Privacy and Personal Data Protection Policy

This Privacy Policy has been developed in strict compliance with Vietnam’s Decree No. 13/2023/ND-CP on Personal Data Protection, the Law on Cyberinformation Security, and Vietnamese regulations governing e-commerce.
Hemidi Joint Stock Company (“Hemidi,” “we,” or “us”) acts as the Personal Data Controller and Processor for information collected through the Selling Sync platform. We are committed to protecting the privacy, confidentiality, and integrity of Customer data using state-of-the-art technical standards.

To operate the software and provide the services, Hemidi collects the following categories of data:

• Personal Data of Customer Representatives: Full name, job title, business email address, contact telephone number, IP address, login logs, and account authentication information.
• Payment Data: Transaction history, billing information, and payment methods. International credit and debit card information is encrypted and processed directly through a PCI DSS-compliant third-party payment gateway. Hemidi does not directly store Customers’ raw card numbers.
• Storefront Business Data: Storefront connection information, category codes (ASIN, SKU), inventory levels, selling prices, order data, CPC advertising campaign metrics, and financial reconciliation data collected via APIs from Customer-integrated e-commerce platforms; order data including customer information, shipping addresses, etc., and any other information returned by the platform APIs. The processing of this data shall strictly comply with the respective platform regulations, the laws of the countries where the Customer operates, and the laws of Vietnam.
• Electronic Identity Verification Data from VNeID: Upon the Customer initiation of the account linking process, Selling Sync will collect legally shared identification data from the national electronic identity verification system, including: Full Name, National Identification Number (ID/Passport number), Registered mobile phone number, Identity Verification Status (Level 2), and corporate entity representative details (if applicable).

The collected data is processed based on the Customer’s consent and the requirements for performing the service agreement, for the following purposes:

• Establishing, authenticating, and managing user accounts on the Selling Sync platform.
• Delivering the software’s core technical functions, including automated inventory synchronization, order workflow processing, predictive restocking, and AI-powered advertising campaign optimization.
• Calculating service fees, processing payment transactions, and issuing value-added tax (VAT) invoices in accordance with applicable laws.
• Sending technical notices, feature updates, and security alerts, and receiving support requests at contact@hemidi.com.
• Fulfilling legal, audit, and reporting obligations as required by competent governmental authorities.
• Purposes of Processing E-ID Data: We process VNeID verification data solely to: (i) Authenticate the legitimate identity of account owners operating on the platform; (ii) Prevent commercial fraud, scams, or identity misrepresentation in digital environments; and (iii) Fulfill statutory reporting and vendor-monitoring obligations required by competent government and state regulatory authorities.

Hemidi applies advanced technological measures to safeguard data:

• Data Encryption: All data transmitted between the Customer’s device and Selling Sync servers is encrypted using TLS 1.3. Data stored in databases is encrypted using AES-256.
• Enterprise Data Isolation: The system uses a multi-tenant architecture with strict logical separation. Each Customer’s business data, pricing information, and product catalog are fully isolated. No other Customer or third party is authorized to access that data.
• AI Training Policy: Hemidi commits not to use Customers’ proprietary business data or detailed sales information to train public AI models in ways that adversely affect Customers’ competitive advantage.

Hemidi does not sell, rent, or commercialize Customer data to any third party. Data is shared only in the following limited circumstances:

• With cloud infrastructure providers that meet international standards, for the purpose of hosting and operating the software.
• With e-commerce platforms through direct API connections initiated by the Customer.
  In response to written requests from governmental regulatory authorities, investigative authorities, or courts, in accordance with Vietnamese law.

Due to the nature of software supporting cross-border e-commerce operations, such as selling on Amazon in the United States and Europe, data may be processed on secure servers located outside Vietnam. Hemidi fully complies with the procedures for conducting personal data cross-border transfer impact assessments under Decree No. 13/2023/ND-CP.

Identity Verification Data Sharing: To complete the verification process, Selling Sync establishes secure application programming interface (API) data exchanges with the electronic identity system managed by the Ministry of Public Security or its legally authorized entities to validate user records. This cross-referencing process is fully encrypted and executed in strict accordance with the Law on Personal Data Protection (Decree 13/2023/NĐ-CP) and current cybersecurity technical frameworks.

Customers have all data subject rights under Decree No. 13/2023/ND-CP, including the right to be informed, the right to consent, the right to access, the right to rectification, the right to erasure, the right to withdraw consent, and the right to lodge complaints.

Customers may review and update their information directly through the Selling Sync account administration page or submit a formal request to contact@hemidi.com.

Hemidi’s security team will verify the Customer’s identity and process and respond to the request within 72 working hours.