D1 Moto Personal Data Processing Policy

This policy explains what data of yours we receive, why, where we keep it, whom we share it with, how long we keep it and what you can do about it. It follows Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP. If a translation differs from the Vietnamese text, the Vietnamese text prevails.

1. Who is responsible for your data

The data controller is D1MOTORS (360 Moto, D1 Moto), brand D1 Moto, registration number 0317849875-002, address 1P, 2P, 3P Quân Trấn, Hùng Vương nối dài, P. Lộc Thọ, TP. Nha Trang, Tỉnh Khánh Hoà ("D1 Moto", "we").

Questions, requests and complaints about data: e-mail hello@d1motors.com, WhatsApp +84 375 908 782.

2. What data we receive

When you send a request on the website (rental, riding school, bike buying help, a question):

• the name you give;
• a contact to reply to: a phone number or username in Telegram or WhatsApp;
• the city, the bike or service you chose, pick-up and return dates and places, your comment;
• the language and address of the page the request was sent from;
• the date and time of the request;
• a one-way fingerprint of your device's address (derived from the IP address). We do not keep the IP address itself; the fingerprint protects the form from robots and mass sending.

When you rent a bike (at pick-up at the branch and in your personal account, if one is opened for you):

• passport and driving licence details (including an international driving permit) and photos of them;
• phone, e-mail and your place of stay in Vietnam, if you give them;
• the rental contract, handover and return reports, your signature;
• photos and videos of the bike at pick-up and return, mileage readings;
• payments, the deposit and its return;
• messages with the branch.

When you sign in to your personal account — with Google, Apple, Telegram or a code sent by e-mail:

• from Google and Apple — the account ID, your e-mail address (kept only if the service confirms it is yours) and your name; from Google also the account language; Apple sends the name only at the first sign-in;
• from Telegram — the account ID, first and last name or username; we do not keep the profile photo;
• with a code by e-mail — the e-mail address; the code is kept only as a fingerprint and deleted after sign-in.

The Google, Apple and Telegram sign-in buttons load from those companies' servers, and only on the account page; what they see about you is governed by their own rules.

Map. When a page shows a map, its tiles load from OpenStreetMap servers, which see your device's IP address. This stays so until we move the map to our own servers.

VinFast battery swap stations (in the account of an electric bike rental) — only when you tap "Find near me" yourself and allow your browser to share your location. The coordinates go through our server to the VinFast station service to find the nearest stations; we do not store them or write them to logs. Instead of sharing your location you can choose a city from the list.

What we do not collect. The website does not use tracking cookies, does not run advertising or analytics services and does not sell data. The browser tab (sessionStorage) keeps only your personal account sign-in, until the tab is closed.

We do not collect data the law treats as sensitive (health, religion, political views, etc.). Please do not put it in comments.

3. Why we process data and on what basis

We do not use your data for marketing without separate consent and do not take decisions about you by automated means alone. Text recognition on documents only helps the manager fill in the contract; a person checks the document.

4. Giving and withdrawing consent

You give consent with a separate checkbox in the request form — it is never pre-ticked. We keep when you agreed and to which version of this policy. You can withdraw consent at any time by contacting us (section 1). Withdrawal does not affect processing already done, nor processing required by law or needed to perform a contract already concluded.

5. Whom we share data with

• Branch managers in the city you chose and responsible D1 Moto staff — only what is needed for your request or rental.
• Providers working for us under contract:
  • DigitalOcean, LLC — servers and file storage (data centre in Singapore);
  • Telegram — internal notifications to staff about a new request;
  • Telegram, WhatsApp (Meta) — our conversation with you in the messenger you chose, on those services' terms;
  • RentProg — rental management software we use alongside our own system.
• Services you use on the website yourself (under their own rules):
  • Google, Apple, Telegram — sign-in to the personal account, if you choose that way;
  • OpenStreetMap — map tiles on pages with a map (sees the IP address);
  • VinFast — finding battery swap stations near your coordinates, only when you tap.
• Public authorities — only when the law requires it (for example, at the request of the police).

We do not sell data or share it for others' advertising.

6. Transfer of data abroad

Our servers are in Singapore, and messengers keep conversations on their servers outside Vietnam, so data is transferred abroad. We transfer only what the purposes in section 3 need, require our providers to protect it, and follow the procedure for cross-border transfer set by Law No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP.

7. How long we keep data

When the period ends, the data is deleted or anonymised.

8. Your rights

You have the right to:

• know which of your data we process and why;
• receive a copy of your data;
• correct inaccurate data;
• ask us to delete your data or restrict its processing;
• object to processing and withdraw consent;
• complain to the authority in charge of personal data protection (the Ministry of Public Security of Vietnam), or go to court and claim compensation.

How to use a right: contact us (section 1) and name the request or rental concerned. We will confirm receipt and answer within the time limits set by law. We may ask you to confirm your identity so that we do not give data to someone else. We may refuse to delete data the law requires us to keep — and will tell you why.

9. How we protect data

• data travels only over a secure connection (HTTPS);
• staff use personal accounts and reach only the data of their city and their work; actions are logged;
• databases are backed up;
• documents are kept in private storage and open only through our system to those entitled.

If a security breach affects your data, we will notify the competent authority and you in the manner and time set by law.

10. Children

The website and rentals are for adults. We do not knowingly collect children's data. If you learn that a child has sent us their data, contact us and we will delete it.

11. Changes

A new version is published on this page with its date. If the changes concern the purposes of processing or the sharing of data, we will ask for your consent again with your next request.