---
title: "Privacy Policy | DonQuaan"
description: "How we collect, use and protect your personal data."
image: "https://donquaan.com/og-hero.png"
url: "https://donquaan.com/en/rules-and-policies/privacy-policy"
lang: "en"
---

[Rules & Policies](https://donquaan.com/en/rules-and-policies)

# Privacy Policy

EN VI

Version 2.0 · Effective 08/07/2026

# Privacy Policy — donquaan.com

**Version:** v2.0 · **Effective date:** 08/07/2026 · **Last updated:** 08/07/2026

_Pursuant to the Civil Code No. 91/2015/QH13 dated 24 November 2015;_

_Pursuant to the Law on Electronic Transactions No. 20/2023/QH15 dated 22 June 2023;_

_Pursuant to the Law on Cyber Information Security No. 86/2015/QH13 dated 19 November 2015;_

_Pursuant to the Law on Cybersecurity No. 24/2018/QH14 dated 12 June 2018;_

_Pursuant to the Law on Children No. 102/2016/QH13 dated 05 April 2016;_

_Pursuant to Decree No. 13/2023/ND-CP dated 17 April 2023 of the Government on protection of personal data;_

_Pursuant to Decree No. 147/2024/ND-CP dated 09 November 2024 of the Government on the management, provision and use of Internet services and online information;_

_The Service Provider issues this Privacy Policy as follows._

---

## Chapter I. GENERAL PROVISIONS

**Article 1. Scope and subjects of application**

1. This Privacy Policy (the "Policy") explains how personal data is collected, used, shared, stored and protected when accessing or using the website donquaan.com together with its subdomains and related pages (the "Service").
2. This Policy applies to the personal data of Service visitors and registered Users. This Policy does not apply to third-party websites or services that the Service links to but does not control; those pages have their own privacy policies.
3. This Policy is written to comply with Decree No. 13/2023/ND-CP on protection of personal data as the primary governing framework, and to be aware of and, where applicable, aligned with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR") for visitors located in the European Union and the European Economic Area. Provisions specific to this group are set out in Article 16.
4. This Policy and any dispute arising out of or relating to the processing of personal data are governed by the law of Vietnam and fall within the jurisdiction of the competent Court of Vietnam.
5. The Service does not maintain a separate Cookie Policy; all cookie disclosures are set out in Article 8 of this Policy.

**Article 2. Definitions**

In this Policy, the following terms are understood as follows:

1. "Service Provider" means Mr. Nguyễn Vũ Đông Quân (known as "DonQuaan"), a natural person having full civil legal capacity and full capacity for civil acts under the Civil Code 2015, being the owner and operator of the Service and the Personal Data Controller with respect to data processed through the Service.
2. "User" means an individual who accesses or uses the Service.
3. "Data Subject" means an individual reflected by personal data processed through the Service, as understood under Decree No. 13/2023/ND-CP.
4. "Personal Data", "sensitive personal data", "consent", "processing of personal data", "Personal Data Controller", "Personal Data Processor", "Controller-cum-Processor" and "Third Party" are understood in accordance with Decree No. 13/2023/ND-CP.
5. "Child" means a person under 16 years of age, pursuant to Article 1 of the Law on Children 2016.
6. "Non-essential processing" means processing that is not required to provide the Service or to meet a legal obligation or a safety or security requirement, including traffic analytics, advertising, behavioural profiling, and the related sharing and transfer described in Article 5(2).

