LEGAL
Privacy Policy
Version 1.0 · Issued on 29 August 2026 · Applies to the website https://phamdolaw.com and the legal services of Pham Do Law and Accounting Company Limited (Công ty TNHH Luật và Kế toán Phạm Đỗ).
Pham Do Law and Accounting Company Limited (Công ty TNHH Luật và Kế toán Phạm Đỗ, “Pham Do Law”, “we” or “us”) respects your privacy and is committed to protecting the personal data of our clients, website visitors and the individuals involved in the matters we handle. This Policy explains what data we collect and why, how we process and protect it, who we share it with, how long we keep it and what rights you have. Please read it carefully before you provide personal data to us.
This English version is a translation of the Vietnamese Privacy Policy (Chính sách bảo mật thông tin), which you can open with the VI language switch at the top of the page. If the two versions differ, the Vietnamese version prevails.
1. Scope
This Policy applies to the processing of personal data of:
- visitors to the website https://phamdolaw.com;
- clients and prospective clients who contact us through our forms, by email, by phone, on Zalo or in person;
- individuals connected with a client’s matter (legal representatives, members, shareholders, employees, business partners) whose data the client provides to us so that we can perform our services.
When you provide us with another person’s personal data, you confirm that you collected it lawfully and that you have that person’s consent or another legal basis for providing it.
2. Legal basis
- Law on Personal Data Protection No. 91/2025/QH15 of 26 June 2025, in force from 1 January 2026;
- Decree No. 356/2025/ND-CP of 31 December 2025 of the Government, detailing certain articles of and measures to implement the Law on Personal Data Protection, in force from 1 January 2026 (replacing Decree No. 13/2023/ND-CP);
- Law on Cybersecurity No. 24/2018/QH14;
- Law on Network Information Security No. 86/2015/QH13;
- Law on Lawyers No. 65/2006/QH11 (as amended in 2012), including the duty to keep information about cases, matters and clients confidential;
- Law on Protection of Consumers’ Rights No. 19/2023/QH15, for clients who are consumers.
3. Definitions
- Personal data: information in the form of symbols, letters, numbers, images, sounds or similar forms in an electronic environment that is associated with, or helps identify, a specific person. It includes basic personal data and sensitive personal data.
- Processing of personal data: one or more operations on personal data, such as collection, recording, analysis, confirmation, storage, editing, disclosure, combination, access, retrieval, recall, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion and destruction.
- Data subject: the individual to whom the personal data relates.
- Data controller: Pham Do Law, which decides the purposes and means of processing personal data under this Policy. In some matters, we also act as a data processor on the client’s instructions.
4. Data controller and contact point
Pham Do Law and Accounting Company Limited (Công ty TNHH Luật và Kế toán Phạm Đỗ)
Address: Room 402, Floor 3, 296 Nguyen Van Dau Street, Binh Loi Trung Ward, Ho Chi Minh City, Vietnam
Phone: +84 972 599 340 · Email: info@phamdolaw.com
Personal data protection contact: the personal data protection unit of Pham Do Law and Accounting Company Limited, by email to info@phamdolaw.com (subject line “Personal data”).
5. Principles of processing
We process personal data according to these principles:
- Lawfulness: we process data only with your consent or on another legal basis provided by law.
- Transparency: you are clearly informed about the processing before it takes place.
- Purpose limitation: we process data only for the purposes stated in this Policy.
- Data minimisation: we collect only the data needed for those purposes.
- Accuracy: data is updated and completed when necessary.
- Security: protective measures apply throughout the processing.
- Storage limitation: data is kept only for as long as its purpose requires, unless the law provides otherwise.
- Accountability: we are responsible for demonstrating compliance with these principles.
