PRIVACY POLICY

Last updated: February 24, 2026

1. DANAHOST'S DATA PROCESSING ROLE

In Short: Danahost plays two different roles depending on the type of data being processed.

Danahost is a SaaS (Software as a Service) platform providing property management solutions. In our operations, we play two distinct roles:

a) Data Controller

Danahost acts as the Data Controller for the personal information of platform users (property owners, management staff). We determine the purposes and means of processing this data, which includes: account information, service usage data, contact information, and payment details.

b) Data Processor

Danahost acts as the Data Processor for the personal information of guests that users enter into the system. In this case:

• The property owner (Danahost user) is the Data Controller, responsible for ensuring the lawfulness of collecting and using guest data.
• Danahost only processes guest data according to the property owner's instructions and for the purpose of providing the Services.
• Guest data may include: full name, email, phone number, national ID/passport number, and related booking information.

2. WHAT INFORMATION DO WE COLLECT?

In Short: We collect information you provide directly and some information collected automatically when you use the Services.

a) Information You Provide Directly

When you register an account, use the Services, or contact us, you may provide:

b) Guest Data

When you use Danahost to manage your property, you may enter customer data into the system, including:

• Guest full name
• Email address and phone number
• National ID or passport number
• Booking information (check-in/check-out dates, room type, special requests)

c) Automatically Collected Information

When you access the Services, we automatically collect certain technical information:

Regarding location data: We do not collect precise location (GPS). We only use IP addresses to determine estimated location (country/city) for the purpose of displaying the appropriate language and detecting unusual access.

d) Sensitive Information

We do not directly collect or request sensitive personal information from platform users (such as biometric data, religious beliefs, or sexual orientation). However, guest national ID/passport data entered by property owners falls under the sensitive data category and is processed with enhanced protection measures (see Section 10).

e) Information from Third Parties

We may receive booking information from OTA (Online Travel Agency) channels via Channex, including customer information synced from Booking.com, Airbnb, and similar platforms. This data is processed according to the property owner's instructions and the policies of each OTA.

All information you provide must be truthful, complete, and accurate. You are responsible for notifying us of any changes.

3. LEGAL BASIS AND PROCESSING PURPOSES

In Short: We only process data when there is a valid legal basis under Decree 13/2023/ND-CP.

The table below details each processing purpose, the data types involved, and the corresponding legal basis:

4. SHARING INFORMATION WITH THIRD PARTIES

In Short: We only share data with third parties necessary to operate the Services and always ensure appropriate safeguards are in place.

We do not sell your personal information. We may share data with the following third parties to the extent necessary:

Additionally, we may share data in the following situations:

• Legal requests: When required by a competent state authority under Vietnamese law.
• Business transfers: In the event of a merger, acquisition, or sale of assets, data may be transferred to the acquiring party. We will notify you before data is transferred and becomes subject to a different privacy policy.
• With your consent: When you explicitly authorize sharing with a specific party.

All third parties must commit to keeping information confidential through appropriate contracts or data processing agreements.

5. CROSS-BORDER DATA TRANSFER

In Short: Some data may be processed abroad. We ensure appropriate safeguards in accordance with Decree 13/2023/ND-CP.

Your core data is stored on servers located in Vietnam. However, some data may be transferred and processed abroad when you use features involving third parties:

Under Article 25 of Decree 13/2023/ND-CP, when transferring personal data internationally, we ensure:

• The data recipient commits to protecting personal data at a level equivalent to or higher than Vietnamese law;
• Binding contracts or agreements on data processing and protection are in place;
• Impact assessments are conducted for transfers involving sensitive data;
• Data subjects are notified and consent is obtained when required by law.

6. COOKIES AND TRACKING TECHNOLOGIES

In Short: We use essential cookies to operate the Services. Analytics and advertising cookies are only activated with your consent.

We categorize cookies into the following groups:

How to manage cookies:

• On your first visit, a cookie banner will appear allowing you to accept or reject each type of cookie.
• You can change your cookie preferences at any time in the cookie settings on our website.
• You can also configure your browser to block or delete cookies. Note that blocking essential cookies may affect Service functionality.

Google Analytics: We use Google Analytics with the IP anonymization feature. Google Analytics is only activated after you consent to analytics cookies. To opt out of Google Analytics, you can:

• Decline in our cookie banner;
• Install the Google Analytics Opt-out Browser Add-on;
• Adjust your Google Ads Settings.

Full details are provided in our Cookie Policy.

7. ARTIFICIAL INTELLIGENCE (AI) PRODUCTS

In Short: Some features use AI through third-party providers. You have the right to opt out of these features.

Danahost integrates features powered by artificial intelligence ("AI Features") through third-party service providers, including OpenAI and Google Cloud AI.

a) AI Features

Our AI Features may include: booking data analysis, room rate suggestions, automated support, and business analytics tools.

b) Data Processed by AI

When you use AI Features, input and output data will be sent to and processed by the AI provider. We commit to the following:

• Not used to train AI models: Your data is not used to train or improve the provider's AI models. We use commercial APIs with commitments not to use customer data for training purposes.
• Temporary retention: AI providers may retain input/output data for a short period (typically up to 30 days) for abuse detection purposes, after which it is automatically deleted.
• Encryption: Data is transmitted to the AI provider over an encrypted channel (TLS 1.2+).

c) Right to Opt Out

You have the right to opt out of AI Features by:

• Disabling AI features in your account settings;
• Contacting us at [email protected].