**Article 3. The Service Provider and data-processing roles**

1. The Service is a personal website operated by the Service Provider in an individual capacity; it is not the activity of an organisation or juridical person. There is no company or other legal entity operating this Service; any prior legal entity has been dissolved and is not the operator here.
2. For the processing described in this Policy, the Service Provider acts as the Personal Data Controller-cum-Processor, being the party that both decides the purposes and means of processing and carries out the processing.
3. For notice and cross-border data-transfer dossier purposes under Decree No. 13/2023/ND-CP, the infrastructure providers named in Article 9 (Supabase, Cloudflare) are treated as Personal Data Processors acting on the Service Provider's instructions; the analytics and advertising providers (Google, Meta) are treated as Third Parties, being independent controllers for the data they process for their own purposes.
4. Because the Service Provider is an individual, the Service Provider personally handles data-protection requests and questions and serves as the point of contact for all matters relating to personal data protection under Decree No. 13/2023/ND-CP. All contact is made through the email address [contact@donquaan.com](mailto:contact@donquaan.com) with the subject line "Privacy Request" so it can be prioritised.

---

## Chapter II. PERSONAL DATA COLLECTED

**Article 4. Categories of personal data collected**

The Service Provider collects the following categories of data. Whether a given category is collected depends on how the User uses the Service and, for non-essential categories, on the consent of the Data Subject under Articles 6 and 7.

1. Data provided directly by the User, comprising: a) Account identity data: full name or display name, email address and phone number, provided when registering or signing in via Google sign-in, email or phone number, with authentication handled through Supabase; b) Profile data: any optional information the User adds to their profile; c) User Content: comments, posts or other content the User submits, and basic descriptive data about it, for example the time of submission; d) Communications: the content of messages the User sends to the Service Provider, for example emails to [contact@donquaan.com](mailto:contact@donquaan.com), and support and enquiry history.
2. Data collected automatically, comprising: a) Device and browser data: device type, operating system, browser type and version, language settings, screen and viewport information; b) Network and connection data: IP address, approximate geographic region or location derived from the IP address at city, region or country level, not precise satellite or device-level geolocation, and the internet service provider or network operator or telecommunications service provider inferred from the User's connection; c) Security and server logs: access timestamps, requested addresses, referring address, error logs and similar records kept for security, abuse prevention and reliability.
3. IP address, approximate region, internet service provider and on-site behaviour are treated as personal data under Decree No. 13/2023/ND-CP and handled accordingly. The Service Provider keeps location at the approximate-region level only and does not collect precise or satellite geolocation; if a future feature needs precise location, the Service Provider will obtain separate, explicit consent first, in accordance with Article 13.

**Article 5. Behavioural data and cookies**

1. Behavioural data, also called the "digital footprint", is the record of how the User interacts with the Service, comprising: a) On-site behaviour: pages viewed, links and buttons clicked, scroll and interaction events, session duration, navigation paths, entry and exit pages, referrer and campaign source; b) Aggregated usage patterns, used to understand what content is useful.
2. The building of behavioural data referred to in clause 1 of this Article to improve and lightly personalise content, together with the related sharing and transfer of data to Google and Meta, is non-essential processing, carried out only with the opt-in consent of the Data Subject.
3. The cookies and similar identifiers used comprise: a) Strictly necessary cookies and storage, which are essential, serving login sessions, log-in, security, load-balancing and the storage of consent preferences; b) Analytics and advertising cookies and identifiers, which are non-essential, including Google Analytics 4 identifiers, Meta Pixel identifiers and advertising identifiers. Details are set out in Articles 8 and 9.

**Article 6. Automated decision-making, profiling and sensitive personal data**

1. The processing of behavioural data referred to in Article 5 is used only to understand usage and lightly personalise content, for example to decide which content to surface. The Service Provider does not use this data for automated decisions that produce legal effects or similarly significant effects on the User, such as decisions on credit, employment or eligibility.
2. The Service Provider does not intentionally collect sensitive personal data under Decree No. 13/2023/ND-CP and asks Users not to include sensitive data in comments, profiles or messages. If a future feature genuinely requires sensitive personal data, including precise or satellite location, the Service Provider will give clear notice, obtain separate, explicit consent specifically for that sensitive data, and apply the heightened protections required by Decree No. 13/2023/ND-CP.

