Privacy Policy

This Policy applies to the timanh.vn website. The Tìm Ảnh mobile app and the bananh.vn website have their own policies.

Summary of the key points

• We do not sell personal data and we do not use your photos or face data for advertising.
• The face photo you upload is biometric data. It is used for one thing only: finding photos of you at the Event you choose. Depending on the Event, matching is performed either by a recognition system we run ourselves or by Amazon Rekognition from Amazon Web Services.
• Retention: a face you choose to save is kept until you delete it or delete your account; single-use query images and technical copies are deleted automatically within 30 days; system logs are kept for at most 12 months. Full tables in sections 3 and 8.
• How to delete: delete individual faces directly on the search page, delete your whole account and data as described in Delete your account and data, or email [email protected].
• Data is stored on rented servers in Germany and on Amazon Web Services in the United States, meaning it is transferred outside Vietnam (section 7).
• The website uses cookies and third-party web analytics (Google Analytics, Google Tag Manager, Hotjar) — details and how to opt out in the Cookie Policy.

1. Introduction and scope

This Privacy Policy (the “Policy”) explains how XMAX MEDIA JOINT STOCK COMPANY (XMAX MEDIA JSC), enterprise code 0110577248, with its registered office at No. 18 Dong Nhan Street, Hai Ba Trung Ward, Hanoi, Vietnam (the “Company”, “we”, “us”) collects, uses, shares, stores, protects and deletes personal data when you use the timanh.vn website and the online services behind it (together, the “Service”).

For the Service, the Company is the personal data controller and processor: we decide the purposes and means and process your personal data directly, while using certain service providers as processors acting on our instructions (section 6). This Policy is the notice of personal data processing given to you before your data is processed.

This Policy is built on the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP detailing that Law (both effective 1 January 2026, replacing Decree No. 13/2023/ND-CP), the Law on Protection of Consumer Rights No. 19/2023/QH15, the Law on E-Commerce No. 122/2025/QH15 and other applicable laws.

The Face Data Policy forms an integral part of this Policy and prevails for face data. The Cookie Policy sets out cookie details. Delete your account and data explains how to delete your account.

Your account is shared by email address with the bananh.vn website and the Tìm Ảnh mobile app. Data you provide directly on those platforms is processed under the policy published on the platform concerned.

2. The data we collect

2.1. Data you provide

• Account information: email address; full name (if you enter one); a password if you register by email (stored only as a one-way hash, so nobody can read the original); a phone number if you add one.
• Face data (sensitive personal data): the face photo you upload in order to search, and the face feature vector derived from it. See the Face Data Policy.
• Search requests: the Event, the search mode (face, BIB number, all photos), the BIB number and the Event password where one applies. Event passwords are only checked, never stored on the server.
• Contact and support: the email address, phone number and message you send through the Contact form or to [email protected]; information needed to verify you when you make a data request or ask for a photo to be taken down.
• Settings: your display language.

2.2. Data collected automatically

• Technical and security data: IP address, time of access, the path and function called, error codes, browser and operating system (user agent) in system logs; short-lived counters that limit how often searches may be run.
• Account activity: when the account was created and when it was last active.
• Web analytics: through Google Analytics (G-E7ZF2GN4G3), Google Tag Manager (GTM-MWFF33CD) and Hotjar (site 5262487): pages viewed, the order you viewed them in, time on page, referral source, device and browser information at a general level, and a random identifier kept in a cookie. Hotjar records mouse movement, scrolling and clicks in anonymised form so we can improve the interface. Details and opt-out in the Cookie Policy.

2.3. Data we receive from third parties

• Google, if you sign in with Google: account identifier, verified email, name and profile picture (if any).
• Photographers and event organisers: photos and videos taken at public sporting events in which you may appear, supplied under an agreement between the organiser and the Company; for Events with certificates, race results (name, BIB number, finishing time). Our systems automatically read BIB numbers and derive face features from Event photos so that search can work (Face Data Policy, section 5).
• Our other platforms: if you use the same account, account information and saved faces are shared between timanh.vn, bananh.vn and the Tìm Ảnh app.

2.4. Data we do not collect

• Card numbers, bank account numbers, PINs or OTPs.
• Your precise location, contacts, messages or health data. Location and device information in the EXIF data of a face photo is stripped before storage.
• Your whole photo library: your browser sends only the file you select.
• We integrate no advertising network and do not use your data for ad targeting.

