Last updated: 31 July 2026
This Privacy Policy explains how Waebox Media collects, uses, shares, stores and protects your personal data when you visit https://www.waebox.com and use the services offered through the site: sending a consultation or quotation request, registering a member account, purchasing an AI Agent package, and chatting with the Waebox AI Agent assistant.
The policy is written to comply with Decree 13/2023/ND-CP on personal data protection, the 2015 Law on Cyberinformation Security, the Law on Protection of Consumer Rights and other applicable Vietnamese regulations.
By continuing to use the website and voluntarily providing information to us, you confirm that you have read, understood and agreed to this Policy. If you do not agree, please do not submit personal data to us through the website.
1. Who we are
The personal data controller under this Policy is:
- Name: Waebox Media
- Head office: 242/05 Dien Bien Phu, Chinh Gian, Thanh Khe, Da Nang, Vietnam
- Email: [email protected]
- Hotline: +84 93 850 65 96
- Website: https://www.waebox.com
Please send any request, question or complaint relating to personal data to [email protected] with the subject "Personal data request".
2. Scope
This Policy applies to https://www.waebox.com and the online features available on it.
This Policy does NOT apply to:
- Third-party websites, apps and platforms you reach from links on our site (Zalo, Messenger, WhatsApp, Telegram, Viber, WeChat, social networks, search engines and similar). Processing on those platforms follows their own policies.
- Data you provide to us outside the website (for example through a signed contract, direct email or a meeting at our office), unless we state that this Policy applies.
- Business customer data that we process as a data processor under a separate service contract — in that case the confidentiality and data protection terms of the signed contract prevail.
3. Personal data we collect
We collect only what each purpose requires, following the principle of data minimisation.
| Source | Data collected |
|---|---|
| Contact / quotation / promotional campaign forms | Full name, email, phone number, company name, country, service of interest, preferred branch, message content, campaign code and referral source (UTM). |
| Member account registration and login | Display name, email, phone number, password, interface language and sign-up source. Passwords are hashed by our central system — we do not store and cannot read your password in plain text. |
| Online package purchase | Order reference, package name, amount, currency (VND), order status, creation time and payment confirmation time. |
| Chatting with the Waebox AI Agent | The messages you send, up to the 6 most recent turns of the session, and the language in use. |
| Technical and usage data | IP address, browser type, device, operating system, pages viewed, visit time and referring page — recorded through our infrastructure provider’s server logs and through Google Analytics. |
| Job applications | Applications currently go through the Contact form. We receive only the information you choose to put in that form; the website has no CV upload feature. |
We do NOT deliberately collect sensitive personal data as defined in Article 2 of Decree 13/2023/ND-CP (health status, political or religious views, biometric data, criminal records, detailed financial account or transaction data, and similar). Please do not enter such information into our forms or the AI chat box.
We do not collect or store your card number, CVV or online banking credentials. Payment is made by bank transfer inside your own banking app; we only reconcile the amount and the transfer note (the order reference) as recorded by the bank.
4. Purposes and legal bases
| Purpose | Data used | Basis |
|---|---|---|
| Receiving and answering consultation or quotation requests | Contact details, request content | Your consent when you submit the form |
| Creating, authenticating and managing member accounts | Account data | Performing the service you requested |
| Processing orders, reconciling payments, activating packages, keeping records | Order data and account details | Contract performance and accounting/tax obligations |
| Customer support, troubleshooting and after-sales care | Contact details, order data, technical logs | Contract performance and legitimate interests |
| Sending transactional email: welcome email, order status, account notices | Email, display name | Performing the service you requested |
| Sending service information and promotions | Email, phone number | Your consent — withdrawable at any time |
| Operating the Waebox AI Agent to answer your questions | Chat message content | Your consent when you send a message |
| Measuring traffic and improving the website | Technical and usage data, Google Analytics | Legitimate interest in running the website |
| Protecting system security, preventing spam and abuse | Technical data, form data | Legitimate interest in protecting the system and its users |
| Complying with the law and requests from competent authorities | The data covered by the request | Legal obligation |
We do not use your personal data for purposes other than those listed above without notifying you and obtaining your consent.
5. Cookies and similar technologies
The website uses the following cookies and browser storage:
| Name | Purpose | Lifetime |
|---|---|---|
| wbx_auth | Keeps your member account session. httpOnly — not readable by JavaScript in the browser. | 1 hour |
| wbx_rt | Refreshes your session so you are not asked to sign in repeatedly. httpOnly. | 14 days |
| wbx_locale_suggest_dismissed | Remembers that you dismissed the language suggestion so it is not shown again. | 30 days |
| _ga, _ga_* | Google Analytics — aggregated visit and behaviour statistics. | Per Google’s default configuration |
| Consultation popup localStorage entry | Remembers that you closed the consultation popup so it does not reappear repeatedly. Stored only in your browser. | Until you clear browser data |
The session and preference cookies are strictly necessary for the corresponding features. You can delete or block cookies in your browser settings; blocking the session cookies will disable the member account and package purchase features. You may also opt out of Google Analytics using Google’s "Google Analytics Opt-out Browser Add-on".
