Legal

Personal Data Protection Policy

Last updated: 5 March 2026

NK International Co., Ltd ("NKI", "we") respects the privacy and protects the personal data of customers, website users and anyone who contacts NKI. This policy explains what data NKI may collect, the purposes it is used for, when data may be shared or transferred abroad, how long it is kept and how data subjects can exercise their rights. It is drafted in line with Vietnam's Law on Personal Data Protection No. 91/2025/QH15, in force from 1 January 2026, and related regulations.

1. About NKI

Company name: NK International Co., Ltd. Enterprise registration number: 0111398548.

Address: BT11-12, Packexim 1, No. 49, Lane 15, An Duong Vuong Street, Phu Thuong Ward, Hanoi, Vietnam.

Hotline: 0934 554 186 / 0989 271 782. Website: nkiprivatetravel.com.

2. Scope

This policy applies when an individual visits the website, submits a consultation form, registers for a tour, visa or service, or contacts NKI by email, phone, message or other online channels.

For customers who sign a contract or use a specific service, NKI may provide an additional notice or data-processing terms specific to that service.

3. Data NKI may collect

Depending on the activity and service, NKI may process the following categories of data:

Identity and contact details: full name, date of birth, nationality, phone number, email, address and other contact information.

Service information: destination, travel dates, number of guests, needs, budget, itinerary, bookings, flights, hotels, transport and special requests.

Documents needed for a service: passport, national ID or other identity papers, visa details, immigration files and other required documents.

Transaction information: quotes, contracts, payments, invoices, correspondence history and customer care records.

Sensitive data such as health information or special assistance needs, only where necessary to run the service safely or to arrange insurance or visas.

Technical information generated when using the website, such as IP address, browser, device, cookies or similar data where these technologies are used.

Photos, videos and other data an individual provides voluntarily, or that NKI has an appropriate legal basis to process.

4. Purposes of processing

Receiving and responding to consultation requests, quotes or service registrations.

Designing itineraries and delivering tours, visas, flights, hotels, transport, insurance, guides, interpretation and related services.

Contacting, caring for and supporting customers before, during and after a service.

Payment, reconciliation, accounting, invoicing, tax, audit and legal obligations.

Preventing fraud, resolving complaints or disputes and protecting the lawful rights and interests of NKI and related parties.

Improving the website, service quality and system security.

Marketing, sending programme information or using images for communications where a legal basis exists; where the law requires consent, NKI will seek it separately.

5. Legal bases

NKI determines the appropriate legal basis for each activity in accordance with the law. This may include performing a contract or service the customer requests, complying with legal obligations, protecting lawful rights and interests where permitted, the data subject's consent, or another lawful basis.

Providing data so that NKI can deliver a specific service does not by itself amount to consent for any other purpose, in particular marketing or the use of images in advertising.

6. Sharing data with suppliers and related parties

To deliver services, NKI may provide data, to the extent necessary, to: airlines, transport providers, hotels and accommodation, restaurants, attractions and travel suppliers; diplomatic missions, immigration authorities, visa agencies and competent state bodies; insurers, medical or emergency-assistance providers; tour operating partners, guides, tour leaders, interpreters and partners in Vietnam or abroad; providers of technology, hosting, email, payment, accounting or other services necessary to NKI's operations; and other parties where the law requires or permits.

NKI limits the data shared to what each purpose requires and applies appropriate controls within its own role. Independent organisations such as airlines, hotels, insurers or state bodies may also process the data they receive under their own policies and applicable law.

7. Transfers of personal data abroad

Because NKI provides international tours and visa services, personal data may be transferred to Japan or other relevant countries and territories to book services, complete visa and immigration procedures, arrange insurance, transport and accommodation, support customers or coordinate with partners.

NKI transfers data only to the extent necessary and carries out the assessments, records, notifications or safeguards required by the law applicable at the time.

8. Cookies and tracking technologies

The website may use cookies or similar technologies to keep the site working, remember preferences, measure performance or support advertising. For non-essential cookies or technologies, NKI will apply an appropriate notice and choice mechanism where the law requires.

If NKI issues a separate Cookie Policy, that policy forms a supplementary part of this one.

9. Marketing

NKI does not automatically use data collected for a tour, visa, flight or other specific service to send advertising. Phone numbers, email addresses or other contact channels are used for marketing only on an appropriate legal basis.

Customers can ask to stop receiving marketing content by following the instructions in the message or email, or through NKI's official contact channels. Opting out of marketing does not affect notices necessary to perform a contract or a service in use.

10. Photos and video

NKI may take or receive photos and video while running a programme. Use for operations, safety, incident handling or record-keeping takes place where an appropriate basis exists. Use on the website, social media or in advertising takes place on an appropriate legal basis and, where the law requires, with the individual's consent.

11. Retention

NKI keeps data only as long as necessary for the processing purpose, the performance of a contract, accounting, tax and legal obligations, the resolution of complaints or disputes, or the protection of lawful rights and interests within the limits the law allows.

When no purpose or basis remains, data is deleted, destroyed, returned, de-identified or restricted from processing in line with regulations and appropriate technical conditions.

12. Data security

NKI applies managerial, technical and organisational measures appropriate to its scale of operations to limit unauthorised access, loss, misuse or disclosure of data.

No electronic transmission or storage system can remove every risk. If an incident occurs, NKI will take remedial measures and fulfil the notification and reporting obligations the law requires.

13. Data subjects' rights

Data subjects hold the rights granted by current law over their personal data. Depending on the case, an individual may request to know about, access, correct, obtain, delete, restrict or object to processing, withdraw consent, or exercise other rights provided by law.

To keep data from being released to anyone without authority, NKI may ask for reasonable information to verify the identity and authority of the person making a request. Some requests may be limited or refused where the law allows, for example where NKI must keep data to meet a legal obligation or preserve evidence.

14. Data about other people and children

A customer who provides NKI with data about travel companions or other people must ensure they have the right or a lawful basis to do so and have met the necessary obligations towards those people.

For data about children or people who need a legal representative, NKI applies the consent and representation requirements of applicable law.

15. Contact about personal data

Requests, feedback or questions about personal data can be sent through NKI's official contact channels as published on the website from time to time.

To make verification and handling easier, please include your full name, contact details, the substance of the request and the information NKI needs to identify the relevant data or transaction.

16. Updates to this policy

NKI may update this policy when the law, technology, business operations or processing methods change. The updated version will be published on the website with its most recent revision date. Where a change requires separate notice or renewed consent under the law, NKI will follow the applicable requirements.

By continuing to use the website or sending information to NKI after this policy has been made available, an individual confirms they have had the opportunity to read and understand how NKI processes data. Processing based on consent is carried out only within the scope of the consent recorded and is not extended beyond it.

This English version is provided for reference. The Vietnamese version is the official text and prevails if there is any difference.