Privacy & Data Protection Policy

Phung Beauty & Tech GmbH (Registered in Switzerland, UID: CHE-474.361.935) and our global software engineering headquarters Sudo Software & E-Commerce Co., Ltd. (collectively referred to as "Sudo", "we", "us", or "our") respect your privacy and are committed to protecting the corporate information and personal data of organizations and individuals ("Client" or "you") using Sudo’s services, including: custom software consulting and development, enterprise web engineering, mobile application development, API & system integration, Cloud Server infrastructure, DevOps maintenance, and related technology services.

This Privacy Policy is established in strict compliance with Swiss and European data protection regulations and international security standards, including:

• The Swiss Federal Act on Data Protection (FADP / revDSG) of the Swiss Confederation;
• The General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR) of the European Union and the European Economic Area (EEA);
• International information security management principles aligned with ISO/IEC 27001.

By registering an account, submitting a consultation inquiry, executing a service agreement, or using any digital service provided by Sudo, the Client acknowledges that they have read, understood, and agreed to the terms set forth in this Privacy Policy.

Article 1: Definitions and allocation of legal roles

To ensure full transparency and compliance with the Swiss FADP and the EU GDPR, the key terms and legal roles in this Policy are defined as follows:

• "Client": Any organization, enterprise, or individual that directly enters into a contract, registers an account, or uses Sudo’s software and digital services.
• "Personal Data": Any information relating to an identified or identifiable natural person ("Data Subject"), whether in the form of symbols, text, numbers, images, audio, or electronic identifiers.
• "Service Data": All information, source code files, internal databases, business records, and end-user data that the Client stores, transmits, or processes via custom software, web platforms, or cloud server infrastructure provided or handed over by Sudo.
• "Role as Data Controller": Our Swiss entity Phung Beauty & Tech GmbH (UID: CHE-474.361.935) and Sudo Software & E-Commerce Co., Ltd. act as the Data Controller (pursuant to Swiss FADP and EU GDPR Art. 4(7)) solely with respect to the Client’s corporate identification details, business contact information, and direct billing/support history with Sudo for contract administration and technical support purposes.
• "Role as Data Processor": With respect to "Service Data" uploaded to cloud servers or operated within custom software by the Client, the Client is the sole Data Controller. Sudo acts strictly as a Data Processor (pursuant to EU GDPR Art. 28 and Swiss FADP Art. 9) on behalf of the Client, processing data solely within the technical scope required to maintain and support the system.
• "Security Incident (Data Breach)": Any unauthorized intrusion, disclosure, alteration, destruction, or loss of data resulting from cyberattacks or unforeseen technical failures.

Article 2: Scope, legal basis, and purpose of data collection

2.1. Information collected by Sudo

Sudo collects only the minimum necessary information when a Client requests a consultation, enters into a contract, or uses Sudo’s support portal:

• Legal & corporate identification: Full name and title of the authorized representative, legal company name, Company Registration Number / Swiss UID, and VAT/Tax identification number.
• Business contact information: Registered office address, billing address, corporate email address, phone/WhatsApp number, and bank account details for invoicing and tax compliance.
• Technical and access logs: IP address, access timestamps, browser type, and operating system recorded when accessing Sudo’s technical support portal (support.sudo.vn).
• Payment records: Transaction and invoice history. Sudo does not store Client credit card numbers or banking credentials; all payments are processed securely through PCI-DSS compliant banking channels and licensed international payment gateways (SEPA / SWIFT bank transfer, Stripe, Apple Pay, Google Pay, PayPal).

2.2. Legal basis and purpose of processing

In accordance with the Swiss FADP and Article 6 of the EU GDPR, Client identification data is processed strictly on the basis of contractual necessity, statutory obligation, and legitimate business interest for the following purposes:

• Conducting business workflow analysis, proposing system architecture, and providing tailored project estimates upon request;
• Executing commercial contracts and issuing statutory tax/VAT invoices;
• Provisioning cloud server resources, managing deployment environments, and activating software warranty coverage;
• Sending technical notifications, scheduled maintenance alerts, service renewal reminders, and handling support tickets;
• Fulfilling mandatory statutory, accounting, and tax obligations under Swiss and international commercial law.