---

## Chapter III. PURPOSES, LEGAL BASES OF PROCESSING AND CONSENT

**Article 7. Purposes of processing and legal bases**

1. Processing is divided into essential processing, which requires no separate consent to provide the Service, and non-essential processing, which requires opt-in consent. Decree No. 13/2023/ND-CP is built around consent plus a set of enumerated situations where consent is not required, for example the performance of a service at the Data Subject's request, compliance with a legal obligation, and protection in defined situations.
2. Essential processing is processing necessary to provide the Service, relying on the non-consent grounds of Decree No. 13/2023/ND-CP and not conditioned on any marketing consent, comprising: a) Creating and operating the account, authenticating log-in via Google, email or phone number, using account identity data, on the ground that the processing is necessary to perform the service at the User's request; b) Displaying and storing the content and comments submitted by the User, using User Content, on the ground that the processing is necessary to provide the service the User requested; c) Keeping the Service secure, preventing fraud, abuse, spam and attacks, and maintaining reliability, using security and server logs, network data and device data, on the ground that the processing is necessary for the security of the system, the prevention of unlawful acts, and the meeting of security and legal obligations; d) Responding to the User's enquiries and support requests, using communications, on the ground that the processing is necessary to handle a request initiated by the User; đ) Complying with legal obligations, for example lawful requests from competent Vietnamese authorities and record-keeping, on the ground of compliance with a legal obligation under Vietnamese law; e) Storing and honouring the User's consent and opt-out preferences, using consent-preference data, on the ground that this is necessary to comply with the law on protection of personal data.
3. Non-essential processing relies on the separate, freely given, opt-in consent of the Data Subject, which is refusable and withdrawable at any time, comprising: a) Analytics of traffic and how content is used through Google Analytics 4, using behavioural data, analytics cookies and identifiers, device data and approximate-region data; b) Advertising, marketing and retargeting measurement through Meta Pixel and related Meta tools, using behavioural data, advertising identifiers and Pixel cookies; c) Building a broader picture of on-site behavioural data to improve and lightly personalise content, using behavioural data; d) Sharing and transferring the data referred to in points a, b and c of this clause to Google and Meta, including transfer abroad, using analytics and advertising data.
4. The User may refuse all of the non-essential processing referred to in clause 3 of this Article and still register, log in, read and comment. Refusal does not reduce access to the core Service.

**Article 8. Layered consent mechanism**

1. The Service Provider seeks consent for each group of non-essential purposes, comprising traffic analytics, advertising, behavioural profiling, and sharing to Google and Meta, rather than bundling them into one all-or-nothing package.
2. Consistent with Decree No. 13/2023/ND-CP, under which consent must be voluntary, purpose-specific, informed and withdrawable, and consistent with the GDPR, under which consent must be freely given, the Service Provider does not bundle unrelated purposes and does not pre-tick non-essential boxes.
3. The Service Provider does not require the User to accept analytics, advertising, behavioural tracking or data-sharing as a condition of creating an account or using core features. A consent design that forces acceptance of non-essential processing is treated as invalid under Decree No. 13/2023/ND-CP and under Article 7(4) of the GDPR, and is therefore not used.
4. Essential processing is active because it is required to run the Service. Non-essential processing is off until the User opts in. No analytics, advertising or behavioural-tracking script, including Google Analytics 4 and Meta Pixel, is loaded before the User opts in. An opt-out is always available afterwards.
5. The User may change or withdraw any non-essential consent at any time through the Service's cookie and privacy settings or by emailing [contact@donquaan.com](mailto:contact@donquaan.com). Withdrawal takes effect going forward, does not make past lawful processing unlawful, stops further sharing of data with Google and Meta from that point, and does not affect the ability to keep using the core Service.
6. Withdrawal of consent does not by itself delete data already transmitted to Google or Meta before the withdrawal. To reach that data, the User may use the third parties' own controls and deletion tools through the links in Article 9 and may ask the Service Provider for help via [contact@donquaan.com](mailto:contact@donquaan.com).
7. The Service Provider keeps records of the User's consents and withdrawals as evidence of compliance and to honour the User's choices, in accordance with Article 11 of Decree No. 13/2023/ND-CP.

