Personal data and cookie policy

Name: Nhà Bè Khánh Hào
Address: Group 3, Rach Vem Quarter, Phu Quoc Special Zone, An Giang, 92516, VN
Telephone: 0774 029 983
Price range: 100.000đ - 650.000đ

This policy describes how Nha Be Khanh Hao collects, uses, stores and protects personal data when you visit the website, send booking requests, pay or contact support. NBKH never asks for passwords, PINs, banking OTP codes or financial login credentials. This English version is provided for convenience; where interpretations differ, the Vietnamese version prevails.

Last updated: 24/09/2026

Choose a sectionViewing: Controller and scope

Part 01

Controller and scope

Personal data controller

CÔNG TY TNHH NETCA (NETCA COMPANY LIMITED, abbreviated NETCA CO., LTD) operates the Nhà Bè Khánh Hào brand and is responsible for the data processing within the scope of these services. Enterprise/tax code: 1702371021. Head office: Group 3, Rach Vem Quarter, Phu Quoc Special Zone, An Giang Province. Data protection contact: Tran Phu Loc - Director of NETCA. Email: nhabekhanhhao.phuquoc@gmail.com. Phone: 0774 029 983.

Scope and who this applies to

This policy applies to website visitors, people sending booking or ticket requests, payers, people contacting for advice, people commenting on articles, speedboat passengers named in the list reported to the Border Guard, and representatives providing information for a group. Data of staff and partners, such as drivers bringing guests, falls outside this document.

Part 02

Data collected

Data you provide

Depending on the service, NBKH may receive your name, phone number, email, intended date and time, service type, total guest count, promo codes, note content and information needed to support the request. When you comment on an article, the website receives your display name, phone number and comment; only the display name and the comment are published. Allergy or health information you choose to write in the note field is handled as described under “Sensitive personal data”. Please don’t write identity documents or children’s personal data in the note field.

Technical data

When you use the website, the system may record access times, network address, browser or device type, page address, anti-abuse check results, session identifiers, error logs and the operations needed to maintain safety, rate limits and incident investigation. The network address is used only briefly for rate limiting and abuse prevention; the system does not store it in readable form, and the value used for rate limiting expires within 30 minutes at most. When you comment on or like an article, the system keeps, with that comment or like, a keyed one-way value derived from your network address to block duplicates and abuse. Infrastructure providers (Vercel, Cloudflare) keep access logs, including the network address, browser details and page address of each request; the providers themselves set how long those logs are kept under their own service terms, NETCA cannot set that period and states no figure for it. This technical data is behavioural tracking data and is handled as described under “Sensitive personal data”.

Booking and transaction data

NBKH processes request codes, Booking codes, chosen services, prepaid amounts, transaction amounts, transfer contents and references, payment statuses, e-tickets or QR codes and related support history. If you actively choose MoMo, the system may exchange the order code, request code, amount and necessary technical statuses with MoMo. NBKH never collects full card numbers, banking passwords, PINs, banking OTP codes or payment-account login credentials. If you choose a bank transfer, you may send a screenshot of the transaction so the raft can reconcile it. For speedboat trips, NETCA prepares the passenger list reported to the Border Guard Station as required by law; it contains each passenger’s full name, nationality, date of birth, sex, place of stay and ID card or passport number, plus the trip date and a contact phone number, and is used only for that report. From 23/09/2026, NETCA no longer collects these lists through the Google Forms form; the lists already collected remain in Google Sheets and are deleted 12 months after the trip date. For speedboat trips, staff may photograph guests on the speedboat to reconcile the number of passengers; the photos may show their faces, are kept in NETCA’s internal application and are deleted in a periodic review, no later than 90 days after the trip date.

Sensitive personal data

NETCA handles the following as sensitive personal data: (1) behavioural tracking data on the website, meaning the measurement data sent to Google Analytics and Google Ads with your consent and the technical logs described under “Technical data” (Article 4(1)(l) of Decree 356/2025/ND-CP); (2) allergy or health information you choose to write in the note field (Article 4(1)(d) of Decree 356/2025/ND-CP); (3) transfer screenshots you choose to send, which may show bank account and transaction details (Article 4(1)(k) of Decree 356/2025/ND-CP). Measurement data is processed only when you consent to each purpose separately on the cookie notice; health information is used only to prepare food and arrange the visit you booked, including the speedboat trip; transfer screenshots are used only to reconcile the payment. NETCA restricts access to this data to authorised staff, encrypts contact details and notes when they move from the booking system to the internal application, and does not use this data for remarketing or ad personalisation.