Sudo strictly guarantees that we never sell, rent, trade, or share Client personal data with any third party for commercial marketing or advertising purposes.

Article 3: Service data hosted on Sudo cloud infrastructure and software

This Article applies specifically to Clients utilizing Sudo’s Cloud Server, VPS, Managed Kubernetes, DevOps maintenance, or enterprise management platforms (HRM, CRM, POS, Booking, Digital Warranty) hosted on infrastructure managed by Sudo:

3.1. Absolute data ownership by the Client

All business databases, employee records, end-customer records, and digital documents stored by the Client on the server ("Service Data") remain the exclusive and inviolable property of the Client. Sudo claims no intellectual property rights or commercial usage rights over any Service Data.

3.2. Client’s responsibilities regarding end-user data

As the Data Controller for its own customers and employees, the Client bears primary legal responsibility for:

• Ensuring lawful consent or valid legal basis (under the Swiss FADP, EU GDPR, or applicable local privacy laws) has been obtained from end-users prior to collecting, storing, or processing their data within the software/server;
• Assuming full legal accountability before regulatory authorities for the lawfulness and accuracy of stored data content;
• Indemnifying and holding Sudo harmless against any third-party claims, disputes, or regulatory penalties arising from the Client’s unlawful data collection or infringement of third-party privacy rights.

3.3. Strictly restricted access by Sudo engineers

Sudo’s systems engineers are only permitted to access the Client’s hosting infrastructure under the following limited circumstances:

• When the Client explicitly submits a technical support ticket or emergency assistance request through official channels;
• To perform emergency incident response (system outage, DDoS mitigation, resource bottleneck resolution) in accordance with our agreed SLA commitments;
• To conduct scheduled hardware or operating system maintenance with prior notice (without viewing, exporting, or copying database contents);
• To comply with a binding written order from a competent Swiss or European judicial authority as required by law.

3.4. Automated backup policy

• Sudo implements automated daily/weekly backup mechanisms according to the specifications of each infrastructure service tier. Backups are encrypted and stored in isolated off-site European storage.
• To ensure maximum resilience for critical digital assets, the Client remains responsible for maintaining periodic independent backups of core business data to their internal storage systems.

3.5. Data retention, export, and permanent deletion upon contract termination

• Upon service expiration or contract termination, Sudo provides written or email notification at least 15 days in advance.
• The Client is granted a 15-day grace period from the termination date to export and download all databases and source code to their own infrastructure.
• Following this period, Sudo will permanently purge and overwrite all Client Service Data from our production and backup storage systems within the subsequent 15 days. Once purged, data cannot be recovered. Upon request, Sudo will issue a formal Certificate of Data Destruction to the Client.

Article 4: Credential security and source code handover

4.1. During project development

All server credentials, API keys, or staging datasets provided by the Client for development and QA testing are restricted strictly to the assigned engineering squad and protected under a binding Non-Disclosure Agreement (NDA).

4.2. Upon final acceptance and 100% source code handover

• Sudo delivers 100% of the clean source code, technical architecture documentation, and highest-level administrative credentials (Super Admin / Root).
• Sudo does not retain copies of Client administrative passwords after final acceptance. The Client is responsible for rotating all administrative passwords, SSH keys, SSL certificates, and API keys immediately upon handover.
• For subsequent maintenance or feature upgrades, the Client shall grant temporary, role-based access to Sudo engineers and revoke such access immediately upon task completion.

4.3. Employee offboarding security protocol

Sudo enforces a strict personnel security policy: within 24 hours of an engineer’s offboarding decision, all internal SSO accounts, VPN certificates, staging server keys, and client project permissions are permanently revoked.