6. Data sharing and processors
We do NOT sell, rent or trade your personal data for commercial gain. Data is shared only to the extent necessary with:
| Recipient | Role and data shared |
|---|---|
| WAEBOX MANAGEMENT internal system | Our own CRM/ERP platform, where leads, customer accounts and orders are stored. Waebox staff access it under role- and branch-based permissions. |
| Vercel Inc. | Website hosting and delivery infrastructure. Processes technical data and access logs generated when you open the site. |
| Cloudflare, Inc. | DNS and email routing for the waebox.com domain. |
| Google LLC (Google Analytics) | Website traffic measurement using technical and browsing data in aggregated form. |
| OpenAI | Processes chat messages to generate the Waebox AI Agent’s answers. When this feature is disabled the assistant answers from our internal knowledge base and chat content does not leave our infrastructure. |
| VietQR (img.vietqr.io) | Generates the bank transfer QR image. The request contains only the amount and Waebox’s own account number and account name — none of your personal data. |
| Commercial banks | When you transfer money, the transaction is handled by your bank and Waebox’s bank under banking regulations. |
| Competent state authorities | Upon a lawful written request, or where necessary to protect the rights, property and safety of you, Waebox or a third party. |
| Legal, audit and accounting advisers | Only as necessary and under corresponding confidentiality obligations. |
7. Cross-border data transfers
Some providers listed in Section 6 (Vercel, Google, Cloudflare, OpenAI) run servers outside Vietnam. To that extent, your data may be transferred to and stored abroad.
Such transfers are carried out in accordance with Decree 13/2023/ND-CP and the data protection commitments in each provider’s terms of service. We transfer only the minimum data required for the relevant purpose.
8. Retention periods
- Contact details and consultation requests (leads): kept in the CRM until the consultation and customer care purpose is fulfilled, or until you ask us to delete them.
- Member account data: kept while the account is active. After you request account closure the data is deleted or anonymised, except what the law requires us to keep.
- Order data and payment records: kept for the period required by accounting and tax law.
- AI chat content: used only within the session to produce an answer; the website does not build a chat profile linked to your account.
- Infrastructure technical logs: kept for a short period for operational and security purposes, per our infrastructure provider’s policy.
- Session cookies: as stated in Section 5.
9. Security measures
We apply the following technical and organisational measures:
- The entire website runs over encrypted HTTPS/TLS.
- Session cookies are httpOnly, Secure (in production) and SameSite=Lax to limit session theft.
- Passwords are hashed by our central system before storage; Waebox staff cannot read your password.
- Sessions are short-lived and renewed through a separate refresh token.
- Internal access is granted by role and by branch — staff only reach data within their remit.
- Input length limits and a honeypot anti-spam trap on forms; message length and conversation history limits on requests to the AI assistant.
- Regular backups and system monitoring.
No system is 100% secure. Should a personal data breach occur, we will notify you and the competent authority as required by law (Decree 13/2023/ND-CP requires notification within 72 hours of discovery).
10. Your rights
Under Decree 13/2023/ND-CP you have the right to:
- Be informed about the processing of your personal data.
- Give or withhold consent to processing.
- Access, review and correct your personal data.
- Withdraw consent previously given.
- Request deletion of your personal data.
- Request restriction of processing.
- Request a copy of your personal data.
- Object to processing.
- Complain, denounce or initiate legal proceedings as provided by law.
- Claim compensation for damage caused by a breach of personal data protection rules.
How to exercise them: email [email protected] describing your request together with details that let us identify you (for example the email registered to your account or an order reference). We may ask for additional verification so that we never disclose data to the wrong person. We respond within 72 hours as required; for complex requests we will keep you informed of progress.
We may decline part of a request where the law permits or requires it — for example where data must be retained under accounting or tax rules, or to resolve a dispute — and we will explain why.
If you reside in a jurisdiction with a different framework (for example the GDPR in the European Union), you may exercise the corresponding rights through the same contact address above.
11. Direct marketing and opting out
You can stop receiving marketing email or messages at any time by using the unsubscribe link in the email, telling your account contact directly, or writing to [email protected].
After opting out of marketing you will still receive essential transactional email such as order confirmations, order status changes and notices about your account.
12. Children’s data
Our services target businesses and users aged 13 and over, consistent with the eligibility rule in our Terms of Service. Users under 18 need consent from a parent or legal guardian before providing personal data.
For users under 16 we process personal data only with the consent of a parent or legal guardian, as required by law. If we learn that we have collected a child’s data outside these rules, we will delete it promptly.
13. Using the Waebox AI Agent
The chat box on this website is powered by Waebox’s internal knowledge base, combined with a third-party language model when that feature is enabled. What you type, plus up to the 6 most recent turns, may be sent to the model provider to generate an answer.
- Please do not enter passwords, banking details, sensitive personal data or trade secrets into the chat box.
- AI answers are indicative; official quotations and scopes of work are always confirmed by Waebox staff.
- If you need to discuss confidential information, please contact us directly by email or hotline.
14. Third-party links and platforms
The website contains links and buttons to third-party platforms such as Zalo, Messenger, WhatsApp, Telegram, Viber, WeChat and Waebox’s social profiles. Following such a link takes you off our website, and your data is then handled by that platform under its own policy. We recommend reading their privacy policies before providing information.
15. Changes to this Policy
We may update this Policy as our services, technology or the law change. The current version is always published on this page with the update date shown at the top.
For material changes affecting your rights we will give notice on the website, or by email to registered customers, before the change takes effect.
16. Contact
For any question, request or complaint about this Privacy Policy, please contact:
- Waebox Media
- Address: 242/05 Dien Bien Phu, Chinh Gian, Thanh Khe, Da Nang, Vietnam
- Email: [email protected]
- Hotline: +84 93 850 65 96
- Website: https://www.waebox.com
This Policy should be read together with our Terms of Service.
© 2026 Waebox Media. All rights reserved.