Part 03

Processing and sharing

Purposes of processing

Data is processed to receive and fulfil requests; verify payments; issue, look up and manage Bookings; prepare passenger lists reported to the authorities; contact you for advice or changes; support customers, reconcile and resolve complaints; prevent fraud and protect the system; keep proof of your cookie choices; and meet accounting, tax and lawful government requirements. In addition, only where you consent to each purpose separately on the cookie notice, the website processes data for two measurement purposes: (1) page-view measurement with Google Analytics; (2) ad measurement with Google Ads, including whether an ad led to a booking. Booking data is not used for advertising, except the prepaid amount and a random transaction code sent to Google Analytics when you turn on purpose (1) and to Google Ads when you turn on purpose (2), as set out under “Google measurement tools”.

Legal bases

Depending on the case, processing rests on your consent, on fulfilling a request or transaction you initiated, on NETCA’s legal obligations, or on protecting legitimate rights and interests within what the law allows. Measurement with Google tools rests solely on your consent, given separately for each purpose; if you do not consent you can still use the website and book as usual. You may withdraw consent for consent-based processing; withdrawal does not undo the lawfulness of prior processing and does not remove legally required retention. Passenger lists for speedboat trips are prepared to meet statutory reporting duties. Allergy or health information you choose to write in the note field is processed to carry out the Booking you asked for (Article 19(1)(d) of Personal Data Protection Law No. 91/2025/QH15). The cookie consent log, including refusals, is kept to meet the duty to store and prove consent under Article 6(2) of Decree 356/2025/ND-CP and to prove that the website respected a choice not to consent.

Email OTP and Booking lookup

Where online lookup is offered, you authenticate with a one-time code sent to your registered email. The code is valid only for the announced period and only for the matching authentication request. Never forward OTP codes or lookup links to anyone. This flow does not use SMS OTP.

Who can access or process data

Data is shared only as needed with authorised NETCA staff; the infrastructure, email and tool providers listed under “Recipients outside Vietnam”; Zalo/VNG when you choose to open its page or a conversation; Meta Platforms (Messenger) when you choose to open a Messenger conversation; Google LLC (Google Analytics, Google Ads) for the measurement purposes you have turned on, within the scope set out under “Google measurement tools”; banks, MoMo or payment intermediaries strictly per the method you chose; the Border Guard Station for speedboat passenger lists; professional advisers; and competent state agencies on lawful grounds. The website never sends passwords, PINs, OTP codes or payment-account credentials to Zalo or MoMo. Sharing depends on the services actually used and applicable confidentiality duties. NBKH does not sell personal data.

Recipients outside Vietnam

The parties below receive or store your personal data on servers located outside Vietnam; this is a transfer of personal data abroad. NETCA transfers only the data needed for the purpose stated in the table, under each party’s service terms and data processing terms. Measurement data and YouTube video requests are transferred only when you turn on the matching purpose or press play.

Recipients of personal data outside Vietnam
Recipient	Data	Purpose	Where processed
Vercel Inc. (United States)	Network address, browser details and page address when you visit the website; Booking data shown to staff in the customer-management portal; name, Booking code, service, date, time, amount and the ticket QR image to render the ticket image sent by email	Running the website and the customer-management portal; rendering the ticket image attached to emails	Vercel infrastructure, outside Vietnam
Cloudflare, Inc. (United States)	Booking requests, Bookings, payment details, notes, transaction screenshots, comments, the cookie consent log; access logs of the booking system, including the network address and browser details of each request; network address and browser signals during the anti-automation check (Turnstile); photos of guests on the speedboat in the internal application, which may show their faces	Receiving and processing booking requests, passing data to the internal application, keeping the consent log, storing the internal application’s reconciliation photos, preventing abuse	Cloudflare infrastructure, outside Vietnam
Supabase Pte. Ltd. (Singapore)	Name, phone number, email, service, notes and payment status of Bookings passed to the internal application; records of speedboat guest photos	Managing Bookings, serving guests and reconciliation	Singapore
Plus Five Five, Inc. (Resend) (United States)	Email, name, Booking code, confirmation, invoice and ticket emails, and lookup OTP codes	Sending emails to guests	Resend infrastructure, outside Vietnam
Sanity US Inc. (United States)	Network address and browser details when your browser loads website images	Storing and delivering website images	Sanity content delivery network, outside Vietnam
Google LLC (Google Analytics) (United States)	The measurement data set out under “Google measurement tools”, only when you turn on purpose (1)	Page-view measurement	Google data centres, outside Vietnam
Google LLC (Google Ads) (United States)	The measurement data set out under “Google measurement tools”, only when you turn on purpose (2)	Ad measurement and bookings that come from ads	Google data centres, outside Vietnam
Google LLC (YouTube) (United States)	Network address, browser details and data stored on your device, only when you press play on a video	Playing videos in articles	Google data centres, outside Vietnam
Google LLC (Gmail) (United States)	Emails you send to nhabekhanhhao.phuquoc@gmail.com, including personal-data requests and complaints	Receiving and answering your emails	Google data centres, outside Vietnam
Google LLC (Google Forms, Google Sheets) (United States)	Speedboat passenger lists collected before 23/09/2026: full name, nationality, date of birth, sex, place of stay, ID card or passport number, trip date and a contact phone number	Reporting to the Border Guard Station; from 23/09/2026 NETCA no longer collects lists through these two tools	Google data centres, outside Vietnam
Meta Platforms, Inc. (Messenger) (United States)	Conversation content and account details when you choose to message us on Messenger	Answering you on Messenger	Meta infrastructure, outside Vietnam