Article 5: Data retention periods and European data residency

5.1. Administrative data retention schedule

5.2. Data residency and cross-border transfer safeguards

To guarantee low latency, high availability, and strict European data sovereignty, Sudo deploys Client cloud infrastructure across certified Tier 3+ / ISO 27001 European data centers (including facilities in Switzerland, Germany (Frankfurt), the Netherlands (Amsterdam), France (Paris), the United Kingdom (London), Italy (Milan), and Sweden (Stockholm)) or global hubs as explicitly selected by the Client. Where remote engineering or maintenance support involves our R&D centers outside Switzerland/EEA, all operations are governed by the European Commission’s Standard Contractual Clauses (SCCs — Implementing Decision (EU) 2021/914) and the Swiss FADP adequacy safeguards.

Article 6: Rights of data subjects

Pursuant to the Swiss FADP (Articles 25–32) and Chapter III of the EU GDPR (Articles 15–22), Clients and Data Subjects hold the following statutory rights regarding their personal data:

• Right to be informed: To receive clear, transparent information regarding how and why personal data is collected and processed;
• Right of consent & withdrawal: To grant or withdraw consent for data processing at any time (without affecting the lawfulness of processing prior to withdrawal);
• Right of access & data portability: To view, verify, and request a structured, machine-readable copy of your personal data;
• Right to rectification: To request immediate correction of inaccurate or incomplete personal data;
• Right to erasure ("Right to be forgotten"): To request permanent deletion of personal data when it is no longer necessary for the purposes collected;
• Right to restrict or object to processing: To restrict data processing or object to processing for direct communications;
• Right to lodge a complaint: To file a complaint directly with Sudo’s Data Protection Team or with the competent Swiss or European Data Protection Supervisory Authority.

Clients may exercise these rights directly via our support portal at support.sudo.vn or by emailing info@sudo.vn. Sudo commits to acknowledging and processing all valid requests within 72 business hours.

Article 7: Technical and organizational security measures (TOMs)

Sudo implements multi-layered, enterprise-grade Technical and Organizational Measures (TOMs) in accordance with Article 8 of the Swiss FADP and Article 32 of the EU GDPR:

• Encryption standards: End-to-end encryption in transit via HTTPS/TLS 1.3; account credentials hashed using industry-standard cryptographic algorithms (Argon2 / bcrypt); sensitive databases encrypted at rest using AES-256.
• Role-Based Access Control (RBAC): Strict enforcement of the "Principle of Least Privilege." Engineers and staff are granted access strictly within the scope required for their assigned duties.
• Network & infrastructure defense: Multi-layer firewalls (WAF), automated DDoS mitigation, and mandatory Multi-Factor Authentication (2FA/MFA) for all system administrators.
• Continuous security auditing: Quarterly automated vulnerability scanning and mandatory Penetration Testing (Pentest) prior to major software releases.

Article 8: Data breach response and notification procedure

In the event of a detected cybersecurity incident or unauthorized data breach, Sudo immediately activates our Emergency Incident Response Protocol:

1. Containment & isolation: Isolate affected nodes, block malicious traffic vectors, and secure data integrity within 60 minutes of detection.
2. Client notification (72-Hour SLA): Notify affected Clients in writing/email within 72 hours (in alignment with GDPR Article 33 and Swiss FADP Article 24), detailing the nature of the incident, affected data categories, mitigation actions taken, and our technical point of contact.
3. Regulatory reporting: Submit formal incident reports to the competent supervisory authorities as required by law — specifically the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB) and/or the relevant EU Data Protection Authorities (DPAs).
4. Remediation & Post-Incident Report: Restore systems from verified clean backups and provide a comprehensive Root Cause Analysis (Post-Incident Report) to the Client.

