# Privacy Policy How Barbie Bar collects, uses and protects personal data — on this website, when you book, when you apply for a job, and in the automated systems we run against Google's APIs. In effect from 2026-09-16 · last updated 2026-09-16 1. [Who is responsible for your data](#s01) 2. [The short version](#s02) 3. [What we collect, and how](#s03) 4. [What we collect — WhatsApp assistant (booking)](#s04) 5. [Cookies and similar technologies](#s05) 6. [Why we process it, and on what legal basis](#s06) 7. [Who we share it with](#s07) 8. [Data that leaves Vietnam](#s08) 9. [How long we keep it](#s09) 10. [How we protect it](#s10) 11. [Your rights](#s11) 12. [Age](#s12) 13. [Google user data and our use of Google's APIs](#s13) 14. [Changes to this policy](#s14) 15. [Contact](#s15) ## Who is responsible for your data Barbie Bar is operated by Barbie Bar Japtown, of 15B/98 Le Thanh Ton, Ben Nghe, Quan 1, Ho Chi Minh City, Vietnam. We are the controller of the personal data described in this policy, within the meaning of Vietnam's Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. This policy covers barbiebar.vn, enquiries and bookings you send us by WhatsApp, telephone or email, job applications, and the reporting tools we run against our own Google accounts. It was last updated on 2026-09-16 and takes effect from 2026-09-16. For anything in this policy, including a request to see, correct or delete your data, write to barbiebar.hcmc@gmail.com or message +84 91 931 2738 on WhatsApp. ## The short version - We do not sell personal data, and we never have. - This site has no forms, no accounts and no login. You cannot give us data through the site itself — every enquiry reaches us through WhatsApp, telephone or email. - On WhatsApp we may use an automated assistant to draft replies about bookings and the venue. A staff member reviews and confirms each reply before it is sent. - That assistant is for booking and venue enquiries only. Job applications and identity documents stay with people, not the assistant. - AI drafts, staff confirm / override logs, and related audit trails for those chats are kept for 12 months from your last contact (same family as booking enquiries), then deleted unless law or a dispute requires longer. - We do not sell your WhatsApp messages, and we do not use them to train third-party generative AI models. - Two third-party measurement tools can run on this site: Google Analytics 4 and the Meta pixel. Neither is loaded until you allow it, and you can change your answer at any time from the Cookie choices button at the top of this page. - Booking enquiries are kept for 12 months. Job applications we do not take forward are kept for 12 months. Payment and accounting records are kept for 10 years, because Vietnamese accounting law requires it. - Data leaves Vietnam. Our analytics, hosting and messaging providers are American companies and process data outside the country. - You have the right to know, to see, to correct, to delete and to withdraw consent. Ask, and we will act within the deadlines Vietnamese law sets. ## What we collect, and how There is no form on this website. Nothing you type into a page is transmitted to us, because there is nowhere to type. Personal data reaches us in four ways. - When you contact us. If you message us on WhatsApp, call +84 91 931 2738, or email barbiebar.hcmc@gmail.com, we receive whatever you send: your name or display name, your phone number or email address, the date, group size and room you are asking about, and anything else you choose to write. WhatsApp also shows us your profile name and picture if you have set one. - When you apply for work. Applications come in by WhatsApp. Depending on what you send, that means your name, age or date of birth, contact number, nationality and languages, work history, and any photographs you attach. We ask for proof of age and the right to work in Vietnam before an offer, and we check identity documents in person rather than by message. - When you visit the venue. If you pay by card or bank transfer, our bank and its payment terminal process the transaction and we receive a record of it. We are not sent your full card number and do not store it. If you ask for a VAT invoice we will need the billing details you give us for it. - When you read this site. Our host, our CDN and our two measurement tools receive technical data automatically: your IP address, the page you requested, the time, your browser and operating system, the language your browser asks for, and the page that referred you. Clicking a WhatsApp, telephone or email link on this site sends an event to Google Analytics and to Meta recording that a booking link was clicked, which link it was, and which page it was on. The content of any message you then send is not part of that event and is never transmitted to them by us. ## What we collect — WhatsApp assistant (booking) When you message our WhatsApp Business number (+84 91 931 2738), we may use an AI assistant running on our Grok Bot agent runtime (systems under our control as controller) to draft a reply. A staff member reviews and confirms the reply before it is sent. The assistant may process your WhatsApp profile name and picture, your number, and the content of your messages (for example dates, group size, room preference) only to triage booking enquiries and draft answers about rooms, times, prices and the venue. The assistant does not take payments, does not finally confirm a paid booking on its own, and is not used for job applications or identity / right-to-work checks. Meta provides ordinary WhatsApp Business messaging for delivery