Part 04

Retention period

Data is kept for as long as the announced purposes require and within the periods below. Only three groups are currently deleted automatically on a schedule: expired lookup OTP codes, the values used for rate limiting and the intake error logs. NETCA deletes or anonymises the remaining groups in a periodic review, or promptly when you ask for deletion; NETCA has no automated job that deletes those groups, so the periods below are outer limits, not the moment of automatic deletion. When a period ends, NETCA deletes or anonymises the data unless the law requires longer retention. Booking, transaction, invoice and voucher records follow statutory accounting, tax, consumer-protection and dispute-resolution periods.

Data retention periods
Data	Retention period
Booking requests not paid	30 days after the payment deadline
Advice requests	90 days after sending, or 30 days after the appointment date if earlier
Notes, including health information	90 days after the service date
Contact details and consent records of a Booking	3 years after the request
Accounting vouchers and invoices	10 years under accounting law
Transfer screenshots	90 days after sending
Lookup OTP codes	5 minutes for the code, deleted automatically on a schedule; lookup records no longer than 90 days
Values used for rate limiting	30 minutes at most
Article comments and likes	Until you ask for deletion or NETCA removes the article
Speedboat passenger lists	12 months after the trip
Booking data in the internal application and the customer-management portal, including notes	As the matching row above
Photos of guests on the speedboat in the internal application	90 days after the trip
Measurement data in Google Analytics	2 months (event-level and user-level data)
Google measurement cookies	As in the cookie table under “Google measurement tools”
Cookie consent log	5 years after recording
Cookie choices on your device	Valid for 12 months
Infrastructure providers’ access logs	Per the provider’s own terms; NETCA cannot set this period

Google measurement tools

The cookie notice offers two purposes, both off by default, which you turn on separately: (1) “Page-view measurement (Google Analytics)”; (2) “Ad measurement (Google Ads)”. The data these tools collect is behavioural tracking data and is handled as sensitive personal data. Only when at least one purpose is on does the website load the Google LLC tag for that purpose; until you choose, or once both purposes were already off when the page was opened, the website sends no request to Google Analytics or Google Ads. For purpose (1), data sent to Google comprises the pages you view (including campaign parameters in the address), the page title, the previous page, what you do on the page such as scrolling, clicking outbound links and interacting with forms, the time of the visit, your browser’s Google Analytics identifier and session identifier, device type, screen size, browser, language, your IP address and the approximate location derived from it; when a Booking is confirmed, the website also sends the amount you prepaid and a random transaction code that is not derived from the Booking code or any of your details. The Google Analytics tag may send each event to both Google Analytics’ own servers and Google LLC’s www.google.com domain. For purpose (1), Google LLC processes the data on NETCA’s behalf under Google’s data processing terms; data from purpose (1) is used only to provide the Google Analytics service to NETCA and is not passed to Google Ads. For purpose (2), data sent to Google comprises the ad click identifier when you arrive from an ad, your browser’s advertising identifier, the pages you view and their titles, your IP address, device, browser and, when a Booking is confirmed, the prepaid amount and the random transaction code above, so that Google Ads can tell whether an ad led to a booking. For purpose (2), Google LLC receives the data as an independent controller and processes it under Google’s policies at policies.google.com/technologies/partner-sites. The website does not send Google your name, phone number, email, note content, terms typed into the article search box or payment information; before the tag reads the page address, the website removes note, search and payment-transaction parameters from it; and the website does not use this data for remarketing or ad personalisation and sets Google’s tags to refuse ad personalisation. Google LLC may process the data on servers located outside Vietnam; this is a transfer of personal data abroad and happens only for the purposes you have turned on. Google may also read or write cookies on Google’s own domains under Google’s policies; the website does not control and cannot delete those cookies. You can change your choices or withdraw consent at any time via “Cookie settings” in the footer; each choice is recorded in the log described under “Cookie consent log”. When you turn off a purpose that is running, the website tells Google to stop, deletes that purpose’s cookies on this domain and reloads the page; if you are on the booking page or have unsaved input, the website does not reload, to keep what you entered, and the Google library already loaded is only removed, or reloaded to match your new choice, when you open a page other than the booking page; data recorded just before you chose may still be sent afterwards. Withdrawal does not affect processing carried out before it. Event-level and user-level data linked to your browser identifier in Google Analytics is kept for 2 months and is deleted by Google in its next monthly deletion run; aggregated reports not linked to any browser may be kept longer. How Google uses information from sites that use its services is described at policies.google.com/technologies/partner-sites.