6. Personal data we collect and how we collect it
| Category | Content | How it is collected |
|---|---|---|
| Contact data | Full name, phone number, email, company name, position, the content of your enquiry | Contact and booking forms on the website, email, phone, Zalo, in-person meetings |
| Matter data | Information about the company, legal representative, members, shareholders and employees; investment project; identity documents and legal files you give us to perform the services | Provided by you under the legal services contract; obtained from state authorities under your authorisation |
| Website visit data | IP address, browser and device type, pages viewed, time of visit, referral source | Automatically, through the cookies and analytics tools listed in section 9 |
| Interaction data | Comments on articles, newsletter sign-ups, feedback on our services | Provided by you |
We do not actively collect sensitive personal data through the website. Where a matter requires the processing of sensitive data (for example, health information in an application for a medical practice licence), we process it only to the extent the matter requires, after informing you.
7. Purposes and legal bases of processing
| Purpose | Legal basis |
|---|---|
| Receiving your enquiry, giving initial advice, sending a quotation and contacting you | Your consent when you send the enquiry |
| Performing legal services under the contract: preparing dossiers, filing with and representing you before state authorities, advising, litigating | Performance of the contract with you |
| Conflict-of-interest checks, risk management and internal control of a law practice | Obligations under the law on lawyers |
| Accounting, invoicing, tax declarations and record keeping as required | Legal obligation |
| Sending legal newsletters and information about new services | Your consent when you subscribe, which you may withdraw at any time |
| Operating, securing, protecting against spam and improving the website | Our legitimate interest in keeping the website safe |
| Responding to requests from competent state authorities | Legal obligation |
8. How data is processed
Data is processed manually (preparing, drafting and filing documents) and automatically (client management software, email, storage systems). We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects for you.
9. Cookies and third-party tools on the website
| Tool | Purpose | Data involved | How to opt out |
|---|---|---|---|
| WordPress technical cookies and caching | Running the website, remembering login sessions and comments | Session cookies, display preferences | Cannot be switched off, as the website needs them to work |
| Google Analytics | Aggregated statistics on visits, pages viewed and traffic sources | IP address (anonymised), cookie identifier, browsing behaviour | Block cookies in your browser settings, or use the Google Analytics opt-out browser add-on |
| Google Fonts | Displaying fonts | IP address sent to Google servers when the fonts load | Not applicable |
| Zalo | Quick contact button | Processed only when you click the button; your conversation is subject to Zalo’s own policy | Do not click the Zalo button |
| Gravatar (Automattic) | Displaying a profile picture when you comment | An anonymised hash of your email address | Do not comment, or do not use a Gravatar account |
We do not use advertising cookies or cross-site tracking. You can delete or block cookies in your browser settings; if you block technical cookies, some features of the website may not work fully. Before we add a new tool that collects personal data, we will update the table above.
10. Sharing and disclosure of personal data
We do not sell, rent or trade your personal data. Data is shared only in the following cases and only to the extent necessary:
- Competent state authorities, when we carry out procedures under your authorisation: business registration authorities, investment registration authorities, sector licensing authorities, tax authorities, intellectual property authorities, courts and arbitration bodies;
- Partners involved in the matter, as the dossier requires: notary offices, certified translators, bailiffs, associate lawyers, tax agents; each of them is bound by corresponding confidentiality obligations;
- Technical service providers: website hosting, email, cloud storage and analytics tools, only for operating our services and under confidentiality commitments;
- Where required by law or by a decision of a competent authority;
- Other cases, with your consent.
Where data is processed and transfers outside Vietnam. Our website and database are hosted on servers located in Vietnam. Our email system and some of the tools listed in section 9 are operated by foreign providers, so contact data exchanged by email may be processed on servers outside Vietnam. These providers are bound by confidentiality obligations under their terms of service, and transfers are made in accordance with the rules on transferring personal data abroad under the Law on Personal Data Protection and Decree No. 356/2025/ND-CP. If you are a foreign investor, exchanging documents between you and us necessarily involves cross-border data transfers at your own request.
11. Retention periods
| Type of data | Retention period |
|---|---|
| Enquiries that did not lead to a contract | Up to 24 months from the last contact, then deleted |
| Matter files and client data under a contract | For the term of the contract and afterwards for the retention periods required by law: at least 10 years for accounting and tax documents under the Law on Accounting; matter files are kept to meet our professional obligations and to handle complaints and disputes within the statutory limitation periods |
| Newsletter subscription data | Until you unsubscribe |
| Website analytics data | For the default retention period of the analytics tool, in aggregated form |
When the retention period ends, data is deleted or destroyed so that it cannot be recovered, unless the law requires longer retention or the data is needed for an ongoing dispute.