and storage of WhatsApp messages on this number, as already described. A separate Meta Cloud API path for automated agent send is not live; if we enable it later, we will update this policy and name only processors that actually handle your messages. Those Grok Bot agent systems may process message content outside Vietnam; we remain responsible for the cross-border impact assessment under Vietnamese law as elsewhere in this policy. ## Cookies and similar technologies This site sets no cookies of its own. It is a set of static pages with no session, no cart and no preference to remember. If you allow measurement, the cookies you will then find in your browser are set by third parties: - Google Analytics sets _ga and _ga_* to distinguish one visitor from another and to measure how the site is used. These persist for up to two years. - The Meta pixel sets _fbp, and reads the _fbc value Facebook adds to advertising links, to attribute a visit and a booking-link click to an advertisement. These persist for up to three months. - Cloudflare, which sits in front of this site, may set __cf_bm and similar short-lived cookies to tell automated traffic from human traffic. These are security cookies and last minutes to hours. - Google Fonts serves the typefaces this site uses. Requesting a font sends your IP address and browser details to Google's font servers. No cookie is set by that request. Nothing above is loaded until you say so. On your first visit the site asks; until you answer, no analytics or advertising script is fetched and nothing is set in your browser except Cloudflare's security cookie, which is what tells a person from a bot. Declining takes one click, is remembered on this device, and costs you nothing — the site behaves identically either way, and we do not ask again. You can change your mind whenever you like: the Cookie choices button at the top of this page reopens the question. Your answer is stored in this browser only, so it does not follow you to another device or survive clearing your browsing data. Browser settings, Google's Analytics opt-out add-on, Meta's Ad Preferences and any mainstream content blocker all still work as a second line of defence. ## Why we process it, and on what legal basis Vietnamese law is built around consent, with a short list of situations where processing may proceed without it. Each thing we do falls into one of these. - To answer you and hold your booking. Processing your enquiry is necessary to perform the contract you are asking us to enter into, and to take the steps you have asked for before it. - To consider you for a job. Processing an application is necessary to take pre-contractual steps at your request. If we keep your details on file after a decision, that is on the basis of your consent, and you may withdraw it. - To keep the accounts and pay tax. Processing payment and invoicing records is a legal obligation under Vietnamese accounting and tax law. - To keep the site standing up. Server, CDN and security logs are processed to keep the site available and to defend it from attack. - To measure marketing. Analytics and advertising measurement rest on consent. This is the processing you can refuse without losing anything — see the section above. ## Who we share it with We do not sell personal data, do not trade it, and do not pass it to data brokers. It is disclosed only to the following: - Processors that run the site and its measurement: Google LLC (Google Analytics 4, Google Fonts, Search Console — United States); Meta Platforms, Inc. (Meta pixel; WhatsApp Business messaging — United States / Ireland); Cloudflare, Inc. (CDN, DNS and edge security for barbiebar.vn — United States); Railway Corp. (Hosting of the static site — United States). - Our bank and payment providers, for card and transfer settlement, and our accountant, for the statutory books. - Competent Vietnamese authorities, where a lawful request obliges us to disclose — for example the police, the tax authority or a court. We disclose the minimum the request compels and no more. - Professional advisers under a duty of confidentiality, where we need legal or accounting advice on a specific matter. We may later receive WhatsApp messages through Meta into our own gateway for drafting; that path is not live today. Our hostess and bar staff see booking details in order to do their jobs. They are instructed not to keep guests' contact details for personal use, and not to photograph or record guests. ## Data that leaves Vietnam Our providers are foreign companies and process data outside Vietnam, principally in the United States and the European Union. That includes analytics, advertising measurement, hosting, content delivery and WhatsApp messaging. Vietnam's Law on Personal Data Protection and Decree No. 356/2025/ND-CP require the party transferring personal data abroad to prepare a cross-border transfer impact assessment dossier and to file it with the Ministry of Public Security within sixty days of the transfer beginning. We are responsible for that filing for the transfers described here and will keep it current as our providers change. If you would rather your data did not go abroad at all, contact us by telephone rather than WhatsApp, and block the two measurement tools as described above. Telephone and in-person contact keep your data inside Vietnam. ## How long we keep it - Booking enquiries, related WhatsApp messages, AI drafts, staff confirm / override logs, and agent audit trails for those threads: 12 months from your last contact, then deleted (unless a dispute or Vietnamese law requires longer). - Job applications we do not