**Article 9. User preference controls**

1. The Service provides a consent control, for example a cookie banner or preferences panel, where the User can accept or decline analytics, advertising and behavioural tracking separately.
2. If the User declines non-essential processing, the User can still create an account, log in via Google, email or phone number, read content, post comments and contact the Service Provider.
3. The User may use browser settings to block or delete cookies, together with the platform-level opt-outs offered by Google and Meta through the links in Article 11. These are additional to, and not a replacement for, the on-site control.
4. Where the Service receives a "Do Not Track" or "Global Privacy Control" signal from the browser, the Service Provider treats it as a request to disable non-essential tracking.

---

## Chapter IV. COOKIES AND SHARING AND TRANSFER OF DATA

**Article 10. Cookies and similar technologies**

1. Essential cookies and storage are required for login sessions, security, load handling and to remember consent choices. They operate under essential processing as referred to in Article 7(2) and cannot be switched off without breaking core functionality.
2. Analytics cookies and identifiers are set only if the User opts in and are used by Google Analytics 4 in accordance with Article 11.
3. Advertising cookies and identifiers are set only if the User opts in and are used by Meta Pixel in accordance with Article 11.
4. The User may manage non-essential cookies through the Service's preference control and browser settings. Deleting cookies may reset preferences, in which case the User may be asked to choose again.
5. A full, itemised cookie table listing name, provider, purpose and duration is maintained here and kept up to date. A complete table is a condition of valid, informed consent, not an optional extra.

| Name | Provider | Purpose | Category | Duration |
| --- | --- | --- | --- | --- |
| `sb-access-token` / auth session | Supabase | Keep the User logged in | Essential | Session / short-lived |
| `consent_state` | donquaan.com | Store cookie choices | Essential | Persistent, up to 12 months |
| `__cf_bm` / `cf_clearance` | Cloudflare | Bot management / security | Essential | About 30 minutes |
| `pref_lang`, `theme_mode` | donquaan.com | Remember language / theme | Functional | Persistent, up to 12 months |
| `_ga`, `_ga_<id>` | Google | Analytics, distinguish users and sessions | Analytics | Up to 2 years, Google default |
| First-party analytics identifier | donquaan.com | Aggregate usage measurement | Analytics | Persistent, up to 12 months |
| `_fbp`, `fr` | Meta | Advertising measurement and delivery | Advertising | About 90 days |

**Article 11. Third parties receiving data**

1. The Service Provider does not sell the User's personal data and shares data only with the recipients described in this Article.
2. Google, through Google Analytics 4: if the User opts in to analytics, Google Analytics 4 receives behavioural and usage data, device data, approximate region and analytics identifiers, to measure traffic and improve content. The basis is the User's opt-in consent under points a and d of Article 7(3). Transfer of data abroad may occur in accordance with Article 12. Google's policies and controls are set out at <https://policies.google.com/privacy> and <https://policies.google.com/technologies/partner-sites> .
3. Meta, through Meta Pixel: if the User opts in to advertising and marketing, Meta Pixel receives event and behavioural data together with advertising identifiers, used for advertising measurement and retargeting. The basis is the User's opt-in consent under points b and d of Article 7(3). Transfer of data abroad may occur in accordance with Article 12. Meta's policies and controls are set out at <https://www.facebook.com/privacy/policy> and <https://www.facebook.com/policies/cookies> .
4. Infrastructure and service providers act on the Service Provider's instructions to provide the Service. This processing is essential and occurs regardless of the User's analytics and advertising choices, comprising: a) Cloudflare: content delivery, domain name resolution, security and protection against denial-of-service attacks, and performance; processing network and technical data and security logs; transfer of data abroad is likely to occur in accordance with Article 12. Its privacy policy is set out at <https://www.cloudflare.com/privacypolicy/> ; b) Supabase: authentication via Google, email or phone-number sign-in, database and backend hosting for accounts and content; processing account identity data and User Content; transfer of data abroad is likely to occur in accordance with Article 12. Its privacy policy is set out at <https://supabase.com/privacy> .
5. Because Cloudflare and Supabase process essential account and content data, that processing and any resulting transfer of data abroad are not switched off by declining analytics and advertising, as they are required to operate the Service the User asked to use.
6. The Service Provider may disclose personal data where necessary to comply with Vietnamese law, a lawful request from a competent authority, or to protect the rights, safety and security of the Service and its Users.

