Sustainability 360° | Bền vững 360°
Website: https://benvung360.com.vn
Version: 1.0
Effective date: 25/10/2026
Introduction
Sustainability 360° respects your privacy and regards the protection of personal data as an essential part of operating the platform responsibly. We collect and use information only for clearly defined purposes and to the extent necessary, while prioritizing transparency, security and users’ ability to make informed choices.
This Policy explains the data that may be processed when you browse the Website, submit an inquiry, subscribe to updates or use the content management system; why and for how long data is processed; when it may be shared; and how you can exercise your rights.
This Policy has been prepared with reference to Vietnam’s Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/ND-CP and other applicable Vietnamese laws. Publishing this Policy does not replace a separate notice or consent mechanism where one is legally required.
1. Responsible Entity and Scope
Legal entity: Fly To Sky Charity and Community Development Support Social Enterprise Co., Ltd. (tax identification number: 5901213612).
Operating unit: FTS Center for Sustainability Research & Advisory (FTS CSRA), within the Fly To Sky Charity Organization (affiliated with the Vietnam National Volunteer Center under the Ho Chi Minh Communist Youth Union).
Contact address: No. 145/14/4 Thong Nhat Street, Dien Hong Ward, Gia Lai Province, Vietnam.
Email: [email protected]
Telephone: +84 375 136 800.
Where the Company determines both the purposes and means of processing and directly processes personal data, it assumes the responsibilities of a personal data controller and processor under applicable law. FTS CSRA manages the platform and carries out assigned operational activities. In this Policy, “we”, “us” and “our” refer to the above entities within their respective responsibilities.
This Policy applies to visitors reading publicly available content; individuals submitting inquiries, feedback, requests for collaboration or consulting; subscribers to updates when that feature is offered; and authors, contributors, editors and administrators authorized to access the content management system (CMS). It covers functions we directly manage on benvung360.com.vn, unless a particular service provides a separate, clearly identified policy.
2. Principles Governing Data Processing
Our approach is based on lawfulness and transparency; specific purposes; data minimization; restricted access; appropriate security; proportionate retention; and respect for data subjects’ rights.
We do not sell users’ personal data. We do not use contact details to send promotional content without an appropriate legal basis and consent where required. Simply continuing to read the Website does not constitute consent to processing activities for which consent is legally necessary.
3. Personal Data We May Collect and Process
3.1. Browsing public content
You may read articles, analyses, resources and other public content without registering an account. We do not ask for your name, email address or telephone number solely to access public pages.
The Website may record aggregate page-view counts to understand interest in particular content, without intending to build individual reading profiles. During a connection, the technical infrastructure may process IP addresses, device and browser information, access times, requests and performance or security-related signals. Depending on actual configurations, such information may appear in technical logs maintained by the Website or its service providers.
3.2. Submitting an inquiry or contact form
Depending on the form, we may receive your name; organization or company (if provided); email address and/or telephone number; area of interest; details of an inquiry, collaboration proposal, consulting request, correction request or complaint; submission time; record of consent; and technical data needed to prevent spam or abuse.
Required fields will be identified on the relevant form. Please provide only information necessary for your request. Technical anti-spam data may be transformed to reduce direct identifiability; such transformation does not necessarily mean that all technical data has been fully anonymized.
3.3. Subscribing to newsletters or updates
When a newsletter subscription feature is available, we may collect your email address, selected subscription preferences, registration time and consent record. We will use this information only to send content and notices within the scope you have agreed to receive. You may unsubscribe using the method provided in an email or by contacting us directly.
Submitting a general inquiry does not constitute subscribing to a newsletter, and we do not automatically add inquiry contacts to a marketing list.
3.4. Accessing the content management system
For authors, contributors, editors and administrators, processed data may include a name or display name, work email address, role and permissions, authentication and session information, access times, and logs of content creation, editing, review, approval, publication and administration.
We do not intend to store passwords in readable plain text. Activity records support account protection, editorial accountability, incident investigation and relevant legal or operational obligations.
3.5. Sensitive personal data and third-party information
General contact forms are not designed to collect sensitive personal data. Please do not send identity documents, medical records, passwords, financial details or another person’s private information unless it is genuinely necessary and you are legally entitled to provide it.
If a submission inadvertently contains sensitive information or another person’s data, we will consider whether processing is necessary and lawful and whether access should be restricted or the information corrected or deleted.