take forward: 12 months, then deleted. Records for people we employ are kept for as long as employment and Vietnamese labour and social insurance law require. - Payment, invoicing and accounting records: 10 years, as required by the Law on Accounting 2015. - Analytics and advertising data: retained by Google and Meta under the retention period configured on each account. Aggregate reports, which identify nobody, may be kept longer. - Server and security logs: short-lived, generally days to a few weeks, and overwritten in the ordinary course. ## How we protect it This site is served only over HTTPS, with HSTS and a content security policy that restricts what a page may load. It is a static export with no database and no administrative login, so there is no user table to breach. Access to the accounts that do hold personal data — the WhatsApp Business number, the shared mailbox, the Google and Meta consoles — is limited to the owner and the manager, protected by two-factor authentication where the provider offers it. Service account keys used by our reporting scripts are held outside the site's code and are never published. No arrangement is perfect. If a breach occurs that is likely to affect you, we will notify you and the competent authority within the time Vietnamese law allows. ## Your rights Under Vietnam's Law on Personal Data Protection you have the right to be informed; to consent or refuse; to access your data and to be given a copy; to correct it; to delete it; to restrict or object to processing; to withdraw consent at any time; and to complain, denounce or bring proceedings. Withdrawing consent does not undo processing that was lawful before you withdrew it. To exercise any of these, write to barbiebar.hcmc@gmail.com or message +84 91 931 2738. We will acknowledge your request within two working days. We will complete it within the periods the law sets — as a general rule ten days for access and correction, fifteen days for withdrawal of consent, and twenty days for deletion, longer only where a third party must act and we will tell you if that happens. We may need to confirm who you are before acting, so that we do not hand one person's data to another. If you are unhappy with our answer you may complain to the Ministry of Public Security, which supervises personal data protection in Vietnam, and you retain your right to go to court. ## Age Barbie Bar is an adults-only venue. Nobody under 18 is admitted, and this site is not directed at children. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it. Where Vietnamese law requires the consent of a parent or guardian for a person under sixteen, we will not process without it. ## Google user data and our use of Google's APIs We run a small set of internal reporting scripts against Google's APIs. This section is here because Google requires it, and because it is the part of this policy most people will not otherwise be able to see. Nobody signs in with Google to use anything we operate. There is no third-party application, no user base and no Google account but our own. The scripts authenticate as a service account on our own Google Cloud project, or as the owner's own Google sign-in, and read only data belonging to Barbie Bar. Google Analytics Data API: Aggregated, property-level reports for GA4 property 505784023 (event counts, page paths, traffic sources). Google Search Console API: Aggregated search performance for the barbiebar.vn property (queries, impressions, clicks, positions). Google Business Profile API (planned): The venue's own listing: name, address, hours, photos, and reviews left publicly on that listing. What we do with it: we read it, and we use it to decide what to publish and what to spend on advertising. It is not combined with your booking data, not used to build a profile of any individual, not shared with anyone outside the business, and not sold. It is not used for personalised advertising, not passed to data brokers, and not used to train generative artificial intelligence models — neither ours nor anyone else's. Barbie Bar's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Reports pulled from Google's APIs are kept on the operator's own machine for as long as they are useful for comparison, and are deleted on request. The credentials that grant this access can be revoked by us at any time from the Google Cloud console, and by Google at any time. To ask what we hold, or to have it deleted, write to barbiebar.hcmc@gmail.com. ## Changes to this policy When this policy changes, the date at the top of the page changes with it, and the previous version stops applying from that date. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you noticing the page. This policy is published in English, Japanese, Korean, Chinese and Vietnamese. The English text is the reference version; where Vietnamese law requires otherwise for a Vietnamese consumer or employee, the requirement of Vietnamese law prevails. ## Contact Barbie Bar is operated by Barbie Bar Japtown, of 15B/98 Le Thanh Ton, Ben Nghe, Quan 1, Ho Chi Minh City, Vietnam. Email barbiebar.hcmc@gmail.com. WhatsApp or telephone +84 91 931 2738. Questions about this policy, requests about your data, and complaints all go to the same place, and a person reads them. See also: [Terms of Service](https://barbiebar.vn/terms/) --- Source: https://barbiebar.vn/privacy/ · Language: `en` · Title: Privacy Policy | Barbie Bar Ho Chi Minh City Other languages: [ja](https://barbiebar.vn/jp/privacy-jp/) · [ko](https://barbiebar.vn/kor/privacy-kor/) · [zh-Hant](https://barbiebar.vn/cn/privacy-cn/) · [vi](https://barbiebar.vn/privacy-vi/)