**Article 12. Cross-border transfer of personal data**

1. The transfer of personal data abroad occurs in the following cases: a) For non-essential, consent-based processing: if the User opts in to Google analytics or Meta advertising, the related data is transferred to and processed outside Vietnam, including in jurisdictions such as the United States and other countries where these providers operate. Declining the non-essential processing referred to in Article 7(3) prevents these transfers; b) For essential infrastructure processing: to run the Service, account and content data handled by Supabase, and network and security data handled by Cloudflare, may be stored and processed outside Vietnam, for example in the United States, the European Union, Singapore or other regions where these providers operate. This transfer is part of delivering the service the User requested and therefore occurs even if the User declines all analytics and advertising.
2. For the transfers referred to in clause 1 of this Article, the Service Provider relies on: the User's informed opt-in consent for the non-essential transfers to Google and Meta; the necessity of the transfer to provide the service the User requested for the essential infrastructure transfers; and the recipients' own published privacy commitments together with contractual data-protection terms, for example the data-processing terms or standard contractual clauses offered by these providers.
3. The Service Provider prepares and maintains the cross-border data-transfer impact assessment dossier required under Decree No. 13/2023/ND-CP, covering all recipients abroad, comprising Google, Meta and the infrastructure providers Supabase and Cloudflare, and not only the analytics and advertising providers, in accordance with Article 15. The Service Provider records the form, the per-recipient scope and the filing requirements, and files the dossier for the transfers that require it before those transfers go live.
4. Because the transfers to Google and Meta depend on the User's opt-in, declining analytics and advertising prevents those transfers abroad. The essential infrastructure transfers referred to in point b of clause 1 of this Article still occur to the extent required to deliver the service the User requested; if the User does not want their account or content data processed on that infrastructure, the User may decline to create an account or may close the account.

---

## Chapter V. RIGHTS OF THE DATA SUBJECT, RETENTION AND SECURITY

**Article 13. Rights of the Data Subject**

1. Under Article 9 of Decree No. 13/2023/ND-CP, the Data Subject has the following rights: a) The right to be informed about the processing of their personal data, through this Policy; b) The right of access to obtain a copy of their personal data held; c) The right to rectify inaccurate or incomplete data, some of which the User can edit directly in their account; d) The right to delete their data, subject to lawful retention exceptions; đ) The right to restrict processing; e) The right to object to certain processing, including non-essential analytics and advertising; g) The right to withdraw consent for any non-essential processing at any time, in accordance with Article 8(5); h) The right to claim compensation for damage in accordance with the law; i) The right to complain, denounce and initiate legal proceedings regarding the processing of their personal data.
2. To exercise the rights referred to in clause 1 of this Article, the Data Subject sends an email to [contact@donquaan.com](mailto:contact@donquaan.com) with the subject line "Privacy Request", describing the request. The Service Provider may need to verify identity to protect the Data Subject's account.
3. The Service Provider responds within the timeframe required by Decree No. 13/2023/ND-CP. Where more time is needed or a refusal is required on legal grounds, the Service Provider explains the reason.
4. In addition to contacting the Service Provider, the Data Subject may complain to the competent authority for personal data protection designated under Decree No. 13/2023/ND-CP. Visitors in the European Union and the European Economic Area see also Article 16.
5. Exercising the Data Subject's rights, including withdrawing consent, is free of charge and does not by itself result in loss of access to the core Service.

