Privacy Policy

1. Introduction

This Policy explains how Công ty Cổ phần Giải pháp NEXT HOME (NEXT HOME, hereinafter also "we") processes personal data when providing TingStay, the rental operations software, including the Console, the staff application, the guest pages, the TingEdge and the tingstay.vn website.

This Policy has been prepared in accordance with the Law on Personal Data Protection No. 91/2025/QH15 and its implementing regulations. Terms such as "personal data", "data subject", "controller" and "processor" have the meanings given to them in that Law.

2. Role of NEXT HOME

TingStay is shared by many accommodation businesses, and each business has its own separate data space. Our role therefore differs by type of data:

If you are a guest, the business where you stay bears primary responsibility for your data. You may send your request either to that business or to us, and we will forward it and assist the business in handling it.

3. Data we process

User accounts. Full name, email, phone number, role, the business the User works for, and a profile picture if any. Passwords are stored only in hashed form, and we cannot read the original password.

Usage logs. Sign-in time, IP address, device and browser type, and important actions such as creating a stay, issuing a door code, editing a unit record and recording receipts and payments. Logs let the business know who did what and help detect unauthorized access.

Guest data entered by the business. Full name, phone number, check-in and check-out times, number of guests, notes, the door code of the stay, and amounts due and paid. Where the business requires it, the type and number of the identity document are also collected for guest registration (residence notification).

Staff data entered by the business. Shifts, clock-in times, assigned housekeeping and repair tasks, and room inspection results.

Device readings in the unit. Door open and closed status, unlock events, presence sensor status, electricity and water meter readings, and air conditioner and lighting status. TingStay does not use cameras and does not record audio in units. These readings do not contain names but may be linked to a stay, so we protect them as personal data.

Payment information. Amount, method, time and bank transfer transaction reference. TingStay does not collect or store bank card numbers.

Consultation requests via the website. When you submit the contact form on tingstay.vn, we receive your full name, phone number, business name, number of units, the plan and rental model you are interested in, your message, and accompanying technical information: IP address, browser type, the page from which the request was sent and the traffic source (advertising campaign code, if any). All fields other than full name and phone number are optional.

Website traffic data. When you visit tingstay.vn, the analytics tools record the pages viewed, on-page interactions, device type, browser, approximate location based on IP address and the traffic source. We use this data in aggregate form and do not use it to identify individual visitors.

Some of the data described above may fall within the category of sensitive personal data under the law. For such data, we apply the additional protection measures set out in the section Data protection.

4. Purposes of processing

We process data only for the following purposes:

1. Providing the features of TingStay: management of units, stays, door codes, devices, housekeeping, receipts and payments, and reports.
2. Authenticating users who sign in, managing permissions and logging actions.
3. Sending operational notifications such as device alerts, newly assigned tasks and payment bills to guests.
4. Providing technical support and remotely diagnosing device incidents at the business's request.
5. Ensuring system security, and detecting and preventing fraud and unauthorized access.
6. Performing obligations under contracts and under the law.
7. Following up, advising and providing quotations when you send a request via the website; measuring traffic and the effectiveness of marketing channels to improve website content.

We do not sell personal data and do not use guest data for advertising purposes.

5. Legal basis for processing

We process personal data on the basis of the consent of the data subject, or in cases where the law permits processing without consent, such as to perform a contract to which the data subject is a party, or to perform obligations under the law.

For guest and staff data, the accommodation business is responsible for giving notice and having a lawful basis before entering the data into TingStay. We process such data only on the business's instructions.

6. Data sharing

We share data only in the following cases, and only to the extent necessary:

• Infrastructure providers that host the databases and files and send emails and messages for TingStay. These parties process data under their contracts with NEXT HOME. to be confirmed: list of providers
• Services the business chooses to connect, such as door lock platforms (TTLock, NeoLock) for issuing door codes, booking channels for calendar synchronization, and Zalo for sending bills to guests.
• Tools serving the tingstay.vn website: Google (Google Analytics for traffic measurement; Google Sheets and Apps Script for recording consultation requests), Heap for measuring how visitors use the pages, and Telegram for notifying NEXT HOME staff of new consultation requests. When you submit the form, your browser calls one of three services, Cloudflare (cloudflare.com), ipify (api.ipify.org) or ipinfo (ipinfo.io), to determine your IP address; these services receive your IP address. We use the IP address to prevent automated and duplicate submissions. We do not send consultation requests to Meta or any other advertising platform via the Conversions API (CAPI).
• Competent state authorities upon a written request in accordance with the law.
• The accommodation business where you work or stay: Users within the same business can view data according to the permissions granted. One business's data is not visible to any other business.

7. Transfer of data abroad

The TingStay infrastructure is hosted on servers outside Vietnam, in the Singapore or Mumbai (India) region of the infrastructure provider. The tools serving the tingstay.vn website listed in the section Data sharing (Google, Heap, Telegram, Cloudflare, ipify, ipinfo) store data on their servers outside Vietnam. When transferring personal data abroad, we prepare the impact assessment dossier and complete the other procedures required by law, and require the recipient to apply a level of protection no lower than this Policy.

8. Retention period

When a business stops using the Services, its data is deleted or anonymized after the data export period, except for any part that the law requires to be retained longer.

9. Data protection

• Data transmitted between your device, the TingEdge and the servers is encrypted.
• Door codes and identity document numbers are encrypted at rest and can be viewed only by authorized persons.
• Each business's data is isolated at the database layer. Users see only the data of their own business, within the scope of the permissions granted.
• Every important action is logged: who performed it, when, and what was changed.
• Door codes are issued per stay and expire automatically when the stay ends.
• Data is backed up periodically. NEXT HOME staff access a business's data only when technical support is needed, and such access is recorded.

No system is absolutely secure. In the event of an incident that may affect personal data, we notify the competent authorities and the businesses concerned within the time limit prescribed by law, and take remedial measures immediately.

10. Rights of the data subject

Under the Law on Personal Data Protection, you have the following rights with respect to your data:

1. To be informed about the processing of your personal data.
2. To give or refuse consent, and to withdraw consent to processing.
3. To access and correct your data, or request its correction.
4. To request deletion of your data and restriction of its processing.
5. To request a copy of your personal data.
6. To object to the processing of your data.
7. To lodge complaints and denunciations, initiate lawsuits and claim compensation for damages in accordance with the law.

Users can view and edit their account information in the Console themselves. For other requests, please write to the address in the section Contact. We verify the identity of the requester before acting and respond within the time limit prescribed by law. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Browser storage

The Console stores some information in your browser to keep you signed in and remember interface settings such as light or dark mode and the columns displayed. This information is not used for advertising.

The tingstay.vn website uses Google Analytics and Heap to measure traffic. These two tools set analytics cookies in your browser. The website also stores the first-visit traffic source (campaign code) in your browser for up to 90 days, so that when you send a consultation request we know how you found TingStay. The tingstay.vn website does not use advertising cookies. You can delete or block cookies in your browser settings; the website will continue to work normally.

12. Children's data

TingStay is intended for businesses and is not intended for use by children. Where children stay with adults and the business needs to record their information, the business is responsible for obtaining the consent of the parent or guardian as required by law.

13. Changes to this Policy

We may update this Policy when the Services or the law change. The version and the update date are shown at the top of the page. Material changes are announced on the Console or by email before they take effect.

14. Contact

Personal Data Protection Department, Công ty Cổ phần Giải pháp NEXT HOME

• Address: SP-03-22 San Ho 2A, Vinhomes Ocean Park, Gia Lam, Hanoi, Vietnam
• Phone, Zalo: +84 961 441 678
• Email: [email protected]