Privacy Policy

This Privacy Policy and Personal Data Protection Policy (“Policy”) sets out how Luggo collects, records, stores, uses, shares, transfers, protects, retains, and otherwise processes personal data of customers, recipients, contact persons, website/app users, and other relevant individuals in connection with Luggo’s luggage storage, pickup, transport, and delivery services.

This Policy applies to all personal data processed by Luggo by electronic, semi-electronic, or manual means in connection with its business operations.

This Policy is prepared in accordance with the laws of Vietnam, including but not limited to:

• the Law on Personal Data Protection No. 91/2025/QH15, effective from January 1, 2026;
• Decree No. 356/2025/ND-CP, detailing a number of articles of and measures for implementation of the Law on Personal Data Protection, effective from January 1, 2026;
• the Law on Protection of Consumers’ Rights 2023;
• the Law on Electronic Transactions 2023;
• the Law on Cybersecurity 2018; and
• other applicable laws and regulations of Vietnam from time to time.

For the purposes of this Policy:

• Personal Data means information in the form of symbols, letters, numbers, images, sounds, or similar forms in the electronic environment that is associated with a specific person or helps identify a specific person.
• Data Subject means the individual to whom the Personal Data relates.
• Processing of Personal Data means one or more activities affecting Personal Data, including collection, recording, analysis, confirmation, storage, editing, disclosure, combination, access, retrieval, recovery, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction, or other relevant actions.
• Luggo means the personal data controller or personal data controller-cum-processor, as applicable in each case.
• Processor means any organization or individual that processes Personal Data on behalf of Luggo under a lawful agreement or arrangement.

Depending on the service and channel of interaction, Luggo may collect part or all of the following categories of Personal Data:

8.4.1 Identity and Contact Data

• full name;
• phone number;
• email address;
• nationality;
• emergency contact or alternate recipient details;
• social media account name or chat ID where the customer contacts Luggo through a third-party platform.

8.4.2 Booking and Service Fulfilment Data

• pickup address, drop-off address, hotel, airport, train station, apartment, office, or other relevant location;
• pickup and delivery time;
• booking number, order reference, and flight or travel details if provided by the customer;
• number of items, approximate size, and type of luggage or bag;
• photos of luggage, luggage tags, and external condition of the luggage;
• operational notes, special requests, and customer support history.

8.4.3 Payment and Transaction Data

• payment details, transaction amount, and payment history;
• invoicing details, company name, tax code, and billing address where requested;
• payment reconciliation data received from payment gateways, banks, or payment service providers.

8.4.4 Technical and Digital Data

• IP address, device type, operating system, and browser type;
• cookies, access logs, device identifiers, access time, and user interactions on the website or application;
• approximate geolocation or live location data where necessary for operational coordination and where location sharing is enabled by the customer.

8.4.5 CCTV and Security Data

• CCTV footage recorded at warehouses, pickup/drop-off points, and operating areas;
• images of delivery staff, customers, or authorized recipients appearing within CCTV coverage;
• records, photographs, or videos used to verify luggage condition, incidents, loss, disputes, or complaints.

8.4.6 Other Data

Luggo does not intentionally request sensitive personal data beyond what is necessary for the provision of services. If a customer voluntarily provides sensitive data or special documents, Luggo will process such data only on an appropriate legal basis, within the necessary scope, and with enhanced safeguards where required by law.

Luggo may collect Personal Data from the following sources:

• directly from customers when they make bookings, fill in forms, chat, call, email, or interact with Luggo in person;
• from alternate senders, recipients, hotel reception staff, accommodation providers, or other persons designated by the customer;
• from Luggo’s website, mobile application, social media channels, chatbot, and payment systems;
• from CCTV systems, operational logs, and pickup/delivery records generated during service performance; and
• from competent state authorities or other lawful third parties where required for verification, dispute handling, or legal compliance.

Luggo may process Personal Data for one or more of the following purposes:

• receiving enquiries, providing consultations, quotations, and booking confirmations;
• creating, managing, and performing luggage pickup, storage, transport, and return services;
• verifying the identity of the owner, sender, recipient, or authorized representative;
• contacting customers regarding scheduling, timing changes, address confirmation, or service-related issues;
• tracking order handling, warehouse management, labeling, inventory control, and delivery reconciliation;
• recording the external condition of luggage before, during, and after storage or transport;
• processing payments, refunds, invoices, and receivables;
• handling complaints, claims, compensation, disputes, loss, misdelivery, or service incidents;
• ensuring security and safety of property, preventing fraud, impersonation, or abuse of services;
• complying with legal obligations and lawful requests from competent authorities;
• sending service notifications, customer care communications, and feedback surveys;
• sending promotional materials, offers, or service updates where there is a lawful basis to do so; and
• conducting analytics, reporting, service improvement, and operational enhancement.

Luggo processes Personal Data on one or more legal grounds permitted under Vietnamese law, including:

• the valid consent of the Data Subject;
• necessity for entering into or performing a contract or service requested by the Data Subject;
• necessity for Luggo to comply with legal obligations;
• necessity to protect the lawful rights and interests of Luggo or the Data Subject in accordance with law;
• necessity for activities of competent state authorities as prescribed by law; or
• other lawful grounds as permitted under applicable Vietnamese law. The current legal framework is set by the 2025 Law and its implementing Decree.