12. How we protect data
- Technical measures: HTTPS across the whole website, role-based access rights, strong passwords and authentication for administrator accounts, regular backups, software updates and a server firewall.
- Organisational measures: only the lawyers and staff working directly on a matter can access its files; staff sign confidentiality undertakings; paper files are kept in controlled areas.
- Professional duty: our lawyers must keep information about cases, matters and clients confidential under the Law on Lawyers and the Code of Professional Ethics and Conduct for Vietnamese Lawyers, including after the matter ends.
13. Your rights as a data subject
Under the law on personal data protection, you have the following rights:
- The right to be informed about the processing of your data;
- The right to consent or refuse consent to processing;
- The right of access, to view and correct your data or ask us to correct it;
- The right to withdraw consent;
- The right to erasure, to delete your data or ask us to delete it;
- The right to restrict processing;
- The right to obtain your data;
- The right to object to processing, to prevent or limit its disclosure or use for advertising and marketing;
- The right to complain, denounce and sue;
- The right to claim compensation for damage caused by a violation;
- The right to self-protection under civil law and other relevant laws.
How to exercise your rights: send your request to info@phamdolaw.com, or in writing to the address in section 4, stating your full name, verification details and what you are asking for. We may ask you to verify your identity so that data is not disclosed to anyone without the right to it. We handle requests within the time limits set by the law on personal data protection and free of charge, except where the law allows a fee for repeated or excessive requests.
Some rights may be limited where processing is required by law (for example, keeping accounting records) or where the data is needed to establish, exercise or defend legal rights and interests in a dispute.
14. Withdrawing consent and unsubscribing from newsletters
You can withdraw your consent at any time by emailing info@phamdolaw.com or clicking the “unsubscribe” link at the end of each newsletter. Withdrawal does not affect the lawfulness of processing carried out before it, or processing that we must carry out under a contract or the law.
15. Personal data incidents
If we detect a breach of personal data protection rules (loss, leakage or unauthorised access), we will contain and remedy it immediately. We will notify the specialised personal data protection authority (the Department of Cyber Security and High-Tech Crime Prevention, Ministry of Public Security) and you within 72 hours of detection where sensitive personal data is exposed or lost, and within the time limits set by law in other cases. The notice will state the scope of the incident, the measures taken and what you should do.
16. Children’s personal data
Our website and services are aimed at businesses and investors. We do not actively collect data from people under 16. Where a client’s matter involves children’s data (for example, a dossier to set up an educational institution that includes a list of pupils), we process it only with the consent of a parent or guardian as required by law.
17. Links to third-party websites
The website links to legal texts, public service portals and third-party pages for your reference. Those sites have their own policies and are outside the scope of this Policy. We are not responsible for how those websites collect and use data.
18. Your responsibilities
- Provide accurate and complete data and update it when it changes;
- Ensure you are entitled to provide us with third parties’ personal data (section 1);
- Keep your account details and password (if any) secure when using the website;
- Comply with this Policy and our Terms of Use.
19. Changes to this Policy
We may update this Policy when the law, technology or our activities change. Updates are posted on this page with a version number and issue date; we will announce material changes on the website or by email to clients with an ongoing contract. If you continue to use the website and our services after an update, you are deemed to be aware of the new content.
20. Contact and complaints
For any question, request to exercise your rights or complaint about the processing of your personal data, please contact:
Pham Do Law and Accounting Company Limited · Room 402, Floor 3, 296 Nguyen Van Dau Street, Binh Loi Trung Ward, Ho Chi Minh City, Vietnam · Phone +84 972 599 340 · Email info@phamdolaw.com
We will respond within the time limits set by law. If you are not satisfied with how we handle your request, you may complain to the specialised personal data protection authority, the Department of Cyber Security and High-Tech Crime Prevention (A05), Ministry of Public Security, or bring a claim before the competent court in accordance with the law.