Privacy Policy
1. Scope and responsibility
This policy explains data processing connected with irontan.com, operated by Công ty TNHH Irontan Việt Nam. Irontan is responsible for processing whose purposes and means it determines. This policy does not replace a separate notice on a brand website or for a particular transaction.
You can contact Irontan through this website's contact page. You do not need an account or provide your name, telephone number or identity documents to read its content. It also has no payment, job-application or newsletter-registration function.
2. Data and purposes
We do not use access data from this website to sell personal data, serve behavioural advertising or make solely automated decisions with legal or similarly significant effects. We do not automatically combine data from brand websites to create personal profiles.
- Technical access data: infrastructure may process IP addresses, request times and paths, browser/device information, response status and security signals to deliver pages, diagnose faults and prevent harmful access.
- Information you choose to send through a contact channel: contact details, correspondence and documents needed to respond, handle a concern or fulfil a data request. Do not send passwords, payment-card details, health records or identity-document copies without a clear explanation of why they are needed and how to send them safely.
- Request verification: information limited to what is needed to identify a requester or authorised representative and avoid disclosing data to the wrong person.
3. Grounds for processing and your choices
Each processing activity must have a defined purpose and an appropriate basis under applicable law. Where consent is required, we must provide information and obtain clear, purpose-specific consent before processing. Silence or continued browsing is not consent to every processing activity.
Processing without consent is permitted only where the relevant legal conditions are met, for example to perform contractual obligations or meet an applicable legal requirement. A general business need is not a default exemption from consent.
You may withdraw consent for processing based on that consent. Withdrawal does not invalidate earlier lawful processing. We will explain the consequences and any legal grounds requiring continued retention, where relevant.
5. Providers and disclosures
The website uses Cloudflare Pages for hosting and content delivery. During access, connection data may be processed by Cloudflare and relevant subprocessors to provide infrastructure, content delivery and security. The contact form uses Cloudflare Turnstile for spam checks before Resend delivers messages to Irontan. Related services may process information needed to deliver messages or prevent abuse. Processing independently determined by a provider is described in its own policy; linking to it does not replace Irontan’s responsibilities.
Data is disclosed only to people handling the relevant request, necessary service providers within their assigned scope, or authorities/recipients with a valid legal basis. We do not publish concerns you send us or pass data to another brand simply because you read its profile.
6. Processing outside Vietnam
Global delivery infrastructure may process data in Vietnam and other countries. This website does not promise that all data stays in Vietnam. Using an overseas provider does not automatically remove data-protection obligations.
Before a regulated transfer, Irontan must identify the transfer grounds, recipient, safeguards and applicable documentation obligations. Where EU or UK law applies, its international-transfer requirements must also be satisfied. Reading this policy is not blanket consent to every transfer.
7. Retention
Data is retained only for the notified purpose or a legally required period. The criteria include the time needed to resolve a request, evidence of rights and obligations being fulfilled, and lawful preservation for a dispute. When the purpose ends and no retention ground remains, data must be deleted or appropriately de-identified.
Provider-managed logs depend on the actual service and configuration. Irontan is responsible for determining suitable periods and settings and coordinating with providers within its role; outsourcing does not remove applicable retention and deletion duties. You may request the retention period or criteria applicable to your data.
8. Your rights and how to exercise them
Subject to applicable law, you may be informed; consent, refuse or withdraw consent; access, request a copy of and correct data; request deletion or restriction, or object to processing; request protective measures; complain, report violations, bring proceedings and seek compensation.
Use the privacy contact at the end of this page and state the right you wish to exercise, with the minimum information needed to identify the relevant activity. An authorised representative may act for you. Identity documents are not required for every request; if further verification is needed, we will explain why and limit the information requested.
Applicable legal deadlines govern requests. Article 5 of Vietnam’s Decree 356/2025/ND-CP requires a response within two working days for its specified categories of requests; completion periods depend on the right, processor involvement and any permitted extension. If a request cannot be fully fulfilled, we must explain the grounds and scope. Verification must not obstruct lawful rights.
You do not have to wait for discussions with Irontan to finish before contacting a competent authority.
9. Security and incidents
Data protection requires access controls, protected communications and technical and organisational measures appropriate to risk. No online system can guarantee absolute security. If an incident is discovered, we must assess and limit its effects and fulfil applicable notification and remediation duties. This section does not exclude Irontan’s liability.
10. Children’s data
This company-information website is not designed to collect children’s profiles. If a request concerns a child’s data, we must check authority to act and consent requirements according to age, purpose and applicable law. A representative may contact us to review or address information supplied inappropriately.
11. Visitors in other jurisdictions
Mandatory rights under the law applicable to you remain protected. Where the EU GDPR or UK GDPR actually applies to the relevant activity, additional rights may include data portability, objection to legitimate-interest processing, protection against solely automated decisions and complaints to a competent supervisory authority, subject to statutory conditions.
12. Policy updates
We show the update date at the top and publish revisions here. Material changes to purposes, data categories or recipients require appropriate notice and new consent where required. An update does not retrospectively legitimise improper processing.
Legal and privacy contact
Send website concerns or personal-data requests through the contact form. If your request concerns personal data, please say so in your message.
Include only information necessary for your request. Sending the form does not subscribe you to advertising or authorise unrelated uses of your information.