Privacy Policy
Last updated: October 13, 2026
1. Who we are
Widget.vn is a product of ERPFIT COMPANY LIMITED (CÔNG TY TNHH ERPFIT, “ERPFit”, “we”), tax code 0317567782, 134/33C Nguyen Thi Thap, Tan Thuan Ward, Ho Chi Minh City, Vietnam. Personal-data contact: [email protected].
This policy explains what personal data is processed when you use the widget.vn website, the admin dashboard and the embedded widgets, who is responsible for it, where and how long it is stored, and how you exercise your rights.
2. Our two roles
- Data controller — for the account data of our business customers (admin dashboard users) and for visitors of widget.vn.
- Data processor — for data that visitors of our customers’ websites submit through a widget (e.g. cookie choices, terms acceptance, contact forms, job applications). Here the business that embeds the widget is the controller: it decides why the data is collected, and we process it only on its instructions to provide the service. If you visited a business’s website that uses widget.vn, please contact that business first; we will help it answer your request.
3. Data we process
3.1. Business customers (admin accounts)
- Name, email, password (stored hashed), business name, website domain
- Login sessions: IP address and browser user-agent of the signed-in device
- Pro plan orders and bank-transfer receipts (amount, transaction reference). We do not collect or store payment card data.
3.2. Visitors of our customers’ websites (through widgets)
| Widget | Data stored |
|---|---|
| Cookie Banner | Consent choice per cookie category, timestamp, IP address and user-agent (as proof of consent) |
| Terms Consent | Documents accepted, timestamp, email (if the business requires it), IP address and user-agent |
| Contact form, Feedback | Name, email, phone number, message |
| Email subscription | Email, phone number, name |
| Appointments | Name, phone number, email, date and time, notes |
| Job board | Name, email, phone number, CV |
| All widgets | Daily view and click counts (aggregated, not linked to a person) |
Public forms are protected against spam with Cloudflare Turnstile; IP addresses are used transiently for rate limiting and are not stored for that purpose.
3.3. Visitors of widget.vn
widget.vn runs our own Cookie Banner; your choice is stored as described in 3.2. If you send us a contact form, we keep what you send in order to reply.
4. Purposes and legal bases
- Performance of a contract — creating and running accounts, serving widgets, keeping consent proof for our customers.
- Consent — non-essential cookies on widget.vn; you can withdraw at any time via the cookie settings button.
- Legal obligation — keeping payment records under accounting and tax rules.
- Protecting the service — detecting and preventing abuse, spam and attacks.
We do not sell personal data, do not use it for targeted advertising, and do not use one customer’s visitor data for any other customer.
5. Cookies and browser storage
The admin dashboard uses one essential session cookie. Embedded widgets use localStorage to remember UI state and the visitor’s consent choice. We do not use third-party tracking cookies.
6. Storage location and cross-border transfer
The database and uploaded files are stored on servers we manage, rented from OVHcloud in Singapore. All connections pass through Cloudflare’s network. Personal data of data subjects in Vietnam is therefore transferred abroad and stored in Singapore; it travels over encrypted connections (HTTPS). We are preparing to move storage to Vietnam and will update this policy when that is done.
7. Service providers (sub-processors)
- OVHcloud — server infrastructure (Singapore)
- Cloudflare — CDN, DDoS protection, Turnstile anti-spam
- Resend — transactional email (account verification, service notices)
- Google Fonts — fonts on the widget.vn website (your browser loads them directly from Google)
Each receives only the data its service needs.
8. Retention
- Admin accounts — for as long as you use the service; deleted within 30 days of an account-deletion request.
- Consent records and widget submissions — kept on behalf of the business customer while its account is active (consent records are its legal proof) and deleted within 30 days after the account is closed. The customer can ask for earlier deletion.
- IP addresses on consent records — kept in full for 30 days; after that a daily job shortens them to their network (IPv4 /24, e.g.
203.0.113.0; IPv6 /48). The consent record stays, without the full IP. - Payment records — for the period accounting law requires.
- Backups — taken daily and before every system update; the 14 most recent of each kind are kept and older ones are deleted automatically.
9. Security
- HTTPS encryption for all connections
- Per-customer data isolation (tenant isolation); personal data is visible only after signing in to the admin dashboard
- The database server is not reachable by public SSH
- Regular backups with integrity checks
If a personal data breach occurs, we notify the specialised personal data protection authority (Ministry of Public Security) and affected customers within the time limit the law sets.
10. Data subject rights
You have the right to be informed, to give or withdraw consent, to access, correct and delete your data, to restrict or object to processing, to request a copy of your data, to complain and to claim compensation as provided by law. Send requests to [email protected]; we may ask you to verify your identity first and will respond within the time limit the law sets.
11. Legal basis
- Personal Data Protection Law No. 91/2025/QH15
- Decree 356/2025/ND-CP detailing the Personal Data Protection Law (replacing Decree 13/2023/ND-CP)
- Cybersecurity Law and Network Information Security Law
12. Changes
When this policy changes, we update the date at the top of the page. Significant changes are announced to your account email before they take effect.