2.5. Data stored in your browser

So that you do not have to upload a photo every time, your browser stores the list of keys of the faces you have used (the tf_faces cookie, up to 8 faces) and their thumbnails (in localStorage, under tf_face_thumbs). This data stays on your machine, is not sent to any third party, and is removed when you clear your browsing data or delete the face on the website. Safari may clear it automatically after 7 days without a visit. The full cookie list is in the Cookie Policy.

3. Purposes, legal bases, retention and recipients

We process personal data only for the purposes set out below. We do not use personal data for advertising, do not profile you, and do not take fully automated decisions producing legal effects on you. Each recipient's name and role is given in section 6.

Where the law classifies any of the above as sensitive personal data, we apply the protections required for that category.

4. Your consent

• How we ask: links to the Terms of Use and to this Policy appear in the footer of every page, on the registration screen and at the point where you upload a face photo. Deliberately uploading a face photo after reading that notice is the act by which you consent to your face data being processed in order to find your photos.
• Consent is voluntary: you can choose not to use face search and still search by BIB number and browse an Event's gallery.
• Withdrawing consent: delete the saved face on the search page; delete your account as described in Delete your account and data; or email [email protected]. For analytics cookies see the Cookie Policy. Withdrawal does not affect the lawfulness of processing carried out beforehand.
• Where consent is not required under Article 19 of the Law on Personal Data Protection: performing our agreement with you (providing the Service); complying with legal obligations (accounting, tax, requests from competent authorities); protecting our and others' legitimate rights and interests to the extent necessary against infringement.

5. What we do not do

• We do not buy, sell, rent or trade personal data.
• We do not use photos or face data for advertising, marketing or behavioural profiling, and we do not let third parties do so.
• We do not give data to data brokers.
• We do not give your personal data, including face data, to event organisers, sponsors, photographers or other users, beyond what is stated in this Policy (for example, Event photos shown in the gallery). We may share aggregated statistics that do not identify anyone.
• We do not use your face photos or vectors to train our face recognition models.

6. Recipients and processors

• These providers process data under contracts, service terms and data processing terms with the Company, with confidentiality undertakings. We allow access only where a party protects data to a standard equivalent to this Policy.
• Google and Hotjar also process some data as independent parties under their own privacy policies.
• If the Company is reorganised, merged, consolidated, divided, split or transferred, data may pass to the successor under applicable law provided that it continues to protect the data in line with this Policy; you will be notified.
• If you share a photo yourself through social media or a messaging app, further processing follows that platform's policy.

7. Cross-border transfer of personal data

To provide the Service, your personal data, including face data, is transferred outside Vietnam and stored and processed in Germany (Contabo rented servers: application servers, database, face recognition system) and the United States (Amazon S3 and Amazon Rekognition in us-west-2). Emails you send to our support mailbox are handled by a provider based in Singapore; analytics data is processed in the United States and the European Union; some data is also processed in the countries where Cloudflare and Google operate infrastructure.

We carry out cross-border transfers in accordance with Article 20 of the Law on Personal Data Protection, including preparing and filing a cross-border transfer impact assessment dossier with the specialised personal data protection authority under the Ministry of Public Security, and applying safeguards: contracts and data processing terms with providers, encryption in transit, encryption at rest for photos on Amazon S3, and restricted, controlled access. Your data continues to be protected under this Policy while abroad.

8. Storage and deletion

• Principle: your account information, saved faces and support requests are kept until you delete them, withdraw consent or delete your account; we do not delete them automatically over time. Only the data below has its own fixed period.
• Deletion by your action: when you delete a face, the corresponding data is removed from our servers immediately.
• Automatic deletion: single-use face photos (where you did not choose to save) and technical search copies are deleted within 30 days; password reset codes after 15 minutes; search results are held in memory for at most 10 minutes for paging; system logs for at most 12 months; backups (if any) are overwritten or deleted on the backup cycle.
• When you delete your account: account information, all saved faces (including faces you saved on our other platforms with the same account), settings and support requests sent through the website are deleted immediately. Email copies of support requests in our mail system are not deleted automatically; you may ask us to delete them at [email protected]. See Delete your account and data.
• When a retention period ends, data is deleted or de-identified so that you can no longer be identified. If there is a valid reason why we cannot delete something you asked us to delete (for example a statutory retention obligation), we will tell you.

