Privacy Policy
1. Controller and contact
CÔNG TY CỔ PHẦN LUMEN HARU (LUMEN HARU JOINT STOCK COMPANY; MST 0319543071; Phòng 3.03, Lầu 3, Tòa nhà St. Moritz, 1014 Phạm Văn Đồng, Phường Hiệp Bình, Ho Chi Minh City, Vietnam) is the controller of personal data collected through this website. Data-protection contact: Ms. Vũ Thị Minh Ngọc (Director of Brand Development and Retail Market, kiêm CTO-Lite) — privacy@lumenharu.com. Regional: vn@ / kh@ / jp@lumenharu.com.
2. Scope
This Policy explains what personal data we collect, why, how we share and protect it, how long we keep it, and your rights. It applies to our website, quotations, orders and customer support across the Global, Vietnam, Cambodia and Japan Markets. Where local law gives you greater rights, those apply.
3. Data we collect
- You provide: name, company/role, email, phone, billing and delivery address, order and quotation details, tax/VAT identifiers where required, payment reference (not full card data), and the content of your messages.
- Automatically: IP address, device and browser type, approximate location, pages viewed, referring links, and similar data via cookies/analytics (§10).
- From third parties: confirmation of payment and limited transaction data from payment providers; delivery status from carriers.
We do not intend to collect sensitive/special-category data; please do not send it to us.
4. Purposes, legal basis and granular consent
| Purpose | Basis |
|---|---|
| Respond to quotes/enquiries; create and manage your account | Steps toward a contract; performance of contract (Đ.17.1(d) NĐ 13/2023) |
| Process, deliver and support your order | Performance of contract |
| Take payment; detect and prevent fraud | Contract; legitimate interest; legal duty |
| Issue invoices; meet tax, accounting and e-commerce record-keeping (incl. VN 3-year transaction retention) | Legal obligation |
| Service messages about your order | Performance of contract |
| Marketing emails (if you opt in) | Consent — separate, un-bundled, may be withdrawn any time |
| Improve, secure and analyse the website — non-essential cookies | Consent via cookie banner — separate, may be withdrawn any time |
Granular consent at checkout and forms. At checkout and on our contact/quote/newsletter forms, we present separate un-ticked opt-ins for (i) processing needed to perform your Order (no separate consent required — this is contract necessity under Article 17.1(d) of Decree 13/2023/NĐ-CP), (ii) marketing communications (optional), and (iii) non-essential cookies/analytics (via the cookie banner). Choosing not to accept (ii) or (iii) does not prevent you from placing an Order. We record consent with timestamp and form version per Article 11(4) of Decree 13/2023/NĐ-CP.
5. Sharing and processors
We share personal data only with: - Service providers acting for us — (a) payment: currently only Vietcombank (direct bank transfer to Lumen Haru's account) — no payment gateway is currently contracted; VNPAY (VN), ABA PayWay (KH), KOMOJU (JP) and a card processor (Global) are planned and will be added when contracted; (b) delivery / logistics carriers: delivery carrier partners disclosed at order confirmation, updated as contracts are signed (see Shipping Policy §4); (c) hosting: Automattic Inc. (USA) via WordPress.com Business + Jetpack; (d) email transactional service (WordPress.com built-in). Each may use personal data only to provide their service to us under contract. - Professional advisers, or in a business transfer, under confidentiality. - Authorities/courts where required by law.
We do not sell your personal data or use it for third-party advertising.
6. International transfers
We operate across Vietnam, Cambodia, Japan and internationally and use providers in different countries, so your data is transferred across borders. The following personal-data transfers to non-Vietnam recipients are in place:
| Recipient | Location | Purpose | Data types |
|---|---|---|---|
| Automattic Inc. | USA | Website hosting (WordPress.com Business + Jetpack), edge cache/CDN, backups, security | All personal data submitted through the Site (name, email, phone, order details, IP, cookies) |
Note: Previously we relied on Google Fonts (Google LLC, USA) for web-font delivery. As of 17 July 2026 all fonts are self-hosted on our infrastructure at Automattic; no personal data (including IP) is transferred to Google. Automattic Inc. is the sole non-Vietnam recipient.
