Baby Boss respects privacy and processes personal data only where necessary, transparently, for stated purposes and with appropriate safeguards. This policy forms part of the transaction terms on babyboss.vn.
1. Scope and data-processing roles
This policy applies when an individual visits the website, searches, places or pays for an order, looks up an order, sends a contact, consultation, partnership or job-application form, subscribes to news, or contacts an official Baby Boss support channel.
Baby Boss determines the purposes and means of processing for activities it directly manages. Delivery, payment, hosting and other relevant providers process data according to their actual roles, agreements and applicable law.
2. Categories of data collected
- Identity and contact data: name, phone number, email, delivery or collection address, business name, tax number and invoice details supplied by the customer.
- Order and transaction data: products, pack sizes, quantities, values, promotions, delivery fees, payment method and status, transaction references, delivery status, notes, support history and related evidence.
- Consultation and partnership data: distribution, agency, franchise, OEM/ODM, Gelato setup or event-service needs, area, scale and documents voluntarily supplied by the sender.
- Technical data: IP address, device and browser type, access time, pages viewed, cookies, security logs, error logs and necessary measurement data.
- Application data: CV, experience, contact details and documents voluntarily supplied by a candidate.
- Limited payment data: amount, reference, status and payment method. Baby Boss does not request or directly store online-banking passwords, OTPs, PINs, CVVs or full card data.
3. Collection methods
- Entered or supplied directly by an individual through the website, hotline, email, official Zalo account or documents sent to Baby Boss.
- Recorded automatically when functions are accessed or used, within the disclosed scope of cookies and technical logs.
- Returned by an actual payment provider, delivery provider or operational partner to confirm or reconcile a transaction, make a delivery, issue a refund or resolve an incident.
- Obtained from public or other lawful sources where needed to verify a business or partner and supported by a suitable legal basis.
4. Processing purposes
- To display, receive, verify, process and fulfil orders; handle payment, delivery, order lookup, invoices and after-sales service.
- To receive and handle consultation or partnership enquiries, feedback, complaints, returns, refunds and data-rights requests.
- To prevent fraud, protect accounts and transactions, maintain security, back up data, resolve errors and improve the website.
- To meet accounting, tax, record-keeping and audit duties, protect lawful interests and comply with competent authorities.
- To send news, offers or surveys where the recipient has subscribed or another lawful basis applies; the recipient may opt out at any time.
- To assess applications and manage recruitment.
5. Legal basis and consent
Data is processed on the basis of consent and/or another lawful basis, including performing a transaction requested by a customer, meeting a legal obligation, protecting lawful interests, responding to a safety incident or another case permitted by law. Where consent is required, Baby Boss provides the necessary information before requesting it and records the user's choice.
Withdrawing consent does not affect the lawfulness of processing already carried out and may mean that a function requiring the data can no longer be provided.
6. Recipients
Baby Boss does not sell personal data. Data is shared only where necessary with:
- Delivery providers, collection points or delivery personnel involved in fulfilling an order.
- A bank or actual payment provider involved in a valid transaction for processing, reconciliation or refund; data is not automatically shared with a payment gateway that has not been activated.
- Infrastructure, hosting, security, email, call-centre, analytics, electronic-invoice, accounting and technical-support providers.
- Legal advisers, auditors, insurers or partners directly involved in handling a request.
- A competent state authority or another party where the law requires or permits it.
A recipient must use the data only for its assigned purpose, apply appropriate security and delete or return it when it is no longer needed, except for data that must be retained by law.
7. Overseas data transfers
Some infrastructure or software providers may operate systems outside Vietnam. Where personal data is transferred overseas, Baby Boss completes the required records, assessment, notification and protective measures under the law in force.
8. Retention
| Data category | Expected retention period |
|---|---|
| Orders, payments, invoices and reconciliation | For the transaction and the required accounting and tax retention period; normally up to 10 years unless the law requires otherwise. |
| Complaints, returns and refunds | Up to 3 years after the matter closes, or longer where needed to protect rights, resolve a dispute or comply with law. |
| Consultation and partnership enquiries | Up to 24 months after the last interaction, unless the parties are still transacting or the sender makes a valid deletion request. |
| Marketing | Until opt-out; minimum suppression data may be kept for up to 24 months to prevent further messages. |
| Recruitment records | Up to 24 months, unless the candidate requests earlier deletion or the law requires otherwise. |
| Technical and security logs | Normally up to 12 months; longer where an incident or fraud investigation is ongoing or the law requires it. |
When the period or purpose ends, data is deleted, destroyed, anonymised or restricted, except for data that must continue to be retained by law.
9. Safeguards
- Role-based access controls, authentication and periodic access reviews.
- Appropriate encryption or secure transmission, logging, backups, error monitoring and incident response.
- Confidentiality obligations for staff and providers, with restrictions on unauthorised copying, disclosure or downloading.
- Processes to receive, assess, remediate and notify or report incidents where required by law.
10. Data-subject rights and how to exercise them
- To be informed, access, view, receive a copy of, correct or update data to the extent permitted by law.
- To withdraw consent, object to marketing, or request deletion or restriction where grounds exist.
- To complain, report a violation, seek compensation and exercise other rights under law.
- Send a request to bod@babyboss.com.vn, call 1900 99 88 80 or use https://babyboss.vn/en/policies/ho-tro-truc-tuyen. State your name, contact details, the request or right being exercised and the relevant data or transaction.
- Baby Boss acknowledges receipt within 3 working days and may request the minimum information needed to verify identity and prevent disclosure to an unauthorised person.
- A valid request is handled within 30 days after sufficient information is received. If the matter is complex or another period applies by law, Baby Boss explains why and provides an expected timeline.
- The result is sent through a verified channel. A request may be limited where data must be kept to meet a legal obligation, resolve a dispute or protect lawful interests.
11. Cookies and similar technologies
The website may use cookies necessary for sessions, security, the cart and user choices. Analytics or marketing cookies are used only under the applicable notice, choice mechanism or lawful basis. A user may adjust browser or cookie-management settings; some functions may not work fully if necessary cookies are blocked.
12. Children's data
The website is not intended for children to enter transactions on their own. A minor or person with limited capacity must involve a parent, guardian or legal representative as required by law.
Complaints are handled under the process at https://babyboss.vn/en/policies/giai-quyet-khieu-nai. Official contact details are published at the end of this page.
Complaints are handled under the process at https://babyboss.vn/en/policies/giai-quyet-khieu-nai. Contact: BABY BOSS INVESTMENT JOINT STOCK COMPANY — bod@babyboss.com.vn — 1900 99 88 80 — Floor 14, HM Town Building, 412 Nguyen Thi Minh Khai Street, Ban Co Ward, Ho Chi Minh City, Vietnam.
Security notice: Baby Boss does not ask customers to provide passwords, OTPs, PINs, CVVs or full card numbers by email, chat or phone. Users should not send this data through any support channel.
Effect, changes and dispute resolution
These terms are governed by Vietnamese law. Baby Boss may update them when its functions or the law changes; a new version must be dated, made easy to access and must not remove rights already arising from an earlier transaction. Disputes are first addressed through negotiation and may then be resolved through mediation, arbitration, the courts or another competent authority.