HI Tennis ("we," "us," or "our") operates the HI Tennis mobile application (available on Android via Google Play) and the web administration panel at hitennis.vn. We are a tennis center located in Binh Tan District, Ho Chi Minh City, Vietnam.
This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application, website, and related services (collectively, the "Services").
We obtain your affirmative consent to this policy and to our Terms of Service through an in-app acceptance screen that is shown the first time you open the app after registering (and again whenever we publish a new version). The screen requires you to actively tap an "Accept" button before you can use any feature of the app beyond registration. You may decline by closing the app or by requesting account deletion (see Section 8). Continued use of the app after acceptance is not, on its own, treated as consent — we rely on the in-app acceptance record stored on our servers.
We are committed to complying with Vietnam's regulations on personal data protection, including Decree 13/2023/ND-CP on Personal Data Protection (PDPA).
2. Information We Collect
2.1 Information You Provide Directly
When you create an account or use our Services, we may collect the following personal information:
Note about registration: Phone number and OTP verification data are collected during the registration step before the in-app consent screen described in Section 1 is shown, because we need these values to verify that you control the phone number you are signing up with. We treat this collection as performed for the purpose of entering into a service contract with you (Decree 13/2023/ND-CP, Article 17.4). If you do not wish to accept this policy after registering, you may immediately request account deletion under Section 8 and we will permanently delete your phone number and OTP records within 7 business days.
Account Information: Your full name, phone number, and (optionally) email address. Phone number is required for authentication; email is optional and used only for support correspondence.
Verification Data: One-time passwords (OTP) sent via SMS for phone-based account verification and security purposes
Booking Information: Court reservation details, booking history, and scheduling preferences
Optional Voice Booking Audio: When Google Cloud voice recognition is enabled and disclosed in the Voice Booking screen, up to 20 seconds of microphone audio from one booking request is transmitted through HI Tennis to Google Cloud Speech-to-Text to produce a transcript. HI Tennis keeps the audio in memory only for that request and does not write it to disk or object storage. You can avoid this processing by typing your request instead; staff roles that can choose a speech engine may also select the device recognizer.
Payment and Credit Information: Transaction records, credit balances, and payment history associated with your account
Rewards and Promotions Data: Blind box participation records, scratch card results, reward redemption history, and promotional activity data
Referral Data: Information related to referral activities, including referral codes and the identities of referred users
Profile Photo (optional): If you choose to upload one, your profile image is stored on our servers
2.2 Information Collected Automatically
When you use our application, we may automatically collect:
Device Information: Device type, operating system version, and unique device identifiers
Usage Data: App interaction data, feature usage patterns, and session information
Log Data: Error logs, crash reports, and diagnostic data to improve app performance
3. How We Use Your Information
We use the information we collect for the following purposes:
Account Management: To create, maintain, and secure your user account
Service Delivery: To process court bookings, manage credit balances, and facilitate payments
Identity Verification: To verify your identity through phone-based OTP authentication
Rewards and Promotions: To administer blind box rewards, scratch cards, referral programs, and other promotional activities
Communications: To send booking confirmations, account notifications, and service updates
Customer Support: To respond to your inquiries and resolve issues
Improvement: To analyze usage patterns and improve our Services, app features, and user experience
Legal Compliance: To comply with applicable laws, regulations, and legal processes
4. Data Storage and Security
We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.
Our security measures include:
Encrypted data transmission using industry-standard protocols
Secure server infrastructure with access controls
Regular security assessments and updates
Account lockout mechanisms after repeated failed authentication attempts
OTP-based multi-factor verification for sensitive operations
Your account, booking, and payment records are stored on servers located in Vietnam. If optional Google Cloud voice recognition is enabled, the short audio described in Section 2.1 is processed temporarily in the configured Google Cloud Speech-to-Text region outside Vietnam (currently a supported United States or European Union multi-region) and returned as text. HI Tennis does not create a Cloud Storage object for this audio and does not retain the audio after the request completes. We retain other personal information for as long as your account is active or as needed to provide you with our Services, with the following specific retention periods after account deletion:
Financial transaction records (payments, invoices, credit balance history): up to 10 years, as required by the Vietnam Accounting Law
System audit logs (security events, admin actions): up to 90 days
Notification history (read notifications): up to 60 days; soft-deleted: up to 30 days
Anonymized usage data: retained indefinitely for statistical and reporting purposes, with all personally identifiable information removed
All other personal data (name, phone, email, profile photo, booking history, rewards, referrals, comments) is permanently deleted within 7 business days of a verified account-deletion request. See Request Account Deletion for the deletion process.
