NORIS LAW respects your privacy and protects your personal data. This policy has been prepared with reference to the Personal Data Protection Law No. 91/2025/QH15, Decree 356/2025/ND-CP, Decree 13/2023/ND-CP and other applicable Vietnamese laws.
1. Personal data NORIS may collect
When you visit our website, book a consultation, request a service or work with NORIS, we may collect:
- Identification and contact details: name, telephone number, email address, position, workplace and contact address.
- Information about your consultation or service requirements: your enquiry, the area of law, your choice of adviser, appointment details, promotional code, payment status and payment reference.
- Documents you voluntarily provide: corporate records, contracts, identification documents, images, legal or accounting records, and other materials needed for the consultation or service.
- Basic technical data: the URL from which you submit a form, the time of submission and information needed to prevent spam, protect our systems and operate the website.
NORIS does not ask you to submit sensitive personal data through the website where it is unnecessary for your consultation or service request.
2. Purposes of processing
NORIS processes personal data for the following lawful purposes:
- Receiving, verifying, responding to and managing consultation or service requests.
- Preparing quotations, consultation appointments, payment references, agreements, applications and documents, and performing work agreed with you.
- Contacting you by telephone, email, Zalo or another appropriate channel about your request.
- Maintaining transaction records, providing client support, handling complaints, reconciling payments and meeting accounting, tax and record-retention obligations.
- Protecting the website, preventing spam and abuse, investigating technical issues and improving service quality.
- Complying with valid requests from competent authorities or other legal obligations.
3. Basis and scope of processing
NORIS processes data only as necessary for the stated purposes and on the applicable legal grounds, including your consent, the service agreement and legitimate interests in protecting our systems.
You may decline to provide certain data. However, where information is required to verify a request, arrange an appointment, prepare an application or comply with the law, NORIS may be unable to provide the corresponding service without it.
4. Data recipients and processors
Personal data may be accessed by:
- NORIS directors, lawyers, specialists and staff assigned to your request or matter.
- Website, form and operational infrastructure providers, including Google Apps Script, Google Sheets, Google Drive, Make webhook and email automation, email hosting and related technical services.
- Banks, payment providers or other parties required for payment reconciliation, where sharing is necessary for your transaction.
- External professionals, specialists, professional partners or other third parties assisting with your matter, only where necessary and subject to appropriate confidentiality obligations.
- Competent authorities in response to valid legal requests.
NORIS does not sell your personal data.
5. Retention periods
Information submitted through website forms is retained by default for 24 months from receipt, unless you request earlier deletion and deletion would not affect NORIS's legal obligations or lawful rights and interests.
Service files, contracts, accounting records, legal documents and information required for disputes or complaints may be retained longer where required by law or necessary to protect the parties' lawful rights and interests.
6. Security measures
NORIS uses appropriate organisational and technical measures to reduce the risk of unauthorised access, use, alteration, disclosure or destruction of data. These include controls on access and administrator accounts, limits on data collected through forms, checks for suspicious submissions, website security settings and reviews of relevant service providers.
No electronic system is completely secure. If you identify a potential personal data risk, please contact NORIS promptly using the details in section 8.
7. Data subject rights
Subject to applicable law, you may ask NORIS to assist with exercising your personal data rights, including:
- The right to be informed about personal data processing.
- The right to consent and withdraw consent to the extent permitted by law.
- The right to access, inspect, correct or request a copy of your personal data.
- The right to request erasure or restriction of processing, or to object to processing.
- The right to complain, report a violation, bring proceedings or seek compensation where legally justified.
NORIS may need to verify your identity or request before responding. Some requests may be refused or fulfilled only in part where a legal obligation requires continued retention or processing.
8. Contact us about your personal data
For requests to access or correct data, withdraw consent, delete information, submit a complaint or ask about this policy, please contact:
NORIS LAW JOINT STOCK COMPANY
- Enterprise registration number: 0318339482
- Registered office: 14/18 Street No. 4, Hiep Binh Ward, Ho Chi Minh City, Vietnam
- Telephone/hotline: 086 987 1246
- Email: info@norislaw.com
- Website: norislaw.com
NORIS will respond to requests in accordance with applicable law and within a timeframe appropriate to the nature of the request.
9. Policy updates
This policy takes effect on 3 July 2026. NORIS may update it to reflect changes in law, technical systems or service delivery. The latest version will be published on norislaw.com.