ZCRM
Get in touch

Privacy Policy

ZCRM is a conversational CRM platform that lets businesses connect and manage personal Zalo accounts, Zalo Official Account (OA), Facebook Messenger, Instagram, WhatsApp Cloud API and webchat in one unified inbox, together with a companion mobile app. This policy explains how ZCRM collects, uses, stores and protects personal data when a business customer ("Business") and that Business's own end users (its customers) interact with the platform.

Operator: THIEN PHUC TRADE – SERVICE – SOLUTIONS CO., LTD. (CÔNG TY TNHH TM – DV – GIẢI PHÁP THIÊN PHÚC), tax code 0318783017, address 48/56D Ho Bieu Chanh, Phu Nhuan Ward, Ho Chi Minh City, Vietnam. This policy is prepared in line with Vietnam's Decree 13/2023/ND-CP on personal data protection, the Law on Cybersecurity Information Safety (Luật An toàn thông tin mạng), and the Law on Electronic Transactions.

1. Who this policy applies to

  • Businesses using ZCRM (the contracting/subscribing party) — admin account data, operating staff information, billing details.
  • End users — the customers and contacts a Business manages through Zalo, Facebook, Instagram, WhatsApp and webchat channels connected to ZCRM.

ZCRM acts as a data processor on behalf of the Business with respect to end-user data; the Business acts as the data controller and is responsible for the lawfulness of collecting its own customers' data.

2. Personal data we process

  • Admin account data: name, email, phone number, job title, hashed password, login logs.
  • Conversation content: text, images, video, attachments, voice notes and stickers exchanged through connected personal Zalo, Zalo OA, Facebook Messenger, Instagram, WhatsApp and webchat channels.
  • End-user contact data: display name, phone number, social account identifiers (Zalo ID, Facebook PSID, etc.), address, care notes, tags and sales-pipeline stage.
  • Lead data: information obtained through ads or forms where the Business enables lead-capture features, plus source/attribution history.
  • System operation data: audit logs of staff actions, IP address, device type and access time, used for security and incident tracing.
  • Billing information (where applicable): company name, tax code and invoicing details tied to the service contract. ZCRM does not store full bank card numbers of the paying party.

ZCRM does not intentionally collect sensitive personal data (religion, health, biometrics, etc.). If such data is unintentionally included in message content submitted by users, it is handled like any other conversation content, and the Business remains responsible for complying with any specific rules that apply to that category of data.

3. Purposes and legal basis

Data is processed to: provide and maintain the unified inbox, customer management, appointment, reporting and AI chatbot features within the scope the Business has subscribed to; authenticate accounts and enforce role-based access control; keep audit logs for system security; provide technical support and respond to Business requests; perform the contract between Thien Phuc and the Business; and comply with legal obligations when lawfully required by competent authorities.

The legal basis for processing is: (a) consent of the data subject — for a Business, given at contract signing/trial sign-up; for an end user, given when they voluntarily message or add as a friend a channel operated by the Business; (b) contract performance where the data subject is a party to, or is preparing to enter into, a contract; and (c) legal obligation where a competent state authority makes a lawful request.

4. Sharing with third parties

ZCRM does not sell or rent personal data. Data is shared only in the following cases:

  • Underlying messaging platforms: to synchronize conversations, data is necessarily exchanged via the official APIs/protocols or authenticated sessions of Zalo, Meta (Facebook Messenger, Instagram) and WhatsApp Cloud API, in line with each platform's own terms.
  • Hosting/media storage providers: data is stored on infrastructure Thien Phuc leases, or infrastructure the Business itself designates, under equivalent security commitments.
  • AI providers (only when the Business enables the AI chatbot/assistant feature and configures its own API key): relevant content may be sent to the AI model provider the Business itself selected, to generate responses.
  • Payment processors (if online billing applies): information necessary to process the transaction, under that provider's own privacy policy.
  • Competent state authorities: upon a lawful written request following due legal process.

Outside of the above, ZCRM does not share personal data with any other third party without the consent of the data subject or the Business.

5. Storage and security

  • HTTPS/TLS encryption for all traffic between browser, mobile app and servers.
  • Role-based access control (RBAC) — staff only see data within their granted scope.
  • Phone number masking (Privacy PIN) — limits staff from copying customer phone numbers out of the system unnecessarily.
  • Audit logging of significant system actions for incident tracing.
  • Account passwords are stored hashed, never as plain text.
  • Periodic backups to reduce the risk of data loss from technical incidents.

Data is retained for the duration of the active service contract between Thien Phuc and the Business. After termination, data is kept for a reasonable additional period to support data export requests and accounting/legal obligations, after which it is deleted or anonymized under internal procedure, unless a longer retention period is required by law. A Business may request earlier deletion via the contact channel in Section 8.

No system is completely secure. Thien Phuc commits to applying reasonable technical and organizational measures to reduce risk, and will notify the Business of any data breach affecting data subjects' rights within the timeframe required by Decree 13/2023/ND-CP.

6. Your rights

Under Decree 13/2023/ND-CP, a data subject has the right to: know how their personal data is processed; give or withhold consent to processing; access, view and request correction of their personal data; withdraw previously given consent; request deletion of their data; request restriction of processing, request a copy of their personal data, and object to processing; complain, denounce or initiate legal proceedings where they believe their rights were violated; and claim damages under applicable law where a breach of data protection rules causes harm.

To exercise these rights, an end user should contact the Business they interact with directly (via the Zalo/Facebook/Instagram/WhatsApp/webchat channel that Business operates); a Business, or anyone needing Thien Phuc's assistance as data processor, should use the contact channel in Section 8. Valid requests are answered within a reasonable time appropriate to the request and applicable law.

7. Cookies and similar technologies

The ZCRM website and webchat may use cookies and similar storage technologies (localStorage) to maintain login sessions, remember display preferences and measure usage performance. Users may disable cookies in their browser settings; some login/session features may not work fully with cookies disabled.

8. Contact us about personal data

  • Operator: THIEN PHUC TRADE – SERVICE – SOLUTIONS CO., LTD.
  • Address: 48/56D Ho Bieu Chanh, Phu Nhuan Ward, Ho Chi Minh City, Vietnam
  • Hotline: 0945031039
  • Email: [email protected]

9. Changes to this policy

This policy may be updated to reflect product changes or changes in law. The updated version is published on this same page together with its last-updated date. Material changes affecting how data is processed will be notified to the Business by email or an in-app notice.

Last updated: 18 September 2026