Cookies and browser storage used for measurement
Name	Set by	Purpose	Duration
_ga	Google Analytics	Page-view measurement: Tells browsers apart	2 years
_ga_WML9F2472G	Google Analytics	Page-view measurement: Keeps the session state	2 years
_gcl_au	Google Ads	Ad measurement: Links a booking to an ad	90 days
_gcl_aw, _gcl_dc, _gcl_gb, _gcl_gs, _gcl_ag	Google Ads	Ad measurement: Stores the ad click identifier	90 days
_gac_*	Google Ads	Ad measurement: Stores the ad click identifier	90 days
_gcl_ls	Google Ads	Ad measurement: Copy of the ad click identifier in local storage	No fixed expiry; the website deletes it when you turn ad measurement off
nbkh_dong_y_cookie	Nhà Bè Khánh Hào	Remembers your cookie choices, in local storage	Valid for 12 months; stays on your device until you clear browser data
nbkh_dong_y_ma	Nhà Bè Khánh Hào	Random cookie choice code, counter, and the Google Analytics client ID linked when you turn page-view measurement on, so the consent log can link choices from the same browser; in local storage	Until you clear browser data
nbkh_dong_y_hang_cho	Nhà Bè Khánh Hào	Choices not yet delivered to the consent log, resent on a later page, including the Google Analytics client ID when the choice is the linking event; in local storage	30 days at most

Cookie consent log

Each time you choose on the cookie notice (agree, refuse, change or withdraw a purpose), your browser sends a record to NETCA’s system. The record contains a random cookie choice code created by your browser, the choice’s sequence number, the type of action, your choice for each purpose, the version and content identifier of the cookie notice, the version of this policy, the language, the time you chose and the time the system received it. While purpose (1) is on, your browser also sends a separate record carrying your browser’s Google Analytics identifier, so that NETCA can find and delete the matching data in Google Analytics if you ask or if you withdraw purpose (1). The records contain no IP address, browser details, referring page, name, phone number or email; the infrastructure provider’s access log of the request that delivers a record is handled as described under “Technical data”. The log is stored in the booking system’s database run by Cloudflare, Inc. outside Vietnam, can only be added to, never edited, and is kept for 5 years after recording so that NETCA can prove consent under Article 6(2) of Decree 356/2025/ND-CP. NETCA keeps the exact text of every version of the cookie notice, and of every version of this policy since version 2026-09-16-v6. Your current cookie choice code is shown when you open “Cookie settings”; include it when you ask to see or delete your Google Analytics data.

Third-party content and services

The Zalo contact button opens the official account page in a new tab when you choose it. The website does not load the Zalo chat SDK or iframe before that action. Zalo may receive technical data when its page opens; conversation content and account information you provide are processed under Zalo’s own policy. The Messenger button opens m.me in a new tab when you choose it; the website does not load Meta’s SDK, and Meta processes the conversation under its own policy. YouTube videos in articles load only when you press the play button; before that the page sends no request to Google for the video. When you press play, your browser loads the video from Google LLC’s youtube-nocookie.com; Google receives your IP address and browser details and may store data on your device under Google’s policies, and the measurement cookie choices do not cover this video. Map links open Google Maps in a new tab when you choose them; the website embeds no maps. Website images load from Sanity’s content delivery network, and Cloudflare’s Turnstile anti-automation tool loads only on the booking, lookup and comment forms; both receive your IP address and browser details as set out under “Recipients outside Vietnam”. The website may also link to payment services and third-party pages. NBKH uses configurations that limit tracking where feasible but does not control third parties’ independent processing.

