Face Data Policy

This Policy applies to the timanh.vn website and forms an integral part of the Privacy Policy. Anything not covered here is governed by the Privacy Policy.

Summary

• The face photo you upload and the face feature vector derived from it are biometric data — sensitive personal data under Article 31 of the Law on Personal Data Protection No. 91/2025/QH15.
• They are used for one purpose only: finding photos of you at the Event you choose.
• Matching is carried out either by a recognition system we run ourselves on servers in Germany, or by Amazon Rekognition in the United States, depending on the Event.
• If you do not choose to save it, the query image is not attached to your account and technical copies are deleted automatically within 30 days.
• You can delete a saved face at any time on the search page, or delete everything by deleting your account.
• We do not sell face data, do not use it for advertising, do not give it to organisers or other users, and do not use it to train models.

1. Scope and single purpose

This Face Data Policy (the “Policy”) sets out how XMAX MEDIA JOINT STOCK COMPANY (XMAX MEDIA JSC) (the “Company”, “we”, “us”) collects, uses, stores, protects and deletes face data when you use face search on the timanh.vn website. It is built on the Law on Personal Data Protection No. 91/2025/QH15 (in particular Article 9 on consent and Article 31 on biometric data) and Decree No. 356/2025/ND-CP.

Face data is used for a single purpose: helping you find photos and videos containing you — or a person you are permitted to search for under section 9 — at the Events offered on the Service. We do not use face data for any other purpose.

2. What face data consists of

• The face photo: the image you select from your device or capture with its camera. Your browser downsizes it (longest side at most 1,280 px) before sending; our server normalises it and strips all EXIF and XMP data (including GPS coordinates and device information) before storing.
• The face feature vector: a sequence of numbers computed by a recognition model from the largest face in the photo, used to match against faces in Event photos. A vector is not an image, but it is still biometric data.
• Accompanying technical information: the number of faces detected, the face bounding box, the confidence score, and the name and configuration of the model used.
• Management information: the label you give the face, when it was saved, when it was last used, and the Events for which a search copy was made.

Under Article 31 of the Law on Personal Data Protection, biometric data is data on a person's distinctive and stable physical and biological attributes used to identify them, and belongs to the sensitive personal data category. We state this plainly so you can weigh it before using the feature.

3. Your consent

• Before you upload a face photo the website shows a short notice that face data will be processed, with a link to this Policy. Deliberately choosing a photo and starting the search after reading that notice is the act by which you consent to your face data being processed for the purpose in section 1.
• Your consent covers: deriving a vector from your uploaded photo on the recognition system the Company operates; matching through Amazon Rekognition for Events that use it; storing the photo and vector if you choose to save the face; and transferring face data to Germany and the United States as described in section 6.
• Consent is entirely voluntary. If you would rather not, simply do not use face search: you can still search by BIB number and browse the Event's whole gallery.
• You may withdraw consent at any time by deleting the saved face (section 7) or by deleting your account as described in Delete your account and data. Withdrawal does not affect the lawfulness of earlier processing, and you may use the feature again later.
• Where this Policy changes materially in how face data is processed, we post a notice on the website before the new version takes effect.

4. How face data is processed

• Collection: your browser sends only the file you select; it does not read your photo library. The camera is activated only when you choose to take a photo and grant the browser permission.
• Face crop: the system detects faces in the photo, crops the largest face and stores that crop in a temporary search folder. If no face is detected, the image is discarded and not stored. Where several people appear, the largest face is used — so please use a photo of one person.
• Storage: the image is kept in private storage on Amazon S3, encrypted at rest and not publicly accessible; it can be viewed only through a signed link that expires after about 60 minutes.
• Vector generation: for Events using our own recognition technology, the image is sent to the face recognition system the Company runs on rented servers in Germany to produce a vector, which is stored in the Service database.
• Matching: for Events using our technology, the server matches your vector against face features in that Event's photos on servers in Germany. For Events using Amazon Rekognition, that service reads your face image to match it against the Event's face collection in the United States. The result is a list of Event photos, containing no face image of yours, held in memory for at most 10 minutes for paging.
• Remembering for next time: if you choose to save the face, its key is attached to your account; your browser also keeps the key and a thumbnail so you can pick it quickly next time (section 6).
• Technology updates: when we change the recognition model, vectors are recomputed from your stored face photo and the old vectors are replaced.

The whole process is automatic. Our staff do not look at your face photos except where necessary to handle your own support request, to investigate a breach, or upon a lawful request from a competent state authority.

