Who we are
SenBPO (“SenBPO”, “we”, “us”) is a business process outsourcing company based in Hanoi, Vietnam. We are the controller of the personal data described in this policy. Privacy requests and questions are handled by our Founder and CEO, Phoebe Dinh, at phoebedinh@senbpo.com.
This policy is written to meet the EU and UK General Data Protection Regulation (GDPR), Singapore’s Personal Data Protection Act (PDPA), Vietnam’s Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, and the privacy laws of the United States, including the California Consumer Privacy Act (CCPA/CPRA). It applies to visitors from every country.
The short version
- We collect only what you send us and the technical data needed to run and protect the site.
- We use it to reply to you, to run the website and to meet our legal duties.
- We do not sell personal data, and we do not use advertising or tracking cookies.
- You can ask us to show, correct or delete your data at any time.
What personal data we collect
What you give us. If you use the contact form, we receive your name, email address, how you heard about us and your message. The form also records which page you sent it from and the time. If you write or call us by email, phone, WhatsApp or LinkedIn, or send a CV, we receive what you choose to share. Please do not send sensitive information such as health, ID or financial details.
What we collect automatically. When you visit the site, our hosting provider, Cloudflare, processes technical data to deliver and protect it: your IP address, browser and device type, the pages requested and the time of each request. We do not use this data to build profiles of visitors.
Cookies and browser storage. We use a small number of necessary cookies and browser storage items. Optional cookies for analytics or marketing are off unless you accept them. See the Cookie Policy for the full list.
Why we use your data, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your enquiry, arrange a call and prepare a proposal | Name, email, message, form details | Steps at your request before a contract; our legitimate interest in running our business (GDPR Art. 6(1)(b), (f)) |
| Consider a job application | CV and contact details you send | Steps at your request; our legitimate interest in hiring |
| Deliver, secure and maintain the website; prevent abuse and spam | Technical data | Legitimate interest in a secure, working site |
| Remember your cookie choice | Your consent choice and its date | Legal obligation and legitimate interest in respecting your choice |
| Analytics or marketing cookies, if we add any | Only what the tool collects | Your consent, which you can withdraw at any time |
| Meet legal duties and handle legal claims | Any of the above | Legal obligation; legitimate interest |
Where Singapore or Vietnamese law applies, we rely on your consent, including the consent you give when you submit the form for the purpose stated above, or on another lawful ground those laws allow. You may withdraw consent at any time; this does not affect processing that already took place.
Who we share it with
- Service providers that host and secure the site and store form submissions (Cloudflare, including its D1 database), and the email and communication tools we use to answer you. They act on our instructions or under their own privacy terms.
- Messaging platforms such as WhatsApp or LinkedIn, only if you choose to contact us through them. Their own privacy policies apply.
- Professional advisers and authorities where the law requires it, or to establish or defend a legal claim.
- A future owner of the business, if SenBPO is ever merged or sold, under the same protections.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.
International transfers
We operate from Vietnam, and Cloudflare serves the site from data centers around the world. Your data may therefore be processed outside your own country. Where the law requires safeguards for such transfers, we rely on them, for example standard contractual clauses and the data protection terms of our providers, and we complete any assessment or filing that Vietnamese law requires for cross-border transfers.
How long we keep it
- Contact enquiries: up to 24 months after our last contact with you, then deleted. If we start working together, records are kept as long as the contract and the law require.
- Job applications: up to 12 months, unless you ask us to delete them sooner or we hire you.
- Technical data: held by Cloudflare for the short periods set in its own policies.
- Cookie choice: up to 12 months in your browser, after which we ask again.
How we protect it
The site is served over HTTPS. Form submissions are stored in an access-controlled database, and only people who need them to answer you can see them. No system is completely secure. If a breach affects your data, we will notify you and the authorities as the law requires.
Your rights
Wherever you live, you can ask us to tell you what data we hold about you, to correct it, to delete it, to stop using it, or to give you a copy. You can also withdraw any consent you gave. Depending on where you live, you have these additional rights:
- European Economic Area and United Kingdom (GDPR): access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interests. We do not make decisions about you by automated means that have legal or similarly significant effects. You may complain to your local data protection authority.
- Singapore (PDPA): access to and correction of your data, and withdrawal of consent. You may complain to the Personal Data Protection Commission.
- Vietnam (Law 91/2025/QH15 and Decree 356/2025/ND-CP): to be informed, to consent or withdraw consent, to access, correct, delete, restrict or object to processing, to request your data, to complain and to claim compensation as the law provides. You may contact the Ministry of Public Security, the state authority for personal data protection.
- United States (California and other states): to know what we collect and why, to access, correct and delete your data, to opt out of the sale or sharing of personal data (we do neither), and not to be treated unfairly for using these rights. An authorized agent may make a request for you.
To use any of these rights, email phoebedinh@senbpo.com with the subject “Privacy request”. We may ask you to confirm your identity. We reply without undue delay and within the deadline the applicable law sets, for example one month under the GDPR and 45 days under the CCPA. Exercising your rights is free.
Children
This website is for business visitors and is not directed to anyone under 16. We do not knowingly collect data from children. If you believe a child has sent us data, tell us and we will delete it.
Cookies
When you first visit, a notice asks you to accept or reject optional cookies. Necessary cookies are always active because the site needs them to work securely. You can change your choice at any time with “Cookie settings” in the footer. Read the Cookie Policy for details.
Links to other sites
Our pages link to other websites and services, for example LinkedIn, WhatsApp and AI assistants. They have their own privacy policies, and we are not responsible for them.
Changes to this policy
We will update this page when our practices or the law change, and change the date above. If a change affects how we use your data in a significant way, we will make that clear on this page before it takes effect.
Contact and complaints
Questions or concerns? Email phoebedinh@senbpo.com. We would like the chance to fix a problem first, but you always have the right to complain to your local data protection authority.