Operating rules & data privacy policy

General interpretation

Words with an initial capital letter have the meanings defined under the following conditions. These definitions have the same meaning whether they appear in the singular or plural, active or passive, in contractual commitments on the Da Nang Data Exchange.

Definitions

Account

A unique, identified and authenticated account (through VNeID or an enterprise digital signature) created for You to access Our Service or the Da Nang Data Exchange modules.

Exchange Operator (Company / Operator)

Refers to the Data Innovation & Exploitation Center under the Da Nang People's Committee (24 Tran Phu, Hai Chau ward, Da Nang City) and the technical partners that help operate the Da Nang Data Exchange.

Personal Data

Any information relating to an identified or identifiable individual under Decree 13/2023/ND-CP and the Personal Data Protection Law. Commercially traded datasets on the Exchange must go through de-identification before listing.

Service

The entire Da Nang Data Exchange portal, including the Commercial Data Exchange, the Data Auction Hall, the Open Data Portal, the Sandbox test environment and integrated intermediary APIs.

Service Provider

Any licensed individual or organization that processes data on behalf of the Operator for custody, secure multi-party computation (MPC), escrow payment or data quality appraisal.

Usage Data

Data recorded automatically by the system (access logs, IP address, user agent, tokens / SQL commands executed in the Sandbox, session encryption parameters).

You / Participant

An individual, company, government agency, research institute or lawfully authorized representative accessing or using the Da Nang Data Exchange Service.

Types of data collected

a. Basic personal data

While verifying your Da Nang Data Exchange membership, We may ask You to provide:

• Full name, date of birth, citizen ID number or Level 2 VNeID electronic identifier.
• Organizational / business email address and official contact phone number.
• Legal entity name, enterprise code / tax code, business registration certificate.
• Public digital signature details (USB token or Smart CA) used to sign digital contracts.

b. Usage data and technical logs

Collected automatically to ensure Level 4 information security:

• Internet Protocol (IP) address, browser type and version, device identifier.
• Time and frequency of module access, API key call history, time spent on pages.
• Logs of command interaction in the Sandbox (CPU/RAM consumption, functions invoked).

c. Tracking technologies and cookies

We classify and are transparent about the use of cookies on the Da Nang Data Exchange Portal as follows:

We use personal data only in cases that strictly comply with a legal basis:

1. 1.Maintaining and providing the Service: Creating accounts, issuing API keys, monitoring availability of listed datasets.
2. 2.Performing data sale contracts: Generating automatic electronic contracts, reconciling escrow cash flow, handing over DRM distribution keys.
3. 3.Notices and communication: Sending notices of bid price changes, Sandbox session expiry alerts, contract updates and cybersecurity announcements.
4. 4.Managing support requests and complaints: Supporting data quality appraisal and hash-checksum reconciliation when a data product is disputed.

The Operator retains personal data only as long as necessary for the processing purpose or for legal obligations under the Accounting Law and the Law on Electronic Transactions.

All Da Nang Data Exchange data is stored and processed at the Da Nang Data Center (Tier III+) in Da Nang, Vietnam.

Where data must be transferred abroad (for example when integrating international cloud computing in the VIFC Sandbox), the Operator strictly follows the procedure of preparing a cross-border data transfer impact assessment (DPIA) under Article 25 of Decree 13/2023/ND-CP and obtains written approval from the Department of Cybersecurity and High-Tech Crime Prevention (A05) — Ministry of Public Security.

You have the full rights of a data subject under the Personal Data Protection Law, including:

• The right to be informed and the right to consent to / withdraw consent for the processing of personal data.
• The right to access, view, correct or request a copy of your personal data.
• The right to request deletion or destruction of your personal data when you no longer wish to use the service.
• The right to object to or restrict data processing for marketing or promotional purposes.

To exercise these rights, You can go to Account Settings > Privacy on the Da Nang Data Exchange or send a written request to the Data Protection Officer (DPO) at dpo@sandulieu.vn. Requests are handled within 72 working hours.

The Operator discloses personal information only in cases required by law:

The Da Nang Data Exchange is classified as a Level 4 information system under Decree 85/2016/ND-CP and applies defense-in-depth technical measures across the board:

The infrastructure service providers We authorize operate under a strict Data Processing Agreement (DPA):

Our Service is designed for organizations, businesses and individuals aged 16 and over with full civil capacity. We do not knowingly collect personal data from anyone under 16.

If we find identifying information of a person under 16 in the system without the consent of a parent or lawful guardian, We will delete it from our servers within 24 hours.

Our Service may contain links to national public-service portals, commercial payment banks, or the Ministry of ICT's EMC monitoring system.

We are not responsible for the content or privacy policies of those third-party websites. You should review the privacy terms of each linked portal when you leave the Da Nang Data Exchange system.

The Operator may adjust and supplement these operating rules to comply with newly issued legal documents of the National Assembly, the Government and the Da Nang People's Committee.

Any change will be announced publicly on the Portal at least 15 days before it takes effect, and notified by email to all registered members.

If You have any questions or comments about these Operating Rules & Privacy Policy, please contact the Operator: