How Italian Chamber of Commerce in Vietnam handles your personal data.
This notice explains what personal data Italian Chamber of Commerce in Vietnam collects from members, applicants, event guests, newsletter subscribers and visitors, why, who else handles it, how long it is kept and what you can ask for. It is written to meet the notice requirements of Vietnam's Personal Data Protection Decree and, for people who are in the European Union, the General Data Protection Regulation.
Last updated 5 October 2026
Who is responsible for your data
Italian Chamber of Commerce in Vietnam is the organisation that collects your personal data and decides how it is used. Its office is at 5th Floor, Deutsches Haus, 33 Le Duan Boulevard, District 1, Ho Chi Minh City. Questions and requests about your data go to info@icham.org.
The chamber runs its membership, invoicing, events, website and email on a platform operated by VentureLK LLC (Delaware, United States). VentureLK LLC processes personal data only on the chamber's instructions and under a written agreement, and does not use it for any purpose of its own.
What we collect, and from whom
The chamber holds different details depending on how you deal with it.
Members and their representatives: the company, its address and registration number, the names, roles, email addresses and phone numbers of the people who represent it, the membership tier, dues, invoices, receipts and payment status, and the notes the office keeps about the relationship.
Applicants: what you enter on the membership application form, including the tier you choose and your answers to the chamber's questions. For a membership type with an age or student requirement, also what that needs: your confirmation, and your date of birth or a student card or ID if the type asks for one. Some types also ask which country you are based in. A one-way fingerprint of the network address the application was sent from is kept with it, only to stop abuse of the form.
Event guests: your name, organisation and email address, your ticket, any dietary or accessibility note you give us, and whether you attended.
Guests booked by someone else (for example at a table): the name the booker gives for you, your email and dietary note if they add them, and whether you attended. If you book for others, please share only what they are happy for the chamber to have.
Newsletter subscribers: your email address, your name if you give it, the lists you choose, every consent, unsubscribe and preference change, and, where open and click tracking is switched on for the domain the email is sent from, whether each campaign email was opened and whether a link in it was clicked, recorded through a small tracking image and redirected links.
Everyone who signs in: the email address a one-time code is sent to, and an audit log of the actions it records, with who took them and when. The audit log keeps a network address only for staff sign-ins, failed staff sign-ins, two-factor steps, the platform operator entering a chamber, agreements signed or declined electronically and refused requests. It keeps the browser only for agreements signed or declined electronically.
People who use the member app: the sign-ins that keep them signed in, and their phone's push token if they allow notifications. The chamber can sign anyone out of the app at any time.
People asked to sign an agreement electronically: their name and email address, their signature and the fields they fill in, when they opened, agreed to sign, signed or declined, and the network address and browser they did it from. The network address is printed on the agreement's certificate of completion.
Members who let us know they have paid another way (for example by bank transfer or cheque): how and when you paid, the reference, any note, and a slip or photo if you send one.
Card details are never collected by the chamber or its platform. They are entered on the payment provider's own page.
Why we use it
Administering membership: applications, the member roster, renewals, dues, invoices and receipts.
Running events: registration, tickets and entry passes, attendance, and the practical arrangements of an event.
Communicating: newsletters and invitations to those who have agreed to receive them, and messages about your own membership, invoices and registrations to everyone.
The member directory, which shows member companies to other members, or to everyone if the chamber makes it public: the company's name, industry, city and website, its membership type and the year it joined, and its description if the company shows it. The primary contact's email or phone appears only if the primary contact chooses to show it.
Keeping the records the law requires the chamber to keep, and keeping the system secure.
The legal basis, where the GDPR applies
For people who are in the European Union, the chamber relies on its membership agreement with you or your organisation, on your consent for marketing email, on its legitimate interest in running the chamber and keeping it secure, and on its legal obligations for accounting records. You can withdraw consent for marketing email at any time; that does not affect anything done before you withdrew it.
Who else processes it
The platform runs on providers under contract, who handle data on the chamber's behalf. Each line says what a provider receives and when.
Vercel Inc.: hosts the application, in its Singapore region.
Neon Inc.: the database, on Amazon Web Services in Singapore.
Documents uploaded to the chamber's document library: kept in the database, or in private file storage on Vercel, and served only to people signed in to the chamber. Some documents uploaded before the library moved behind sign-in may still be held in public file storage, at an address that is not listed anywhere, until they are moved.
Vercel Blob: hosting for the public images on the chamber's website and newsletters. These are published pictures, which can show people (event photographs, for example).
Resend Inc., United States: delivers email, from sign-in codes and invoices to newsletters, and, where open and click tracking is switched on for the domain the email is sent from, reports whether each campaign email was opened and whether a link in it was clicked. Mail from a chamber that has verified its own sending domain is sent from Resend's European (Ireland) region.