Opting out will not affect other basic functionalities of the Services.

8. SOCIAL MEDIA LOGINS

In Short: If you log in using a social media account, we receive certain information from that provider.

The Services allow you to register and log in using your social media account (Facebook, Google, etc.). When you choose this option, we receive:

• First and last name;
• Email address;
• Profile picture;
• Other information you have set to public on the social media platform.

We only use this information to create and manage your Danahost account. We do not control and are not responsible for how social media providers process your data. Please review their privacy policies.

9. DATA RETENTION PERIOD

In Short: We retain data for the period necessary for each specific purpose.

We apply the following data retention periods:

Upon expiration of the retention period or when there is no longer a lawful processing purpose, we will delete or anonymize the data. If data is stored in backups, we will isolate it and delete it when the backup expires (maximum 90 days).

10. SECURITY MEASURES

In Short: We apply various technical and organizational measures to protect your data.

We implement security measures appropriate to industry standards and in accordance with Article 26 of Decree 13/2023/ND-CP, including:

Technical Measures

• Transit encryption: All data transmitted over the Internet is encrypted using TLS 1.2 or higher (HTTPS).
• Storage encryption: Sensitive data (passwords, national ID/passport data) is encrypted at rest.
• Passwords: Passwords are hashed using one-way algorithms; we do not store passwords in plain text.
• Access control: We apply Role-Based Access Control (RBAC); only authorized personnel have access to personal data.
• Monitoring: Audit logging systems are in place to detect and investigate abnormal access.
• Backups: Data is regularly backed up and stored securely.

Organizational Measures

• Staff training on security and personal data protection;
• Restricting access to personal data on a need-to-know basis;
• Periodic reviews of security measures and updates as required.

While we make every effort to protect your data using industry-standard security measures, no method of transmission over the Internet or electronic storage is completely secure. We commit to continuously improving our security measures to protect your information.

11. DATA BREACH NOTIFICATION

In Short: We commit to providing timely notification in the event of a data breach affecting you.

In the event of a data security breach, we commit to:

• Notifying authorities: Informing the Ministry of Public Security (Department of Cyber Security) within 72 hours of discovering the breach, as required by Article 23 of Decree 13/2023/ND-CP.
• Notifying you: If the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay via your registered email and/or in-platform notification.
• Notification content: The notice will include: (i) a description of the incident; (iv) recommendations for you to protect yourself; (v) contact information for further details.

12. YOUR RIGHTS REGARDING PERSONAL DATA

In Short: You have several important rights over your personal data under Decree 13/2023/ND-CP.

Under Article 9 of Decree 13/2023/ND-CP and international data protection standards, you have the following rights:

How to Exercise Your Rights

You may exercise any of the rights above by:

• Submitting a data subject access request (DSAR) online; or
• Emailing us directly at [email protected].

We commit to responding to your request within 30 days. For complex or high-volume requests, the deadline may be extended by an additional 30 days, and we will notify you of the reason. We may require identity verification before processing your request to protect your data.

Marketing Opt-Out

You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any email, or by contacting us. After opting out, you will still receive essential service notifications (terms updates, maintenance, security alerts).

Account Deletion

You may request account deletion at any time via your account settings or by contacting us. Upon deletion, we will delete or anonymize your personal data in accordance with the retention periods in Section 9, unless the law requires longer retention.

13. CHILDREN'S DATA PROTECTION

In Short: The Services are not intended for individuals under 18.

Our Services are designed for property owners and business managers. We do not knowingly collect, solicit data from, or market to children under 18 years of age.

By using the Services, you confirm that you are at least 18 years old. If we discover that data has been collected from an individual under 18, we will delete it immediately.

If you discover that a child's data may have been collected, please contact us immediately at [email protected].

14. DO-NOT-TRACK (DNT) SIGNALS

There is currently no unified technical standard for browser "Do Not Track" (DNT) signals. Therefore, we do not currently respond automatically to DNT signals.

However, you can fully control tracking through our website's cookie settings (see Section 6). Analytics and advertising cookies are only activated when you give your consent.

If a DNT standard or other privacy signal mechanism (such as Global Privacy Control) becomes widely adopted in our region of operation, we will update our response policy accordingly.

15. UPDATES TO THIS POLICY

In Short: We will clearly notify you when significant changes are made.

We may update this Privacy Policy to reflect changes in our business operations, technology, or applicable law. When updates are made:

• The "Last updated" date at the top of this page will change.
• For material changes (expanding the scope of data collection, changing processing purposes, changing third-party recipients of data), we will:
  • Send a notification to your registered email address at least 30 days before the changes take effect;
  • Display a prominent notification banner on the website and within the platform;
  • Request your renewed consent if the changes significantly expand the scope of data processing.

We encourage you to review this Policy regularly. Your continued use of the Services after a change takes effect constitutes your acceptance of the updated version.

16. CONTACT US

If you have questions, requests, or complaints about this Privacy Policy or how we process personal data, please contact us:

To exercise your rights over personal data, you may:

• Submit a data subject access request (DSAR) online; or
• Email [email protected] with the subject line "[DSAR] Personal Data Request".

© 2026 Công ty TNHH DANAHOST. All rights reserved.
This Policy complies with Decree 13/2023/ND-CP on Personal Data Protection.