5. Face data in Event photos

Event photos are taken by the Company's or its partners' photographers at public sporting events. The law permits recording and processing images obtained from sporting competitions and public activities without the consent of the person pictured, provided their honour, dignity and reputation are not harmed (Article 32 of the Law on Personal Data Protection, Article 32 of the Civil Code). Photography at an Event and the supply of Event photos are carried out under an agreement between the organiser and the Company.

So that search can work, our systems automatically analyse Event photos to read BIB numbers and derive face features for the people appearing in them, on the Company's recognition system in Germany or using Amazon Rekognition in the United States, depending on the Event. Those features:

• are used only to match searches run by users with their own face or the face of someone they are permitted to search for;
• are not linked to the name or account of the person pictured, and are never used to identify, profile or track anyone;
• are kept for as long as the Event photos are kept under the organiser agreement, or until a photo is removed on request.

If you appear in an Event photo and want it removed or hidden, or want your face in it excluded from search, send a request as described in the Photo Usage Rules — even if you have no account on the website.

6. Where it is stored and who processes it

These providers act as processors under contracts, service terms and data processing terms with the Company, with confidentiality undertakings. Cross-border transfer of face data is carried out under Article 20 of the Law on Personal Data Protection and falls within the consent described in section 3.

7. Retention and how to delete

How to delete:

• Delete one face: in the saved-faces list on an Event's search page, select the face and delete it. The image, vector and search copies are removed from our servers immediately, and the matching entry is removed from your browser.
• Delete everything: delete your account as described in Delete your account and data, or email [email protected].
• Delete the copy on your machine: clear your browsing data (cookies and local storage) for timanh.vn.
• Request a copy of your face data, restriction or objection: email [email protected]. We respond within 2 working days and act within the deadlines in Decree No. 356/2025/ND-CP (10 days for a copy, 15 days for restriction or objection, 20 days for deletion; extendable once, in which case we will tell you).

8. What we undertake not to do

• We do not sell, rent or trade face data.
• We do not use face data or face photos for advertising, marketing, profiling or behavioural analytics, and we do not let third parties do so.
• We do not use face data to identify or track you or anyone else beyond the searches you run yourself; we provide no way to search for strangers.
• We do not use face data to infer your age, gender, ethnicity, emotions, health or any other characteristic.
• We do not use your face photos or vectors to train the Company's face recognition models.
• We do not give face data to event organisers, sponsors, photographers or other users; only to competent state authorities upon a lawful request.

9. Only your own face, or someone you may search for

You may upload and use a face photo only of:

• yourself;
• a minor for whom you are the parent or legal guardian — in which case you consent on their behalf, use it only in their interest, and, for a child aged 7 or over, explain it and obtain the child's agreement;
• another person who has clearly agreed to let you use their face photo to find their photos on the Service. You are responsible for obtaining and being able to prove that agreement; we may ask for evidence or delete the face where there are signs of misuse.

It is prohibited to use another person's face photo without their consent, or to use the Service to identify strangers, track, harass or collect images of other people. Breaches are handled under the Photo Usage Rules and the Terms of Use.

10. Security

• All connections are encrypted with HTTPS/TLS; face images are encrypted at rest and reachable only through a signed link that expires after about 60 minutes.
• Only the account holder can search with their own saved faces; the system rate-limits searches to prevent abuse.
• System logs never record face images or vectors; internal access is limited to the staff who need it.
• Under Article 31 of the Law on Personal Data Protection, biometric data is held in the provider's physically secured data centres, with restricted access and monitoring to detect intrusion.
• If an incident involving face data occurs, we notify the specialised personal data protection authority within 72 hours of detection and notify you within 72 hours, or publicly where we cannot reach you directly.

11. Changes to this Policy

This Policy carries a version number and an effective date shown at the top of the page. Where there is a material change in how face data is processed, we post a notice on the website before the new version takes effect.

Contact

• XMAX MEDIA JOINT STOCK COMPANY (XMAX MEDIA JSC)
• Registered office: No. 18 Dong Nhan Street, Hai Ba Trung Ward, Hanoi, Vietnam
• Enterprise code (tax code): 0110577248
• Phone: +84 942 366 688
• Personal data protection contact: Personal Data Protection Unit
• Email: [email protected]

This document is made in Vietnamese and English. In case of any discrepancy between the two versions, the Vietnamese version prevails.