**Article 14. Data retention periods**

1. The Service Provider retains personal data only for as long as necessary for the purpose it was collected or as required by Vietnamese law, after which it deletes or anonymises the data.
2. The retention period for each category of data is as follows:

| Data | Retention |
| --- | --- |
| Account identity and profile data | While the account is active; deleted or anonymised within no longer than necessary after account closure, subject to any legal retention requirement |
| User Content and comments | Until the User deletes it or closes the account, subject to backups and legal needs |
| Security and server logs | For no longer than necessary for security and abuse prevention, together with any legal retention requirement |
| Google Analytics 4 analytics data | Per the User's consent and the Google Analytics 4 retention setting, for no longer than necessary for the stated purpose |
| Meta Pixel advertising data | Per the User's consent and Meta's retention practices |
| Consent and opt-out records | As long as needed to prove compliance |

1. Residual copies may persist briefly in secure backups before being overwritten on the normal backup cycle.

**Article 15. Data-processing impact assessment and data security**

1. The Service Provider prepares and maintains a personal data-processing impact assessment dossier for the processing described in this Policy, and prepares a cross-border data-transfer impact assessment dossier for transfers to Google, Meta and the infrastructure providers Supabase and Cloudflare, together with any other applicable transfers, as required by Decree No. 13/2023/ND-CP.
2. The Service Provider submits or makes available the dossiers referred to in clause 1 of this Article to the competent authority designated under Decree No. 13/2023/ND-CP, in the form and within the timeframes required by law. These dossiers are reviewed and updated when processing changes materially, for example adding new trackers, providers or purposes.
3. The Service Provider applies reasonable technical and organisational measures appropriate to an individual-run website, including transport encryption over a secure protocol, reliance on reputable providers comprising Cloudflare for security and protection against denial-of-service attacks and Supabase for managed authentication and database, access controls and security logging.
4. No method is perfectly secure. The Service Provider works to protect data but cannot guarantee absolute security. The User uses a strong, unique password and keeps their login credentials confidential.
5. In the event of a personal-data breach that meets the notification threshold, the Service Provider notifies the competent authority and affected Users as required by Decree No. 13/2023/ND-CP.

---

## Chapter VI. OTHER PROVISIONS AND IMPLEMENTATION

**Article 16. Notes for visitors in the European Union and the European Economic Area**

1. Because the Service is publicly accessible, some visitors may be in the European Union and the European Economic Area, where the GDPR may apply. This Article is for those visitors only and solely as a mapping to the GDPR, not a restatement of the Decree No. 13/2023/ND-CP bases in Article 7.
2. The lawful bases map broadly as follows: contract and necessity for essential account and service processing; legitimate interests for security and reliability; legal obligation for compliance; and consent for all non-essential analytics, advertising and behavioural processing and related transfers.
3. Consent under the GDPR is freely given, specific, informed and unambiguous; consistent with Article 7(4) of the GDPR, the Service Provider does not condition the service on consent to non-essential processing.
4. Additional GDPR rights may include access, rectification, erasure, restriction, objection, data portability and the right to withdraw consent, together with the right to lodge a complaint with the visitor's local supervisory authority. The GDPR also confers rights concerning automated decision-making and profiling; as noted in Article 6(1), the Service Provider does not carry out automated decisions with legal or similarly significant effects.
5. International transfers out of the European Union and the European Economic Area rely on appropriate safeguards, for example standard contractual clauses and the providers' transfer mechanisms, or the visitor's explicit consent. Where the Service Provider's activities fall within the territorial scope of the GDPR under Article 3 of the GDPR, the Service Provider complies with the applicable obligations and will appoint a representative in the European Union under Article 27 of the GDPR if and when one is required.