9. Security

• All connections between your browser and our servers are encrypted with HTTPS/TLS.
• Face photos are kept in private storage, encrypted at rest, not publicly accessible; they can be viewed only through a signed link that expires after about 60 minutes.
• Passwords are stored only as one-way hashes. Sessions are time-limited and kept in a cookie with the secure flag and SameSite=Lax.
• System logs never record passwords, face photos or face vectors; the system rate-limits requests to prevent abuse.
• Internal access to data is limited to the staff who need it. Biometric data is protected under Article 31 of the Law on Personal Data Protection: held in the provider's physically secured data centres, with restricted access and monitoring to detect intrusion.
• No measure is perfectly secure. If we detect a personal data protection breach that may harm your rights or interests, we will notify the specialised personal data protection authority within 72 hours of detection; if the incident involves biometric data, we will notify you within 72 hours, or publicly where we cannot reach you directly.

10. Your rights and how to exercise them

Under Article 4 of the Law on Personal Data Protection you have the right to: know how your personal data is processed; give or refuse consent and ask to withdraw it; access, correct or request correction of your data; request a copy of, deletion of, or restriction of processing, and object to processing; complain, denounce, bring legal action and claim damages; and request protective measures for your personal data.

10.1. Things you can do yourself on the website

• View and edit your account details and change your password: the Account information section.
• Delete an individual saved face: in the face list on an Event's search page.
• Remove face data stored in your browser: clear your browsing data (cookies and local storage).
• Refuse analytics cookies: see the Cookie Policy.

10.2. Requests by email

For anything else (a copy of your data, restriction or objection, account deletion, complaints), email [email protected], preferably from the account's email address. Under Decree No. 356/2025/ND-CP we respond within 2 working days of a valid request and complete it within: 10 days for access, correction or a copy; 15 days for withdrawal of consent, restriction or objection; 20 days for deletion. Where we need to involve a processor or verify further, the deadline may be extended once as permitted, and we will tell you why. Exercising your rights is free of charge unless the law provides otherwise.

To protect you we may ask you to confirm that you own the account, for example by replying from the account's email address. We never ask for your password or for photographs of identity documents. We may refuse or only partly perform a request where the law permits, and will give our reasons.

You may complain to the specialised personal data protection authority under the Ministry of Public Security (the Department of Cyber Security and High-Tech Crime Prevention), to another competent authority, or bring an action before a court.

11. Deleting your account

You can ask to delete your account at any time. That account is shared with the bananh.vn website and the Tìm Ảnh app, so after deletion you will no longer be able to sign in to those platforms with it either. Full instructions, and the list of what is deleted and what is kept, are in Delete your account and data.

12. Children and minors

• The website is not designed for children. A person under 16 may use the Service only with the consent and supervision of a parent or guardian, who exercises the data subject's rights on the child's behalf.
• Face data for a person under 16 may be created only by a parent or guardian and only in the child's interest; for a child aged 7 or over, the parent or guardian must explain it and obtain the child's agreement as the law requires.
• If we find that we have collected a child's data without valid consent, we will delete it.
• Event photos may show children. A parent or guardian may ask at any time for such photos to be removed or hidden at [email protected]; we prioritise requests involving children.

13. Cookies and similar technologies

The website uses cookies to keep you signed in, remember your language, remember the faces you have searched with, and to measure traffic. The full list of cookies, their purposes, lifetimes and how to refuse them is in the Cookie Policy.

14. Third-party links and services

The website may link to event organisers' websites, sponsors or social networks. Collection and processing on those websites and services follow the operator's own policy and are outside the scope of this Policy.

15. Changes to this Policy

Each version carries a version number and an effective date shown at the top of this page. Where a change is significant we will post a notice on the website before the new version takes effect and, where the law requires it, ask again for your consent to processing that is based on consent.

Contact

• XMAX MEDIA JOINT STOCK COMPANY (XMAX MEDIA JSC)
• Registered office: No. 18 Dong Nhan Street, Hai Ba Trung Ward, Hanoi, Vietnam
• Enterprise code (tax code): 0110577248
• Phone: +84 942 366 688
• Personal data protection contact: Personal Data Protection Unit
• Email: [email protected]

This document is made in Vietnamese and English. In case of any discrepancy between the two versions, the Vietnamese version prevails.