Clause 1: Purpose and scope of information collection
Trip Express Vietnam Company Limited (hereinafter referred to as "Trip Express") collects personal data from Customers strictly to facilitate reservation processing, electronic ticket issuance, global travel itinerary management, transport, accommodation, yacht charters, events, and customer support across the trip.express platform and its attached domain shan.voyage.
Scope of personal information collected includes:
- Passenger identification details: Full legal name, date of birth, gender, nationality, and Citizen ID or Passport number (mandatory where required by maritime port authorities, aviation, railway, border control, or accommodation registration laws).
- Contact and fulfillment details: Email address and mobile phone number used to deliver Booking Confirmations, Electronic Tickets (E-Tickets), Service Vouchers (E-Vouchers), and operational schedule updates.
- Transaction and invoicing records: Booking history, tokenized payment transaction identifiers processed via licensed global and regional payment gateways, and corporate tax invoicing details (Company name, Tax ID, registered address) when requested by the Customer.
- Technical and device telemetry: IP address, browser type, operating system, and access logs required to prevent payment fraud and maintain platform security.
Customers are responsible for ensuring the accuracy and lawfulness of the information provided. Trip Express is not liable if inaccurate passenger identification details result in denied boarding or check-in by the Supplier or port authorities.
Clause 2: Scope of information use
Trip Express uses collected personal information strictly within the scope and lawful purposes notified below:
- Processing reservations, generating Booking References, and issuing E-Tickets, E-Vouchers, and QR Check-in credentials.
- Transmitting necessary passenger manifest data to the fulfilling Supplier (transport operators, port authorities, hotels, yacht operators, and event organizers worldwide) to execute check-in, boarding clearance, and mandatory passenger insurance.
- Communicating itinerary confirmations, departure time adjustments, weather advisories, rescheduling assistance, and refund or dispute resolution.
- Issuing electronic Value Added Tax (VAT) / GST invoices, collection receipts, and fulfilling statutory accounting, auditing, and tax reporting obligations.
- Sending curated travel updates and SHAN Privé membership notifications solely when the Customer has explicitly opted in.
Clause 3: Data retention period
Customer personal data is retained securely on Trip Express servers in accordance with the following statutory retention periods:
- User account profile data: Retained for the duration of the Customer's active account on trip.express or until a valid account deletion request is submitted.
- Booking records and accounting vouchers: Retained for a minimum of ten (10) years from the end of the fiscal year in which the transaction occurred, in compliance with the Vietnamese Law on Accounting and Law on Electronic Transactions.
- Technical security logs and support transcripts: Retained for twelve (12) to twenty-four (24) months for transaction reconciliation, dispute investigation, and security auditing.
Upon expiration of the applicable retention period or fulfillment of the collection purpose, personal data is permanently anonymized or securely purged from our systems.
Clause 4: Persons and organizations authorized to access information
Trip Express never sells, rents, or trades Customer personal data to third parties for commercial marketing. Access to personal information is restricted strictly to the following authorized entities on a need-to-know basis:
- Authorized Trip Express operations and customer support personnel: Staff bound by strict role-based access controls and confidentiality obligations to manage bookings, ticketing, and customer inquiries.
- Fulfilling service suppliers: Independent transport, yacht, hotel, dining, and experience operators with whom the Customer holds a confirmed reservation. Each Supplier acts as an independent Data Controller and Processor responsible for safeguarding passenger data under Decree 13/2023/ND-CP and applicable international data protection laws (GDPR/PDPA).
- Licensed global and regional payment gateways (Airwallex, Stripe, OnePay) and acquiring banks: Financial institutions licensed by international payment regulators, the State Bank of Vietnam, and global card networks to authenticate transactions and process refunds.
- OneUID single sign-on gateway (uid.one): Operates strictly as an authentication identity gateway. By architectural design, uid.one transmits only an opaque subject identifier (
sub) and stores zero travel history, dining preferences, or membership attributes. - Competent state authorities: Maritime port authorities, public security agencies, tax authorities, the Ministry of Industry and Trade, or courts upon presentation of a lawful written request under Vietnamese law.
Clause 5: Address of the data collection and management entity
The legal entity responsible for collecting, controlling, and managing personal data on trip.express is:
- Corporate legal name: Trip Express Vietnam Company Limited (Công ty TNHH Trip Express Việt Nam)
- Enterprise registration and tax ID: 0402217820 (Initially registered on December 18, 2023, issued by the Department of Planning and Investment of Da Nang City)
- Registered headquarters: 210 Diep Minh Chau, Hoa Xuan Ward, Da Nang City, Vietnam
- Data protection telephone hotline: +84 888 724 777
- Data protection officer email: [email protected]
- General inquiries email: [email protected]
Customers may contact the above channels at any time to inquire about the collection, processing, and protection of their personal data.
Clause 6: Methods and tools for consumers to access and edit personal data
Customers hold all statutory Data Subject rights under Decree 13/2023/ND-CP, Article 68 of Decree 52/2013/ND-CP, and GDPR, including the right to inspect, update, rectify, withdraw consent, or request deletion of their personal data through two convenient methods:
- Self-service account dashboard: Customers may sign in to their account on the trip.express website or Trip Express mobile application and navigate to Profile Settings to view, edit contact details, manage saved passenger profiles, adjust notification preferences, or initiate account deletion.
- Direct support request: Customers may submit a request via email to [email protected] or call +84 888 724 777. Our Data Protection Team will verify the requester's identity and execute the data update, export, or deletion within seventy-two (72) business hours of receiving a valid request.
Clause 7: Mechanism for receiving and resolving personal data complaints
Trip Express enforces TLS 1.3 encryption in transit, strict tenant isolation, and continuous audit logging to protect personal data against unauthorized access, alteration, or disclosure.
If a Customer discovers or suspects that their personal information has been collected or used beyond the notified scope or purpose, they may file a complaint through the following procedure:
- Step 1: Submit a report to the Data Protection Team via [email protected] or hotline +84 888 724 777 with relevant supporting details.
- Step 2: Trip Express acknowledges receipt within twenty-four (24) hours, audits system access logs, and immediately suspends any disputed data processing activity.
- Step 3: Within seven (07) business days, Trip Express provides a formal written response detailing the investigation findings, corrective actions taken, and applicable remediation. In the event of a statutory data breach, Trip Express notifies the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security) within seventy-two (72) hours in accordance with Article 23 of Decree 13/2023/ND-CP.