We have completed a Transfer Impact Assessment (Hồ sơ đánh giá tác động chuyển dữ liệu cá nhân ra nước ngoài) for the above transfer and file it with the Cybersecurity and High-Tech Crime Prevention Department (A05, Ministry of Public Security) by 14 September 2026 — within 60 days of checkout go-live on 16 July 2026 — per Article 25 of Decree 13/2023/NĐ-CP. A copy of the current assessment is available on request to privacy@lumenharu.com. For onward transfers of Japan-origin personal data we comply with APPI Articles 27–28.
7. Retention
We keep personal data only as long as needed for the purposes above and to meet legal retention duties — including the Vietnam e-commerce duty to retain transaction data for at least 3 years, e-invoice retention ≥10 years under Nghị định 123/2020/NĐ-CP and Luật Kế toán 2015, and applicable tax/accounting periods — after which we delete or anonymise it. Account data is kept while your account is active and for a reasonable period afterward.
8. Security
We use reasonable technical and organisational measures (access controls, encryption in transit, vetted processors) to protect personal data. No transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Data breach
If a personal-data breach occurs, we will notify: - the Cybersecurity Department (A05) within 72 hours of becoming aware of it, and affected individuals as required (Vietnam — Article 23 of Decree 13/2023/NĐ-CP); - the Personal Information Protection Commission (PPC) without delay and affected individuals in a manner appropriate to the circumstances (Japan — APPI Article 26); - other authorities per applicable law in your Market.
10. Cookies and similar technologies
We use two categories of cookies. You can accept or reject non-essential cookies via our cookie banner and change your choice at any time via the "Cookie settings" link in the footer.
Strictly-necessary cookies — set automatically; the site and checkout cannot function without them. These do not require consent.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
lh_market |
Market/storefront preference | Lumen Haru (1st-party) | 12 months |
lh_lang |
Language preference | Lumen Haru (1st-party) | 12 months |
wp_woocommerce_session_* |
Shopping session | WooCommerce (1st-party) | 48 hours |
woocommerce_items_in_cart, woocommerce_cart_hash |
Cart state | WooCommerce (1st-party) | Session |
wp-settings-* |
Staff-account preferences | WordPress (1st-party) | 12 months |
Analytics and order-attribution cookies — set only after your explicit opt-in via the cookie banner. Withdraw any time.
| Cookie | Purpose | Provider | Duration | Cross-border |
|---|---|---|---|---|
tk_or, tk_r3d, tk_lr, tk_ai, tk_qs |
Jetpack analytics | Automattic Inc., USA | Session | Yes — to USA |
sbjs_current, sbjs_first, sbjs_udata, sbjs_session, sbjs_migrations, sbjs_promo |
Order-source attribution | 1st-party | ≤ 6 months | No |
Cross-border processing of Jetpack analytics data (Automattic Inc., USA) is covered by our Transfer Impact Assessment (§6). If you decline analytics cookies, your Order and Site experience are unaffected.
11. Marketing
We send marketing only where you have opted in (granular, un-bundled — see §4) and you can unsubscribe at any time via the link in each email or by contacting us.
12. Your rights
Subject to your local law you may: access your data; correct/update it; delete it; restrict or object to processing; withdraw consent; and request a copy. In Vietnam (PDPD) you also have rights to be informed, to consent and withdraw, to access, correct, delete, restrict, object, and to complain and claim; in Japan (APPI) rights to disclosure, correction, and cessation of use/provision; in Cambodia, rights under applicable law. To exercise a right, contact privacy@lumenharu.com; we respond within the period the law requires and may need to verify your identity. You may also complain to your national data-protection authority — in Vietnam, the Cybersecurity and High-Tech Crime Prevention Department (A05), Ministry of Public Security.
Consent-log retention. We retain cookie-consent records (decision, timestamp, form version, hashed IP, user-agent, market, language) for at least 3 (three) years in order to demonstrate consent as required by Article 11(4) of Decree 13/2023/NĐ-CP.
13. Children
The website is for business and adult purchasers. The minimum age is 18 in all Markets. We do not knowingly collect data from persons under 18; if you believe a child has provided data, contact us and we will delete it.
14. Automated decisions
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. [UPDATE IF THIS CHANGES.]
15. Changes and contact
We may update this Policy; the current version and its date are always posted here, and we will notify you of material changes where required. Questions or requests: privacy@lumenharu.com · LUMEN HARU, Phòng 3.03, Lầu 3, Tòa nhà St. Moritz, 1014 Phạm Văn Đồng, Phường Hiệp Bình, TP. Hồ Chí Minh.