosed to competent state authorities when the law requires it.

7. Where data is stored and transfers abroad

Some of the services above (Vultr (máy chủ / server hosting), Cloudflare, Google (Gmail), Google Analytics (Google LLC)) store or process data outside Vietnam, so your data may be transferred abroad. I do this in line with the cross-border transfer rules of the Personal Data Protection Law.

The main copy of the data is stored at: A server rented from Vultr, located in Singapore.

8. How long I keep it

Messages sent through the form are stored in a database on the server that runs this website. If no work follows, the system deletes your message and contact details automatically after 12 months.

If we work together, data is kept for the length of the contract and for as long as the law requires for accounting and tax records. After that it is deleted in a way that can't be recovered.

When data is deleted, it is overwritten in the database so it can't be recovered. The database is backed up daily on the same server, and each backup deletes itself after 14 days. Deleted data can therefore remain in older backups for up to 14 days, and is used for nothing except restoring after an incident.

You can ask me to delete it sooner at any time.

9. How I protect it

• The website runs over an encrypted connection (HTTPS).
• Only I can access the messages and contact details you send.
• The accounts used to receive and store messages have two-factor authentication turned on.
• Passwords and access keys to your systems (if we work together) are only accepted through a secure channel, never through the form.

If data is ever exposed or lost, I notify the authority responsible for personal data protection within 72 hours of finding out, and tell you if it could affect you.

10. Your rights

Under the Personal Data Protection Law, you have the right to:

• Know how your data is processed.
• Give, refuse or withdraw consent.
• See and correct your data, or ask for it to be corrected.
• Ask for your data to be deleted, or for processing to be restricted, or object to it.
• Complain, report, take legal action and claim compensation as provided by law.
• Ask for measures to protect your personal data.

To use any of these rights, send a request by email or through the contact details at the end of this page. I may ask a question or two to confirm the data is yours. I reply within 2 working days of receiving the request and complete it within the time limits set by law.

Every request is logged as proof that it was handled. The log holds only the time, the type of request, the message's sequence number and the reason, never your name, email, phone number or what you wrote. If you ask for deletion, only that log line remains.

Withdrawing consent doesn't affect processing that happened before.

11. Children's data

This site is meant for businesses, not children. I don't knowingly collect children's data. If I find I've received a child's data without the consent the law requires, I'll delete it straight away.

12. Changes to this policy

When the policy changes, I update this page, raise the version number and note the date it applies from. If a change affects data you've already sent, I'll let you know through the contact details you left.

13. Contact about personal data

For any question or request about your personal data, contact: