Legal
Privacy policy.
We keep data collection to the minimum needed to run this website and reply to your enquiries. This notice explains what we process, why, and your rights under the GDPR.
Last updated: 2026-08-16
1. Controller
The controller responsible for data processing on this website is:
ScratLabs
FPT City, Nam Kỳ Khởi Nghĩa, 50500 Da Nang, Vietnam
Email: linhld@scratlabs.com
ScratLabs
FPT City, Nam Kỳ Khởi Nghĩa, 50500 Da Nang, Vietnam
Email: linhld@scratlabs.com
2. What we process and why
Server logs. When you visit the site, our hosting provider automatically processes technical data (IP address, date/time, requested URL, referrer, browser and OS) to deliver the pages and keep the service secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, secure website). Logs are kept for a short period and then deleted.
Contact form & email. If you contact us, we process the details you provide (name, email address, company, message) solely to answer your enquiry and, where applicable, to prepare a proposal. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR. We keep enquiries for as long as needed to handle them and any follow-up, then delete them unless statutory retention applies.
Language preference. A functional cookie (
NEXT_LOCALE) remembers your chosen language for one year. It contains no personal data. Legal basis: Art. 6(1)(f) GDPR / §25(2) TDDDG (strictly necessary).3. Cookies and tracking
This website does not use advertising cookies, tracking pixels or third-party analytics that profile visitors. Only the strictly necessary language cookie described above is set, so no consent banner is required. Should we add privacy-friendly, cookieless analytics in future, this notice will be updated.
4. Recipients and processors
We use the following service providers as processors under Art. 28 GDPR:
- Hosting: Railway Corp., USA (EU/US Data Privacy Framework) — privacy policy. Transfers to the USA are covered by the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
- DNS/CDN: Cloudflare, Inc. — privacy policy.
- Email: Zoho Corporation — privacy policy. Contact-form messages are delivered by email through a transactional email service.
We do not sell personal data and do not share it with third parties for their own marketing.
5. Storage period
We store personal data only for as long as necessary for the purposes above, or as required by law (e.g. commercial and tax retention obligations for contract-related correspondence). Afterwards data is deleted or anonymised.
6. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.
To exercise your rights, email linhld@scratlabs.com. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement.
7. Security
The site is served exclusively over HTTPS (TLS). We apply appropriate technical and organisational measures to protect data against loss, misuse and unauthorised access.
8. Changes
We may update this notice to reflect legal or technical changes. The current version is always available on this page.