Privacy Policy - HAHTech

1. Data Controller & Processor Information

We acts as both the Data Controller and Data Processor for personal data collected through the Application. We are committed to protecting your personal privacy and maintaining transparent data handling practices.

2. Categories of Personal Data Collected

We collect and store the following types of personal data:

• Basic Personal Data: Full name, email address, phone number, profile picture, gender, age, nationality, postal address, account credentials, and display preferences.
• Application Data: Calendar schedules, event titles, event details, timestamps, and lists of invited participants.
• Technical & System Data: IP address, device model, browser information, operating system version, application crash logs, and time zone settings.

3. Purposes of Data Processing

We process your personal data strictly for the following legitimate purposes:

1. Authenticating user identity, securing account access, and preventing fraudulent activities.
2. Sending critical service notifications, system updates, and responding to customer support inquiries.
3. Improving system performance, troubleshooting software errors, and optimizing user experience through anonymized analytics.
4. Providing core calendar management, scheduling, push notifications, and event sharing functionalities.

4. Cookies & Tracking Technologies

We use essential cookies and similar local storage technologies (such as session storage and tokens) to:

• Authenticate your identity and keep you logged in.
• Remember your security preferences and user settings.
• Ensure the security and performance of our Application.

You can manage or disable cookies through your browser or device settings, though doing so may limit your ability to use certain features of the Service.

5. Legal Basis & Consent Management

• Consent Requirement: By accepting this policy during registration, you provide explicit consent for us to process your data for the core operational purposes outlined herein.
• Granular & Optional Consent: Non-essential processing activities (such as marketing emails, location access, or contact list sync) require separate, unbundled consent, which you will be able to toggle on or off at any time when those activities are available.
• Log Retention: We maintain electronic logs recording your consent actions (timestamp, user ID, policy version) as proof of legal compliance.

6. Third-Party Data Sharing & Sub-processors

We do not sell, rent, or trade your personal data. We share data only under the following limited circumstances:

• Authorized Sub-processors: We utilize trusted cloud infrastructure and service providers bound by strict data protection agreements.
• Legal Obligations: We may disclose data when required by written orders from authorized state agencies or police enforcement under applicable laws.
• With Other Users: Information contained in shared events (e.g., event title, event details...) is visible only to users you explicitly invite.

7. Data Security & Retention Period

• Security Measures: We employ end-to-end transport encryption (HTTPS/TLS), and store sensitive and personally identifiable information (including full name, email address, phone number, postal address...) by advanced encryption methods (AES-256). Password is hashed before being stored in our database. Access is strictly controlled via Role-Based Access Controls (RBAC).
• Retention: Personal data is retained for as long as your account remains active. Upon account deletion, personal data is permanently deleted or anonymized within 7 working days, except where law requires longer retention.

8. Data Subject Rights & How to Exercise Them

Under Decree 13/2023/ND-CP, you hold the following statutory rights regarding your personal data:

• Right to Know & Access: View your profile and exported data via account settings.
• Right to Rectify: Update or correct inaccurate personal information directly in the App.
• Right to Withdraw Consent: Revoke optional permissions (location, push notifications) in device settings.
• Right to Erasure (Account Deletion): Execute instant account deletion via the in-app feature or by emailing support@hahtech.online.
• Right to Object & Restrict Processing: Request restrictions on specific processing activities.

9. Language versions of the Policy

Our Privacy Policy have different language versions, you can check the Vietnamese version here. In case different language versions lead to different understandings, the version that you agree when signing up shall be applied.