Privacy Policy

1. Introduction

KOMPA TECHNOLOGY COMPANY LIMITED (“Kompa”, “we”, “us”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit kompa.ai (the “Website”) or use the services we provide.

This policy is drafted in line with Vietnam's Law on Personal Data Protection No. 91/2025/QH15 (the “PDPL”) and its implementing Decree No. 356/2025/NĐ-CP — both effective 1 January 2026 and which fully replace the prior Decree 13/2023/NĐ-CP — together with the Cybersecurity Law 2018 and other applicable Vietnamese laws.

2. Scope

This policy applies to:

• Anonymous visitors to the Website;
• Prospective customers who submit information through demo, download or contact forms;
• Customers using Kompa services pursuant to a separate service agreement;
• Internal users accessing the Website's content management system (CMS).

3. Data we collect

3.1. Information you provide

When you fill in forms on the Website (book a demo, download an ebook, request consultation), we collect:

• Full name;
• Work email address;
• Phone number;
• Company / organization name;
• Job title or role (if provided);
• Areas of interest and the content of your enquiry.

3.2. Information collected automatically

When you visit the Website, our systems automatically log:

• IP address and approximate city-level location;
• Browser type, operating system, screen resolution;
• Pages visited, session duration, navigation path (clickstream);
• Referrer source and campaign UTM parameters;
• Interaction events (clicks, form submissions) via the PostHog analytics tool;
• Aggregate traffic and behavior metrics via Google Analytics 4 (GA4), with IP anonymization enabled.

3.3. Information from third parties

We do not purchase personal data from third-party data brokers. If you sign up to a Kompa service through an authorized partner or reseller, that partner may share your contact information with us in order to provide the service.

4. Purposes of processing

5. Legal basis

We process your personal data on one or more of the following bases:

• Your consent, given when you submit a form or sign up to receive updates;
• Contract performance or pre-contractual steps requested by you;
• Our legitimate interests in operating, analyzing and securing the Website, balanced against your rights and interests;
• Legal obligations under applicable Vietnamese law.

6. Retention periods

We keep personal data only as long as needed for the purposes in Section 4:

• Prospective leads: up to 36 months from your last interaction, after which the data is anonymized or deleted;
• Contracted customer data: contract term plus 5 years for accounting and statutory record-keeping;
• Analytics data (PostHog): up to 12 months;
• Server access logs: up to 90 days.

7. Sharing with third parties

We do not sell or rent personal data. We share data only with:

• Data processors supporting our operations (PostHog Inc. — product analytics; Google LLC — Google Analytics 4 traffic measurement; Google Cloud / hosting providers — storage and delivery);
• Implementation partners authorized by Kompa to deliver services to you under contract;
• Competent state authorities upon a lawful request (tax authority, police, courts);
• Acquirers or successors in the event of a merger, demerger or transfer — with a commitment to continue honoring this policy.

8. Cookies and similar technologies

The Website uses cookies and local storage to maintain your session. We do not use advertising cookies or cross-site tracking cookies.

You can block or delete cookies at any time in your browser. Disabling analytics cookies does not affect core Website functionality but reduces our ability to improve the product based on usage data.

9. Your rights

Under Law 91/2025/QH15 on Personal Data Protection and Decree 356/2025/NĐ-CP, you hold the following rights over your personal data:

• Right to be informed about the processing of your personal data;
• Right to consent / withdraw consent, except where the law provides otherwise;
• Right to access, view and correct your personal data;
• Right to request erasure of your personal data;
• Right to restrict processing;
• Right to data portability in a structured, readable format;
• Right to object to processing;
• Right to file complaints, denunciations and lawsuits as provided by law;
• Right to compensation for damages caused by violations of personal data protection rules.

To exercise any of these rights, please email info@kompa.ai. We will acknowledge your request within 72 hours and resolve it within a maximum of 30 days from receipt of a valid request.

10. Security

We apply appropriate technical and organizational measures to protect personal data, including:

• HTTPS/TLS encryption for all data in transit;
• Access controls following the principle of least privilege;
• Periodic backups with isolated, hardened storage;
• Periodic security reviews and source-code audits;
• Personal-data protection training for staff.

That said, no system is perfectly secure. In the event of a data breach, we will notify you and the competent authority as required by law.

11. Cross-border transfers

Some of our data processors (e.g. PostHog Inc.) host servers outside Vietnam. When we transfer personal data abroad we comply with the cross-border transfer regime of Law 91/2025/QH15 and Decree 356/2025/NĐ-CP — including preparing a Cross-Border Data Transfer Impact Assessment where required by law, filing the assessment with the Department of Cybersecurity and High-Tech Crime Prevention (A05, Ministry of Public Security), and applying standard contractual clauses on personal data protection with the processor.

12. Children's data

Kompa's Website and services are intended for organizations and individuals aged 18 and above. We do not knowingly collect personal data from children under 16. If you believe we hold children's data without parental / guardian consent, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services or applicable law. For material changes, we will notify you via the Website or email at least 15 days before the change takes effect. The current effective version is shown at the top of this page.

14. Contact

For any questions, requests or complaints relating to this policy, please contact: