Legal
Privacy Policy
- Effective date
- Last reviewed
HCT SYSTEMS JSC (“HCT Systems”, “we”, “us”) respects the privacy of everyone who contacts us, visits this website, or works with us. This policy explains what personal information we handle, why, and what you can ask us to do about it.
1. Who is responsible
HCT SYSTEMS JSC is the controller of the personal information described here.
- Registered address: 237A/08 Dũng Sĩ Thanh Khê, Phường Thanh Khê, Thành phố Đà Nẵng, Viet Nam
- Privacy contact: privacy@hct-systems.com
If you are in the EU or UK, we act as a controller for the information described in section 2 and as a processor when we handle personal data on behalf of a client under a services agreement.
2. What we collect
We collect only what we need, and we do not buy personal information from third parties.
2.1 Information you give us
When you submit our contact form or email us, we receive:
- your name;
- your email address;
- your company name, if you provide it;
- the subject category you select;
- the content of your message.
2.2 Information collected automatically
This website uses Cloudflare for hosting, content delivery and security. In the course of serving a page, Cloudflare processes:
- your IP address;
- your user agent and the page requested;
- the country your request originated from, which we use to suggest a language.
We use Cloudflare Web Analytics, which reports aggregate traffic only. It sets no cookies, does not fingerprint your device, and cannot follow you across sites.
2.3 Cookies
This site sets no advertising or tracking cookies. It uses two pieces of local state, both strictly functional:
| Name | Type | Purpose | Retention |
|---|---|---|---|
hct_locale |
Cookie | Remembers the language you chose, so we do not guess again from your IP | 12 months |
hct-theme |
Local storage | Remembers your light or dark mode preference | Until you clear site data |
Neither is used to identify you, and the site works without both.
2.4 Anti-spam
Our contact form uses Cloudflare Turnstile to distinguish people from bots. Turnstile analyses browser signals rather than setting tracking cookies, and it does not build an advertising profile.
3. Why we use it
| Purpose | Lawful basis (GDPR) |
|---|---|
| Replying to your enquiry | Legitimate interests, or performance of a contract |
| Sending information you asked for | Consent |
| Preventing spam and abuse of our forms | Legitimate interests |
| Keeping this site secure and available | Legitimate interests |
| Meeting accounting and legal obligations | Legal obligation |
We do not use your information for automated decision-making that has a legal or similarly significant effect on you, and we do not sell it.
4. Who we share it with
We share personal information only with service providers who help us operate, and only as far as they need it:
| Provider | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, WAF, Turnstile, analytics | Global edge network |
| Mailgun Technologies, Inc. (Sinch) | Delivery of contact-form notification email | United States |
| GitHub, Inc. | Source-code hosting for this website | United States |
Each is bound by a written agreement covering confidentiality and security. We may also disclose information where we are legally required to.
5. International transfers
We operate from Viet Nam and our providers operate globally, so your information may be processed outside your country. Where we transfer personal data out of the EU, UK, Japan or Korea, we rely on the transfer mechanisms available to us — including standard contractual clauses — and we assess whether additional safeguards are needed.
6. How long we keep it
- Enquiries that do not become projects: 24 months from last contact, then deleted.
- Enquiries that become projects: for the life of the engagement plus the retention period in the relevant contract.
- Server and security logs: retained by Cloudflare according to its own retention schedule, typically days rather than months.
- Records we must keep for accounting or tax: for the period the applicable law requires.
7. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate or incomplete;
- delete information we no longer have a basis to keep;
- restrict or object to how we use it;
- receive a copy in a portable format;
- withdraw consent where consent is the basis we relied on;
- complain to your data protection authority.
To exercise any of these, write to privacy@hct-systems.com. We respond within 30 days. We may ask you to confirm your identity first — not to obstruct the request, but because handing personal data to the wrong person would be a worse outcome than a short delay.
If you are in Japan, please also see Personal Information Handling and Retained Personal Data, which set out the disclosures required under the Act on the Protection of Personal Information.
8. Security
How we protect information is described in our Security Policy. In summary: encryption in transit and at rest, least-privilege access, logging and review, and a documented incident response process.
9. Children
This site is aimed at businesses. We do not knowingly collect personal information from children. If you believe a child has sent us information, contact us and we will delete it.
10. Changes
If we change this policy we will update the effective date above. Where a change materially affects how we handle information we already hold, we will make a reasonable effort to tell affected people directly.
11. Contact
Questions, requests or complaints:
HCT SYSTEMS JSC — privacy@hct-systems.com 237A/08 Dũng Sĩ Thanh Khê, Phường Thanh Khê, Thành phố Đà Nẵng, Viet Nam