**Article 17. User Content and right of use**

1. When submitting comments or other content, the User grants the Service Provider a non-exclusive, worldwide, royalty-free, sub-licensable right of use to host, store, reproduce and display that content, and to modify and adapt it solely for technical display and formatting, for example resizing, cropping thumbnails, reformatting for different screens or showing excerpts, solely to operate and provide the Service.
2. This right of use ends when the User deletes the content or their account, except for reasonable residual backup copies pending deletion, copies that others may have lawfully saved, or copies that the Service Provider must retain by law. The Service Provider does not claim a perpetual or irrevocable right of use and does not use the User's content for unrelated purposes such as training artificial intelligence models. This no-artificial-intelligence-training commitment is a commitment by the Service Provider; the independent processing of third-party providers referred to in Article 11 is governed by their own policies, which the Service Provider does not control.
3. Full content rules and acceptable-use terms are set out in the Terms of Service and Acceptable Use Policy at donquaan.com/rules-and-policies/terms-of-service. This Article addresses only the data-protection dimension.

**Article 18. Children and age requirement**

1. The minimum age to use the Service is 13 years. By using the Service or creating an account, the User confirms that they are at least 13 years of age. Being at least 13 is a condition of using the Service, set by the Service Provider, and is set out in full in the Age, Eligibility and Cooperation Terms.
2. If the Service Provider learns that a User is under 13 years of age, that User does not meet the conditions of use of the Service. The Service Provider stops non-essential processing for that User and takes steps to delete their account and personal data, except data that must be kept briefly to comply with the law.
3. Pursuant to Article 20 of Decree No. 13/2023/ND-CP and the Law on Children 2016, a person under 16 years of age is treated as a child, whose data may only be processed with the verified consent of a parent or legal guardian; for a person from 7 to under 16 years of age, the consent of both that person and the parent or legal guardian is required. Because the minimum age is 13, some Users may be aged from 13 to under 16 and are therefore children under these rules. For any User whom the Service Provider knows or reasonably believes to be under 16, the Service Provider applies the Decree's child-data rules, including obtaining the verified consent of a parent or legal guardian, or otherwise restricting or deleting the data, in addition to the minimum-age condition referred to in clause 1 of this Article. These thresholds are addressed further in the Age, Eligibility and Cooperation Terms.
4. If the User believes that a minor has provided personal data, the User contacts [contact@donquaan.com](mailto:contact@donquaan.com) so that the Service Provider can address it promptly.

**Article 19. Third-party links**

The Service may link to external websites and services that the Service Provider does not control. The privacy practices of those pages are governed by their own policies, and the Service Provider is not responsible for them. The User reviews the policies of those pages before providing personal data.

**Article 20. Amendment of the Policy and version management**

1. The Service Provider may update this Policy to reflect changes in processing, providers or the law. Each version has a version number and an Effective date at the top of the document. Material changes are signalled by updating this information and, where appropriate, by a notice on the Service.
2. The Service Provider retains every superseded version of this Policy, each preserving its original version number and Effective date, so that the User can review changes over time and rely on them as evidence of the terms in force at a given date. The Service Provider maintains a public version archive at a stable address under donquaan.com/rules-and-policies; the User may also request any previous version via [contact@donquaan.com](mailto:contact@donquaan.com).
3. If a change expands non-essential processing, for example a new tracker or recipient, the Service Provider seeks fresh opt-in consent where required, rather than treating prior consent as automatically covering the new purpose.

**Article 21. Effect and contact**

1. This Policy takes effect from the Effective date stated at the top of the document and is an integral part of, and is incorporated by reference into, the Terms of Service at donquaan.com/rules-and-policies. Where there is a conflict between parts, the detailed provisions prevail.
2. All requests, questions, complaints, consent withdrawals and previous-version requests relating to personal data are sent to the Service Provider, Mr. Nguyễn Vũ Đông Quân (known as "DonQuaan"), the individual operator of donquaan.com, through the email address [contact@donquaan.com](mailto:contact@donquaan.com) with the subject line "Privacy Request". The Service Provider is the point of contact for all matters relating to personal data under Decree No. 13/2023/ND-CP.