Mistral AI, France: the writing assistant chamber staff use to draft, processing in Europe, on paid terms under which Mistral does not use the data to train its models. It sees only what a task needs: the record a message is about, which can include a name and email address; text staff paste in for it to read, such as notes, an email or a venue's proposal; when staff prepare renewals, the members being prepared (up to twelve at a time), with their primary contact, invoices, event attendance and recent notes; when staff ask the workspace assistant a question, a summary of the chamber: up to 30 member companies with their membership type and renewal outlook, the totals owed, events and email statistics; when staff work the sales pipeline, the prospects on it, with their contacts' names, titles, emails and notes; when staff plan or review an event, its details, speakers, sponsors, income and costs; when staff match a bank transfer to a member, the payer's name and the member companies' names; and when staff ask about a document, that document's text. It never sees passwords or card numbers.
Expo (650 Industries, Inc.), United States: delivers notifications to the member app. When someone allows notifications, it receives their phone's push token, and then the title and text of each notification sent to it.
The chamber's payment provider (Stripe, or Newebpay in Taiwan), when the chamber takes payments online: takes the payment on its own page and receives the payer's email address, the amount and what it is for.
LY Corporation (LINE), Japan: only when the chamber has connected its LINE account and someone links theirs to it. It carries the chamber's event reminders to them on LINE, so it receives each reminder's text.
GitHub Inc., United States: when the nightly backup is switched on, it keeps an encrypted copy of the whole database for 30 days.
Sentry (Functional Software, Inc.): only when error reporting is switched on, it receives reports of errors in the application. Request contents, cookies and the signed-in person's email address are removed before a report is sent.
Vercel Web Analytics: counts visits to the chamber's public website without cookies (the page, the page that linked to it, and the kind of device and browser). It is not used on the member portal or the staff pages.
Beyond these, your data goes to nobody outside the chamber unless the law requires it or you ask the chamber to send it somewhere.
Where it is kept
The application and the database run in Singapore. Email is delivered through a provider in the United States, notifications to the member app through another in the United States, and the staff writing assistant runs with Mistral AI, processing in Europe. The platform operator also keeps backup copies: encrypted nightly copies held by GitHub in the United States for 30 days when nightly backups are switched on, and a full copy taken to its own computer before planned changes to the chamber's data, such as an import. Because the chamber's providers are abroad, your data crosses borders; the contract with each provider commits them to keep it confidential and secure.
How long we keep it
Membership, invoice and event records: for as long as you or your organisation are a member, and afterwards for the period that the rules of the chamber and the law on accounting records require.
Applications: as part of the membership record if approved; if not, until you ask the office to remove them.
Guest names, emails and dietary notes given with a booking: kept with that booking, and deleted with it.
A student card or ID sent to confirm eligibility: deleted once the application is decided, unless the membership type keeps proofs. The chamber keeps only a note that the check was done, by whom and when, and the date the membership stops qualifying. A date of birth is kept only where the membership type needs it.
Newsletter consents and preferences: until you unsubscribe. A record that you unsubscribed is kept so that you are not emailed again.
A payment slip or photo you send: deleted once the chamber office records the payment or sets it aside, unless the chamber keeps proofs. How and when you paid, and the reference, stay with the payment record.
One-time sign-in codes: minutes, then they expire.
Member app sign-ins: they end when the person signs out, when the chamber signs them out or ends their membership, or after 60 days unused.
Agreements signed electronically, with their record of who signed, when and from where: for as long as the chamber keeps the agreement.
The audit log: for the life of the chamber's account, because it is the record of who did what.
When the chamber stops using the platform, its data is exported to the chamber and deleted from the platform on the chamber's written request, except where financial records must be kept.
Your rights, and how to use them
You can ask the chamber for any of the following.
A copy of what the chamber holds about you.
Correction of anything that is wrong or out of date.
Deletion, except for invoices, receipts and the audit line that records the deletion, which are financial records the chamber must keep.
To stop marketing email at any time: use the unsubscribe link in any newsletter, the preferences page, or write to the office. Messages about your own invoices and registrations continue while you are a member.
To have your company removed from the member directory, or its contact details taken off it.
To complain to the authority responsible for personal data protection where you live.
Making a request
Write to info@icham.org. The chamber answers within the time the law allows and confirms in writing what it has done. Members can see their own company, invoices and registrations at any time by signing in to the member portal.
If you would rather not share these details
Membership, event registration and the newsletter each need the details described above. If you choose not to provide them, the chamber cannot process your application or registration, or send you its newsletter.
Changes to this notice
This notice was last updated on 5 October 2026. If the chamber changes how it uses your data, this page is updated and the date changes with it.