Privacy Policy & Data Protection Statement
At a Glance · Core Commitments
No Google Analytics, no Facebook Pixels, no behavioral trackers.
Contact details deleted after 12 months or immediately upon request.
Data Subject Access & Erasure requests processed within 72h via email.
01. Data Controller & DPO Information
This Privacy Policy governs the processing of personal data on the website githsoft.com and related technical consulting channels operated by:
02. Categories of Personal Data Collected
In strict compliance with the Principle of Data Minimization (Article 3 Decree 13/2023/ND-CP, Article 5(1)(c) GDPR), GithSoft only collects personal data that you explicitly and voluntarily submit via our technical inquiry form or direct communication channels:
-
Identity Data: Full Name or Organization / Company Name.
-
Contact Data: Corporate Email address, Phone/Zalo number, or Telegram/GitHub handle.
-
Technical Inquiry Data: High-level problem statements, architectural specifications, or system requirements submitted for feasibility review.
-
Automated Edge Telemetry: Anonymized server logs collected by Cloudflare edge servers (IP address generalized to country level, HTTP protocol version, user-agent) strictly for DDoS mitigation and infrastructure security. No persistent user tracking cookies are set.
03. Lawful Bases & Processing Purposes
Under Article 11 & 13 of Vietnam Decree 13/2023/ND-CP and Article 6 of EU GDPR, your data is processed solely under the following lawful bases:
| Processing Purpose | Lawful Basis (Decree 13 & GDPR) | Data Categories |
|---|---|---|
| Technical Feasibility Review & Architectural Scoping | Consent (Art. 11 Decree 13 / Art. 6(1)(a) GDPR) | Name, Email, Inquiry message |
| Pre-Contractual Negotiation & NDA Execution | Contractual Necessity (Art. 6(1)(b) GDPR) | Organization, Contact details |
| DDoS Mitigation & Edge Infrastructure Security | Legitimate Interest & Cyber Safety Law | Anonymized edge headers, IP |
⚠ Strict Non-Disclosure Guarantee: GithSoft never sells, rents, licenses, or shares your personal information or confidential project specifications with any advertising networks, third-party brokers, or external marketers.
04. Data Retention Period
In compliance with Article 16 Decree 13/2023/ND-CP and GDPR Storage Limitation, personal data is retained only for the period necessary to fulfill the initial consultation purpose:
-
General Technical Inquiries: Retained for a maximum of 12 months from the date of the last technical communication, after which it is permanently purged.
-
Executed Contracts & Invoicing: Stored for 5 to 10 years in strict accordance with statutory accounting and tax regulations.
-
Immediate Erasure: If you request data erasure before the 12-month period expires, your data is expunged within 72 hours.
05. Zero-Tracking Cookies Policy
Under the EU ePrivacy Directive and GDPR Recital 30, websites using non-essential tracking cookies must enforce explicit cookie banners. Because githsoft.com is engineered with privacy-by-design:
We do not set any tracking, targeting, advertising, or third-party analytics cookies. Our site is delivered as precompiled static HTML/CSS over Cloudflare Anycast Edge PoPs. Local latency measurement uses pure client-side performance.now() without storing cookies or transmitting user fingerprints.
06. Data Subject Rights (DSAR)
Regardless of your country of residence, GithSoft grants all data subjects full rights in alignment with Article 9 of Decree 13/2023/ND-CP and Articles 15–21 of GDPR:
Obtain confirmation and a machine-readable copy of any personal data we hold about you.
Request the immediate, permanent deletion of your contact information and message history.
Update or correct inaccurate or incomplete contact records.
Withdraw previously granted processing consent at any time without adverse consequences.
07. How to Exercise Your Rights (DSAR Procedure)
To exercise any of your statutory data protection rights, submit an email to our Data Protection Officer:
[Data Subject Request] Your Full Name08. Technical & Operational Security Safeguards
Under Article 26 Decree 13/2023/ND-CP and Article 32 GDPR, GithSoft implements rigorous physical, organizational, and cryptographic security measures:
-
Transit Encryption: TLS 1.3 enforced across all connections with HSTS (HTTP Strict Transport Security) Preload and 1-year max-age.
-
HTTP Security Headers:
X-Frame-Options: DENY,X-Content-Type-Options: nosniff, andPermissions-Policy: camera=(), microphone=(), geolocation=(). -
Workstation Encryption: Client project discussions and architectural schematics reside on hardware-encrypted macOS drives (FileVault AES-256) secured with physical FIDO2 U2F hardware security keys.
-
Global Edge Network & Transit: Static asset delivery and DDoS mitigation are served across Cloudflare's global Anycast edge network in compliance with Decree 13 Article 25 (cross-border data transfer) and EU Standard Contractual Clauses (SCCs).