---

_End of Privacy Policy — Version v2.0, Effective date 08/07/2026._

```json
{ "@context": "https://schema.org", "@graph": [ { "@type": "Person", "@id": "https://donquaan.com/#person", "name": "Nguyen Vu Dong Quan", "alternateName": "DonQuaan", "url": "https://donquaan.com/", "image": "https://donquaan.com/og-hero.png", "jobTitle": "Gemini Certified Faculty · Google AI Specialist", "description": "I believe in people, not tools. Teaching and applying Google AI; running Discord communities and systems; design and development for Roblox, Minecraft and the web; systems testing.", "email": "mailto:contact@donquaan.com", "knowsAbout": [ "Google AI", "Gemini", "Community operations", "Discord", "Roblox", "Minecraft modpacks", "Web development", "Systems testing" ], "knowsLanguage": [ "Vietnamese", "English" ], "hasCredential": [ { "@type": "EducationalOccupationalCredential", "credentialCategory": "certification", "name": "Gemini Certified Faculty", "recognizedBy": { "@type": "Organization", "name": "Google" }, "url": "https://edu.google.accredible.com/529911e4-a7fb-42b6-9c9f-50d29e633430" }, { "@type": "EducationalOccupationalCredential", "credentialCategory": "certification", "name": "Kaggle Learn certificates (17) and the Data Science graduate badge, 18 images", "recognizedBy": { "@type": "Organization", "name": "Kaggle" }, "url": "https://www.kaggle.com/nguyenvudongquan" }, { "@type": "EducationalOccupationalCredential", "credentialCategory": "certification", "name": "HubSpot Academy certifications (15)", "recognizedBy": { "@type": "Organization", "name": "HubSpot Academy" }, "url": "https://app.hubspot.com/academy-profile/member/94801453" } ], "address": { "@type": "PostalAddress", "addressLocality": "Da Nang", "addressCountry": "VN" }, "sameAs": [ "https://www.facebook.com/NguyenDonQuaan", "https://x.com/DonQuaanVN", "https://www.youtube.com/channel/UCvqlcKf1nm9i2LeH9hFQQYA", "https://github.com/DonQuaan", "https://www.linkedin.com/in/donquaan", "https://www.twitch.tv/donquaan_tkz", "https://open.spotify.com/user/31xr7kgwysteud3urdhzrv5ixc2q", "https://www.curseforge.com/members/yangdawn", "https://www.kaggle.com/nguyenvudongquan", "https://app.hubspot.com/academy-profile/member/94801453", "https://discord.com/invite/sangtraan" ] }, { "@type": "WebSite", "@id": "https://donquaan.com/#website", "url": "https://donquaan.com/", "name": "DonQuaan", "alternateName": "Nguyen Vu Dong Quan", "description": "Nguyen Vu Dong Quan, Gemini Certified Faculty · Google AI Specialist, Da Nang. I believe in people, not tools. Shipped work, real certificates, the Sangtraan Discord community.", "inLanguage": [ "vi", "en" ], "publisher": { "@id": "https://donquaan.com/#person" } }, { "@type": "ProfilePage", "@id": "https://donquaan.com/#webpage", "url": "https://donquaan.com/", "name": "DonQuaan | Nguyen Vu Dong Quan", "isPartOf": { "@id": "https://donquaan.com/#website" }, "about": { "@id": "https://donquaan.com/#person" }, "mainEntity": { "@id": "https://donquaan.com/#person" }, "primaryImageOfPage": "https://donquaan.com/og-hero.png", "inLanguage": "en" } ] }
```