Data protection

In the course of your use of our services, Vietjet Air may process basic personal data, including identification data, contact information, booking and travel itinerary information, loyalty programme information, payment information, correspondence and communication records, as well as data generated through applications, interactions and technical activities.
In addition, we may process your special categories of personal data to the extent necessary and in accordance with applicable laws, including biometric data, images of identity documents, detailed payment information, information that may reveal religious or philosophical beliefs, health data, and location data.

We process your personal data for the purposes of providing services, ensuring safety and security, complying with legal obligations, and improving customer experience, where applicable based on your consent and other lawful bases under applicable law. Specific processing purposes include:

• Performance of the Contract of Carriage and provision of services to you;
• Administration of the Vietjet SkyJoy membership programme;
• Facilitation of payment services through the Galaxy Pay payment gateway;
• Sharing of Passenger Name Record (PNR) and Advance Passenger Information (API) data with competent authorities;
• Ensuring aviation safety and security;
• Compliance with accounting and financial obligations;
• Customer care and support services;
• Direct marketing activities (subject to your consent, where required).

Yes. In certain circumstances necessary for service provision and legal compliance, we may share your personal data with:

• Partners and service providers involved in flight-related operations for the purposes of providing, operating and improving service quality;
• Competent governmental and regulatory authorities, where required for mandatory immigration procedures or for the prevention, detection and investigation of terrorism and other serious criminal offences;
• Overseas affiliates, suppliers, service providers, or competent authorities for the purposes set out in our Privacy Policy.

Any sharing of personal data is carried out in compliance with applicable laws and subject to appropriate safeguards to ensure the security and protection of your personal data.

Potentially, yes. As Vietjet Air provides international air transport services, your personal data may be transferred outside the European Union (EU) or the European Economic Area (EEA) for the purposes of performing the Contract of Carriage and delivering related services.
For passengers who are residents or citizens of the EU/EEA, international transfers of personal data are carried out in accordance with the GDPR, including through the implementation of Standard Contractual Clauses (SCCs) and the execution of Data Processing Agreements (DPAs) with relevant partners to ensure an adequate level of data protection.

Vietjet Air retains your personal data only for as long as necessary to fulfil the processing purposes for which the data was collected, or as otherwise required under applicable law.
Retention periods may vary depending on the type of data. For example:

• Booking and payment information is generally retained for five (05) years;
• Biometric data and health data are retained for a shorter period for service delivery purposes (up to thirty (30) days following the date of the last flight);
• Marketing-related data is retained until you withdraw your consent, plus an additional thirty (30) days;
• Certain other categories of personal data may be retained in accordance with legal or regulatory requirements.

Under applicable data protection laws, you have the following rights as a data subject:

• The right to be informed about Vietjet Air’s processing of your personal data;
• The right to provide or withdraw consent for the processing of your personal data, where consent is the lawful basis for processing;
• The right to access, review, rectify or request correction of your personal data;
• The right to request access to, erasure of, or restriction of processing of your personal data, and to object to processing;
• The right to lodge a complaint, initiate legal proceedings, or seek compensation in accordance with applicable laws;
• The right to request competent authorities, organisations, or relevant persons involved in personal data processing to implement measures for the protection of your personal data in accordance with applicable law.

To exercise your rights relating to personal data processed within the scope of our services, you may contact Vietjet Air through our official channels, including our hotline at 1900 1886 or our Data Protection Officer (DPO) at dpo@vietjetair.com.
For passengers residing in the European Economic Area (EEA), you may also contact Vietjet Air’s EU Representative:

• Bird & Bird GDPR Representative Services SRL
• Avenue Louise 235, 1050 Brussels, Belgium
• Email: EUrepresentative.vietjetair@twobirds.com

You may also contact the competent data protection supervisory authority in your country of residence.

Vietjet Air protects your personal data through a combination of organisational, technical and incident response measures, including internal awareness and training programmes, data processing procedures, encryption and access controls, cybersecurity and intrusion prevention systems, regular security testing, and role-based access management.

As a general principle, the provision of personal data to Vietjet Air is voluntary.
However, in certain circumstances, you are required to provide information necessary for Vietjet Air to perform the Contract of Carriage, provide services, and comply with legal and regulatory obligations. Such information may include identification data, contact details, PNR/API data, and information necessary for identity verification and aviation security purposes.