Privacy Notice
Version 2026-10-18 · Last updated October 18, 2026
This notice explains what personal data TechMe collects when you ask for help, why, who else handles it, how long it is kept, and what rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR / UK GDPR), Japan's Act on the Protection of Personal Information (APPI) and Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15).
1. Who is responsible for your data
The controller of your personal data is:
Win Nguyen, trading as TechMeHamlet 1, Phuoc Vinh Residential Group, Hue City, Vietnam
Email: winnguyen.techdev@gmail.com
2. What I collect
- Contact data: your email address.
- Your request: your description of the problem, website addresses, screenshots, files and any messages we exchange. Please do not include passwords, health information or other sensitive data.
- Payment data: from PayPal, your name, email, country, the amount, date and transaction ID. I never see your card or bank details.
- Business details (optional): company name and VAT number, if you buy as a business.
- Technical data: IP address and browser information, processed briefly by the hosting and security providers to deliver the site and block abuse.
- Consent record: the date and the version of this notice you agreed to.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Reading your request, replying, quoting and delivering the service | Performing a contract or steps before one, Art. 6(1)(b) |
| Payments, invoices and accounting records | Legal obligation, Art. 6(1)(c) |
| Keeping the site secure, rate limiting and preventing spam or fraud | Legitimate interests, Art. 6(1)(f) |
| Handling complaints, refunds and payment disputes | Legitimate interests, Art. 6(1)(f), and legal obligation |
Under Vietnam's Law on Personal Data Protection and Japan's APPI, processing is based on the consent you give when you send the form, together with the purposes listed above. I do not use your data for advertising or newsletters, and I do not sell or share it for targeted advertising.
4. Use of AI tools
An AI service helps translate your message and sort it by type. It does not decide anything about you: I read every request and write or check every reply myself. There is no automated decision-making with legal or similar effects (Art. 22 GDPR). The AI provider may not use your data to train its models.
5. Who else handles your data
| Provider | What for | Where | Safeguard |
|---|---|---|---|
| Supabase Inc. | Database and file storage for requests, messages and attachments | Canada (Montréal) data centre; company in the USA | EU and UK adequacy decisions for Canada; Standard Contractual Clauses (Supabase DPA) |
| Cloudflare, Inc. | Website hosting, content delivery, bot and abuse protection (Turnstile) | Global network; company in the USA | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Resend, Inc. | Sending email notifications about your request | USA | Standard Contractual Clauses (Resend DPA) |
| Anthropic PBC | AI-assisted translation and sorting of your message; not used to train models | USA | Standard Contractual Clauses (Anthropic DPA) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. and affiliates (independent controller) | Processing payments and refunds | Luxembourg / worldwide | PayPal acts under its own privacy statement |
I only share data beyond this list if the law requires it, for example with tax authorities or a court.
6. International transfers
I operate from Vietnam. The European Commission and the UK have not made an adequacy decision for Vietnam. When you send me a request, your data is provided directly to me so I can perform the service you ask for. Where your data goes to providers outside your country, the safeguards listed above apply.
For users in Japan (APPI): your data is provided to me in Vietnam and to the providers above, mostly in Canada, the USA and the EU. Vietnam has a general personal data protection law (Law No. 91/2025/QH15) that includes data subject rights and security obligations. Canada's private-sector law (PIPEDA) covers personal data handled by businesses. The USA has no comprehensive federal data protection law; protections come from sector and state laws and from the contracts listed above. The EU is covered by the GDPR.
7. How long I keep it
| Data | Kept for |
|---|---|
| Enquiries that never became a paid request | 12 months, then deleted |
| Attachments of unpaid requests | 7 days after the payment link expires |
| Attachments of completed requests | 90 days after completion |
| Messages and request history | 24 months after completion, for follow-up questions and disputes |
| Payment and accounting records | As long as Vietnamese accounting law requires (up to 10 years) |
8. Your rights
Depending on where you live, you can:
- get a copy of your data and information about how it is used (access);
- have wrong data corrected;
- have your data deleted, unless I must keep it by law;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing already done;
- complain to a data protection authority.
To use any right, email winnguyen.techdev@gmail.com. I reply without undue delay and within one month at the latest. I may ask you to confirm your identity first.
Authorities: your local EU data protection authority; the UK Information Commissioner's Office (ico.org.uk); Japan's Personal Information Protection Commission (ppc.go.jp); in Vietnam, the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
9. Security
Data is encrypted in transit, stored with access limited to me, and files are only reachable through short-lived links. I never ask for your passwords. If a breach puts your data at risk, I notify the competent authority within 72 hours and inform you without undue delay where the law requires.
10. Cookies and local storage
This site does not use analytics, advertising or tracking cookies. The help form saves an unsent draft in your own browser (local storage) so you do not lose your text; it never leaves your device until you press send. The security provider may set a strictly necessary cookie to tell people from bots.
11. Children
The service is not intended for anyone under 16.
12. Changes
When this notice changes, the version and date at the top change too. If a change affects what you agreed to, I will ask you again before relying on it.