**
**
4. Purposes and Legal Grounds for Processing
We process personal data as reasonably necessary to:
• Respond to inquiries: receive, categorize and handle questions, feedback, correction requests and requests relating to consulting, research, training or collaboration. This generally relies on the sender’s consent or another lawful ground applicable to the specific circumstances.
• Operate the Website: deliver content, maintain connections, prepare aggregate statistics and support service availability and quality, subject to an appropriate legal ground.
• Protect our systems: identify and limit abnormal traffic, spam, fraud and security threats, to the extent necessary and legally permitted.
• Administer the CMS: authenticate users, assign permissions, maintain editorial histories and manage authorized users’ responsibilities, on the basis of work or collaboration arrangements, consent where required or applicable law.
• Send subscribed updates: deliver content that recipients have chosen and consented to receive.
• Meet legal obligations and handle requests: assess and resolve disputes or complaints and respond to lawful requests from competent authorities.
If we wish to use data for a new purpose, we will establish the relevant legal ground, provide further information and obtain consent where required. Exceptions allowing processing without consent will be applied only when the legal conditions are met; they do not automatically cover all technical or business operations.
5. Consent and Withdrawal of Consent
Where consent is required, we provide sufficient information about the types of data, purposes of processing, responsible entity and relevant rights and obligations. Consent must be clear, voluntary and verifiable, and relate to a specific purpose. Where a consent checkbox is used, it will not be pre-selected.
Consent to the handling of an inquiry is separate from consent to receive marketing communications. You may withdraw consent by following Section 11. Withdrawal does not retrospectively invalidate processing lawfully undertaken beforehand and may not prevent processing that is independently required or permitted by law.
**
**
6. Cookies and Similar Technologies
Cookies and browser storage technologies may be used to maintain login sessions, authenticate requests, remember essential choices or protect the Website against suspicious activity.
Under the current design, we do not intentionally use advertising cookies or cross-site tracking technologies to build behavioral marketing profiles. However, certain infrastructure providers, anti-spam services or embedded content providers may process technical data or place cookies as part of delivering their services.
You can view, block or delete cookies through your browser settings. Blocking essential cookies may affect sign-in or security features. If we introduce analytics, personalization or marketing technologies that require consent, we will update our disclosures and provide appropriate choices.
7. Authorized Access and Data Recipients
Personal data is accessible only to authorized personnel, teams with a legitimate operational need and service providers necessary to deliver the platform. Relevant categories of service providers may include:
• Website hosting, databases, file storage and cloud infrastructure operation.
• Information security, content delivery and protection against malicious or automated traffic.
• Transactional emails, authentication codes and system notifications.
• Display resources, embedded content and third-party website functions.
• Technical support, troubleshooting and maintenance within an authorized scope.
Different service providers may have different legal roles depending on the processing activity. We limit disclosures to what is necessary, apply appropriate contractual or other controls and maintain supplier details in our internal compliance records. Where the law requires the identity of a recipient or other detailed information to be disclosed, we will meet that requirement.
We may also provide information to competent authorities in response to lawful requests, or to other parties where valid consent or another legal ground permits it. We do not sell, rent or provide personal-data lists to third parties for their independent marketing without a lawful basis.
8. Cross-Border Data Processing
Some technical-service and external-content providers may operate infrastructure in more than one country. Depending on actual system configurations and data flows, technical information, inquiry information or related data may be transmitted, stored or processed outside Vietnam.
We are responsible for reviewing the relevant activities, identifying the data and parties involved, implementing appropriate safeguards, and completing cross-border personal data transfer impact assessments or other procedures where required by law. Any exemption, exception or procedural requirement must be assessed on its own facts; using an overseas service does not automatically create an exemption.
9. Data Retention and Deletion
We retain personal data for periods appropriate to its purpose, operational needs and legal obligations. The following principles apply to different categories:
• Inquiries: retained as needed to address, follow up and resolve a request; then reviewed for deletion, destruction or de-identification unless a legal, contractual or dispute-related need remains. Specific periods are governed by the approved internal retention schedule.
• Security and anti-spam records: retained for periods reasonably necessary to detect abuse, protect systems, investigate incidents or meet appropriate service-provider log configurations.
• CMS accounts: retained while access is authorized, with access withdrawn or disabled when no longer needed. Publication histories and editorial audit logs may be retained longer for accountability.