Luggo does not sell Personal Data unlawfully. Luggo may share Personal Data only to the extent necessary and for legitimate purposes with the following parties:

• Luggo’s internal personnel, including operations, customer service, accounting, warehouse, and delivery teams;
• transportation partners, drivers, couriers, and warehouse partners;
• technology service providers, including order management software, cloud storage providers, CRM systems, phone systems, email and messaging service providers;
• payment gateways, banks, and intermediaries;
• insurers, adjusters, lawyers, consultants, and auditors where necessary;
• hotels, front desk staff, building management, or other third parties designated by the customer for pickup or delivery coordination; and
• competent state authorities or other parties where required by law.

Luggo requires relevant third parties to process Personal Data within the agreed scope, for lawful purposes, and subject to confidentiality and data protection obligations.

Where Luggo uses servers, software, platforms, or service providers with infrastructure located outside Vietnam, Personal Data may be stored, backed up, or processed outside Vietnam to the extent necessary for business operations.

Where cross-border transfer of Personal Data falls within a category regulated by Vietnamese law, Luggo shall comply with the applicable legal requirements, including relevant protection measures, documentation, procedures, or reporting obligations. Decree 356/2025/ND-CP expressly addresses compliance requirements relating to personal data processing and cross-border transfer impact dossiers.

Luggo retains Personal Data for as long as necessary for the relevant processing purposes, unless a longer period is required or permitted by law, or is reasonably necessary to:

• complete the service;
• resolve complaints, disputes, or compensation claims;
• comply with tax, accounting, and invoicing obligations;
• support audits, inspections, or investigations; or
• protect Luggo’s lawful rights and interests.

Once the retention period expires, or when the purpose of processing has been fulfilled and there is no further legal basis for retention, Luggo will delete, destroy, or anonymize the relevant Personal Data in accordance with applicable law and internal procedures.

Subject to applicable Vietnamese law, Data Subjects may have the following rights:

• the right to be informed about the processing of their Personal Data;
• the right to give or withhold consent;
• the right to withdraw consent;
• the right to access, review, correct, or request updates to Personal Data;
• the right to request restriction of processing in certain cases;
• the right to request deletion of Personal Data where legally applicable;
• the right to object to processing for certain purposes in accordance with law;
• the right to complain, denounce violations, initiate legal action, or claim compensation for damage; and
• other rights as provided by Vietnamese law. The new 2025 Law is the operative framework for these rights from January 1, 2026.

To exercise these rights, Data Subjects may contact Luggo using the contact details set out in Section 16. Luggo may request identity verification before processing a request in order to protect Personal Data and prevent unauthorized access.

Data Subjects are responsible for:

• providing accurate, complete, and lawful information;
• safeguarding their account credentials, verification codes, and access devices;
• not providing another person’s data without lawful authority;
• promptly notifying Luggo if they become aware of unauthorized access, disclosure, or misuse of their Personal Data; and
• complying with applicable law and Luggo’s terms and conditions.

Luggo implements appropriate administrative, technical, and operational safeguards to protect Personal Data, including but not limited to:

• role-based access control;
• limiting access to customer, order, warehouse, and payment data;
• password protection, authentication, encryption, or equivalent technical measures;
• logging, monitoring, and abnormal access detection;
• procedures for handling luggage photos, labels, handover records, and CCTV data;
• staff and contractor training on confidentiality and personal data protection;
• confidentiality obligations with employees and relevant third parties; and
• backup, recovery, and incident response procedures.

However, no system can guarantee absolute security. If Luggo becomes aware of a personal data protection violation that may cause harm, Vietnamese law now contemplates notification and response duties, including a 72-hour notification rule in certain cases.

Luggo does not intentionally collect Personal Data of children or persons lacking full civil act capacity except where necessary for a lawful transaction. Where such processing occurs, it shall be carried out on an appropriate legal basis and, where required by law, with the participation or consent of the legal representative.

Luggo’s website and application may use cookies and similar technologies to:

• maintain login sessions;
• remember user preferences;
• measure website or application performance;
• analyze traffic and usage;
• detect errors, fraud, or abnormal access.

Users may adjust browser settings to reject some or all cookies. However, disabling cookies may affect certain features or functionality of the website or application.

For any request, question, complaint, or exercise of data subject rights, please contact:

Luggo / BoxLok
Address: 108 Street # 69CL, Cat Lai Ward, Ho Chi Minh City<
Email: luggo.vn@gmail.com
Hotline / WhatsApp: +84 966 23 21 22
Website: www.luggo.vn

Luggo will receive, review, and respond within a reasonable period in accordance with applicable law and Luggo’s internal procedures.

8.17 Amendments

Luggo may amend or update this Policy from time to time to reflect changes in law, business operations, technology platforms, or internal governance requirements.

The updated version will be published on Luggo’s website, application, or other appropriate channels. The revised version will take effect from the date of publication or another date specified in the notice.

8.18 Effective Date

This Policy is effective from 1/4/2026.