Protection measures

NBKH applies encrypted connections, access control, authentication, rate limiting, anti-automation, security logging and organisational measures proportionate to risk. No system removes all risk; if an incident occurs, NETCA isolates, assesses, remediates and notifies per applicable legal obligations. For sensitive personal data, NETCA limits access by role and encrypts contact details and notes when they move from the booking system to the internal application.

Part 05

Rights and validity

Your rights

Within what the law allows, you have the right to be informed; to consent or withdraw consent; to access, correct, request a copy of, delete or restrict processing; to object; and to complain, denounce or claim damages. On receiving a valid request, NETCA responds within 02 working days and carries it out within the time limits of Article 5 of Decree 356/2025/ND-CP, counted from receipt: withdrawal of consent, restriction or objection within 15 days, or 20 days where a processor or third party such as Google must be asked to stop; access, correction or a copy within 10 days, or 15 days where a processor or third party must correct the data; deletion within 20 days, or 30 days where a processor or third party must delete it; applying measures to protect your personal data within 15 days. For complex requests NETCA may extend once, by no more than 15 days for withdrawal, restriction, objection or protection measures, 10 days for access, correction or a copy and 20 days for deletion, and will tell you why. Withdrawal via “Cookie settings” applies immediately in your browser and is recorded in the consent log; when you withdraw purpose (1), NETCA uses the consent log to ask Google Analytics, within 20 days, to delete the data linked to that browser identifier. To delete measurement data already sent to Google Analytics, include the cookie choice code shown under “Cookie settings”; NETCA looks up the consent log for the matching Google Analytics identifier and deletes it with Google Analytics’ user deletion tool; according to Google, the data stops showing within 24 hours and is removed from Google’s systems within 63 days at most. Data from purpose (2) is not linked to the cookie choice code; NETCA passes your request to Google, and you can also use Google’s own ad management tools. NETCA may ask for reasonable information to verify the requester and may refuse or limit requests on legal grounds, stating the reason.

Children’s and companions’ data

A group representative must be authorised to provide contact details and headcounts. The website asks only for aggregate numbers used to price and arrange services; don’t enter children’s names, phone numbers, documents or sensitive data in the notes. Should more children’s data ever be needed, NETCA runs proper guardian verification and consent steps.

Sending a personal-data request

Send personal-data requests to nhabekhanhhao.phuquoc@gmail.com or call 0774 029 983. You can copy the form below into your email and fill in every field; a Booking code or cookie choice code helps NETCA find the right data. A request to withdraw consent or restrict processing must be made in writing, including electronically; if you make it by phone, NETCA confirms it back to you by email so that there is a record. Never send passwords, banking OTP codes or lookup OTP codes by email or phone. NETCA verifies the requester, records the request with its time of receipt, and responds and acts within the time limits under “Your rights”; where more time is needed or the request cannot be fulfilled, you will be told why.

Personal-data request form
Field	What to write
Full name	Name of the person making the request
How to reach you	Email or phone number for NETCA’s reply
Type of request	One of: access, correction, copy, deletion, restriction, objection, withdrawal of consent
Data or service concerned	For example: a Booking, a comment, Google Analytics measurement data
Reference code (if any)	Booking code or cookie choice code
Date sent	Date you send the request (dd/mm/yyyy)

Complaints and feedback

You can complain or give feedback about personal data protection via nhabekhanhhao.phuquoc@gmail.com or 0774 029 983. NETCA receives and records it and responds within 02 working days. Where the complaint is a data-subject rights request, NETCA answers within the periods set out under “Rights of the data subject”; for anything else, NETCA tells you the deadline for its outcome when it acknowledges the complaint. If you disagree with the outcome, you may complain or denounce to the competent state authority for personal data protection or bring a lawsuit as provided by law.

Policy updates

The current version is 2026-09-24-v9. Every change carries its update date and is announced on the website at or before taking effect. If a change creates a new processing purpose requiring consent, NETCA will notify you and seek fresh consent instead of silently applying it to data already collected. NETCA keeps the exact text of every version of this policy since version 2026-09-16-v6, and of every version of the cookie notice. Your cookie choices are valid for 12 months; after that, or whenever this policy version or the notice text changes, the cookie notice asks again.