• Newsletter subscriptions: maintained while you are subscribed. After you unsubscribe, dispatch will stop and relevant information will be handled in accordance with legal obligations and any minimal records needed to respect your preference.
• Backups: deleted data may remain temporarily in restricted backups until the applicable retention or overwrite cycle ends.
You may request deletion in accordance with Section 11. If full deletion cannot yet be carried out because of a legal requirement, another person’s rights or another valid reason, we will explain the relevant scope and basis where permitted.
10. Information Security
We apply organizational and technical safeguards proportionate to the nature of the information, system scale and associated risks. These may include protected data transmission, role-based permissions, authentication and session management, controls against unauthorized access, file-upload checks, important-activity logging, backups and recovery measures, routine review and security issue remediation.
Personnel with access to data must use it only for authorized responsibilities and comply with confidentiality requirements. We do not publicly disclose system architecture, protective settings, cryptographic keys, credentials or detailed incident-response procedures where doing so could increase security risks.
No technical or organizational measure can eliminate every risk. We therefore review and improve our safeguards as appropriate to our operations and legal obligations.
11. Your Rights and How to Submit a Request
Under Vietnamese law, you have rights, subject to applicable conditions, to be informed about processing; consent or refuse consent and request its withdrawal; access and correct or request correction of data; request provision, deletion or restriction of data; object to processing; lodge complaints, report violations, bring legal proceedings, seek compensation and request legally prescribed protective measures.
To exercise your rights, email [email protected] with the subject line “Personal Data Request” and include your name, the email address or contact method previously used and a description of your request. You do not need to submit a copy of your identity document at the outset. We may request additional, proportionate verification to avoid disclosing or deleting another person’s data.
For valid requests, Decree No. 356/2025/ND-CP requires an initial procedural response within two working days. Where applicable, the ordinary completion periods are 10 days for viewing, correcting or providing data; 15 days for withdrawal of consent, restriction or objection; and 20 days for deletion. Different periods may apply where coordination with a processor or third party is required or a lawful extension is justified; we will provide the necessary notice.
A request may be refused or fulfilled only in part where verification requirements are not met or a legal exception applies. In such circumstances, we will explain the reason to the extent permitted by law.
12. Children’s Personal Data
Sustainability 360° is not designed to intentionally collect children’s personal data. If such processing arises, we will assess the applicable requirements for consent, the rights of parents or legal guardians and special safeguards under Vietnamese law.
Parents or legal guardians may contact us to raise concerns about information improperly provided by a child, request a review or exercise applicable rights.
13. External Websites and Embedded Content
Articles may link to independent reports, studies, source documents or external websites. Certain content may also be embedded from other platforms. When you visit or interact with these services, information may be processed under the provider’s own privacy policy. We do not control every activity of independent websites and encourage you to review their policies before submitting personal information.
14. Personal Data Incidents
If we identify or receive a report that personal data may have been accessed, lost, disclosed or processed without authorization, we will assess the circumstances, contain the incident, mitigate harm, document our findings, take corrective action and coordinate with relevant parties.
Where an incident falls within the notification obligations under Article 23 of the Law on Personal Data Protection, we will notify the competent personal data protection authority within the applicable period, including no later than 72 hours from discovery for cases covered by Clause 1 of that Article. We will inform affected individuals where required by law or where appropriate to help protect their interests.
Please report any suspicious activity relating to information submitted through the Website using the official contact email below.
15. Changes to This Policy
We may revise this Policy when the Website’s features, data processing practices, service providers or applicable laws change. The updated Policy will be published on this page with its effective date. If a change requires fresh consent, we will provide the relevant notice or obtain consent as prescribed by law; continued browsing alone does not replace that consent.
16. Contact Information
SUSTAINABILITY 360° – BỀN VỮNG 360°
Operating unit: FTS Center for Sustainability Research & Advisory (FTS CSRA).
Responsible legal entity: Fly To Sky Charity and Community Development Support Social Enterprise Co., Ltd.
Address: No. 145/14/4 Thong Nhat Street, Dien Hong Ward, Gia Lai Province, Vietnam.
Email: [email protected]
Telephone: +84 375 136 800
Website: https://benvung360.com.vn
We take legitimate questions, concerns and requests about privacy seriously and handle them confidentially and in accordance with applicable law.
Transparency in information – Responsibility in use – Security in protection.