5. Data Breach Notification
In the event that we discover a personal data breach — meaning any incident in which your personal data is accidentally or unlawfully destroyed, lost, altered, disclosed, or accessed by unauthorized parties — we will:
Notify the Ministry of Public Security of Vietnam (A05 Department) within 72 hours after the personal data breach occurs, as required by Decree 13/2023/ND-CP (Article 23).
Notify affected users without undue delay (via in-app notification, push notification, and/or email to the address on file) when the breach is likely to result in a high risk to your rights and interests.
Provide affected users with the nature of the breach, the categories of personal data involved, the likely consequences, the measures we are taking to address the breach, and the steps you can take to protect yourself.
Keep a written record of every breach, including the facts, effects, and remedial actions taken, for at least 3 years.
If we cannot notify within 72 hours, we will provide the reasons for the delay along with the notification.
6. Third-Party Services
Our Services integrate with the following specific third-party providers. We do not use any other analytics, advertising, or tracking SDKs.
Firebase Cloud Messaging (Google LLC): used solely to deliver push notifications to your device. Receives your FCM token and notification payload only.
Firebase App Check (Google LLC): used to verify that requests originate from a genuine, unmodified instance of our app. Receives a device-attestation token only.
Google Cloud Speech-to-Text V2 (Google LLC): used only when the optional Cloud voice-recognition setting is enabled for Voice Booking. Receives one bounded microphone-audio sample and returns a Vietnamese transcript. HI Tennis does not send your name, phone number, payment data, account credentials, or a persistent audio-storage URL with the transcription request, and does not enable provider data logging for model training.
Sentry (Functional Software, Inc.): used for application error monitoring and sampled performance diagnostics. Receives bounded technical information such as the app/server release, operating system or runtime, error details, and sanitized request or trace metadata. Default personal-information collection is disabled, and HI Tennis excludes request bodies, voice audio, transcripts, credentials, and direct account identifiers from these diagnostic events.
Android SMS Gateway (self-hosted, on premises): used to deliver OTP codes via SMS to your phone number. Operated by HI Tennis on a dedicated Android device located at our facility; SMS content does not leave our infrastructure except via your mobile carrier's SMS network.
Brevo (Sendinblue SA): used solely as the SMTP relay for transactional email correspondence (e.g., support replies). Receives the recipient email address and message content only when we email you directly.
Google Play Services (Google LLC): used for app distribution, installation, and updates on Android devices.
Cloudflare (Cloudflare, Inc.): used as our CDN and DNS provider for hitennis.vn. Sees your IP address and HTTP request metadata when you access our website.
SePay (SePay JSC): used as our bank-transfer payment reconciliation provider. When you pay by VietQR, SePay receives the bank transfer notification from our partner bank and forwards us the transaction amount, the booking reference string carried in the bank-transfer description (e.g., "HT-COURT-12345"), and the SePay transaction identifier and timestamp. SePay does not receive your phone number, email, account credentials, or the sender's bank-account number or name — the partner bank strips those values before SePay sees them.
These third-party providers have their own privacy policies governing the use of your information. We do not sell, rent, or trade your personal information to third parties for marketing purposes, and we do not embed any advertising SDKs.
7. Push Notifications
We may send push notifications to your mobile device to provide booking reminders, promotional offers, reward notifications, and important service updates.
You can opt out of receiving push notifications at any time by adjusting the notification settings on your device or within the app. Disabling push notifications will not affect the core functionality of your account.
8. Your Rights
In accordance with Vietnam's personal data protection regulations, you have the following rights regarding your personal data:
Right to Access: You may request access to the personal data we hold about you
Right to Correction: You may request correction of inaccurate or incomplete personal data
Right to Deletion: You may request deletion of your personal data via the Request Account Deletion page or directly inside the app under Profile → Legal & Privacy → Request Account Deletion. Subject to the legal retention periods listed in Section 4.
Right to Restrict Processing: You may request that we limit how we use your personal data
Right to Data Portability: You may request a copy of your personal data in a structured, commonly used format
Right to Withdraw Consent: You may withdraw your consent to data processing at any time, without affecting the lawfulness of processing conducted prior to withdrawal
Right to Complain: You have the right to lodge a complaint with the relevant data protection authority in Vietnam
To exercise any of these rights, please contact us at welcome@hitennis.vn. We will respond to your request within a reasonable timeframe and in accordance with applicable law.
9. Children's Privacy
Our Services are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16 years of age. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at welcome@hitennis.vn, and we will take steps to delete such information promptly.
For users between the ages of 16 and 18, parental or guardian consent may be required in accordance with Vietnamese law.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Effective Date" at the top of this policy.
For significant changes, we will notify you through the app, via email, or by other appropriate means. When we publish a new privacy-policy version that requires consent, we will show the in-app acceptance screen again and record your affirmative acceptance before you can continue using app features beyond registration.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Company: HI Tennis
Location: Binh Tan District, Ho Chi Minh City, Vietnam