Article 9: Limitation of liability and disclaimers

To ensure fair and transparent risk allocation in enterprise technology operations, Sudo establishes the following liability boundaries:

9.1. Exclusions of liability

Sudo shall not be held liable for data loss, unauthorized disclosure, or service disruption resulting from:

• The Client’s negligent disclosure of Admin credentials, root passwords, or API keys, or compromise of the Client’s local devices by malware, trojans, or keyloggers;
• Unauthorized modifications to the source code architecture, or installation of unverified third-party plugins, themes, or libraries by the Client or third parties without Sudo’s security review;
• The Client’s failure or delay in applying critical security patches or infrastructure upgrades recommended by Sudo;
• Force Majeure events beyond reasonable control, including international submarine cable disruptions, Tier-1 upstream telecom outages, natural disasters, war, or abrupt statutory changes.

9.2. Cap on liability

• Under no circumstances shall Sudo be liable for indirect, incidental, or consequential damages, including loss of business opportunity, loss of revenue, loss of anticipated profits, reputational harm, or business interruption costs.
• Sudo’s total aggregate liability for direct damages (if any, as finally determined by a competent court to have been caused directly by Sudo’s willful misconduct or gross negligence) shall in all cases not exceed the total service fees actually paid by the Client to Sudo during the preceding three (03) months under the directly affected service agreement.

Article 10: Disclosure of data to third parties

Sudo discloses information strictly on a need-to-know basis under the following limited circumstances:

• Authorized sub-processors & infrastructure partners: Certified European data center providers (such as Akamai/Linode), licensed payment gateways, or enterprise messaging providers (WhatsApp Business API / Email gateways) bound by strict Data Processing Agreements (DPAs).
• Mandatory legal obligations: When required by a formal, binding written order from a competent Swiss or European court or regulatory authority in accordance with due legal process.
• Protection of legitimate rights & security: When strictly necessary to prevent fraud, mitigate cyberattacks against critical infrastructure, or protect the security of Sudo’s technology ecosystem.

Article 11: Cookies and analytics technologies

The sudo.vn website and Sudo’s web applications use cookies to:

• Maintain secure authenticated sessions for Clients within management portals;
• Remember language preferences and display configurations;
• Collect anonymized performance telemetry (with IP anonymization enabled) to optimize page load speeds and user experience.

Clients may manage, reject, or disable non-essential cookies at any time via our Cookie Consent Banner or their browser settings without restricting access to public informational content on our website.

Article 12: Amendments and policy updates

Sudo reserves the right to amend or update this Privacy Policy periodically to reflect technological advancements and evolving legal requirements. In the event of material changes affecting Client rights:

• Sudo will publish a public notice on our website and notify Clients via email at least 30 days prior to the effective date of the updated policy;
• If a Client objects to the material changes, the Client has the right to terminate the affected service prior to the effective date without incurring early termination penalties.

Article 13: Data controller & corporate contact information

1. Swiss & European Legal Entity (Data Controller & Representative in Switzerland):

• Registered Company Name: Phung Beauty & Tech GmbH
• Swiss Business Identification Number (UID): CHE-474.361.935
• Commercial Register Number (Handelsregister Kanton Aargau): CH-400.4.454.727-4
• Registered Office (Switzerland): Dorfstrasse 14, 8956 Killwangen, Aargau, Switzerland
• Switzerland & WhatsApp Direct Line: +41 77 530 43 73

2. Global Headquarters & Software R&D Center:

• Registered Company Name: Sudo Software & E-Commerce Co., Ltd.
• Company Registration & Tax ID: 0107082414 | D-U-N-S® Number: 55-678-2017
• Executive Office: 3rd Floor - Dolphin Plaza (Tower 3-4), 6 Nguyen Hoang St., Tu Liem, Hanoi, Vietnam
• Registered Headquarters: 19 Co Van, Dong Anh, Hanoi, Vietnam
• Vinh R&D Center: 14th Floor (Nghe An Petro Tower), 7 Quang Trung St., Nghe An, Vietnam
• Global & Technical Hotline: +84 989 022 022
• Legal & Data Protection Email: info@sudo.vn

Article 14: Data protection inquiries & supervisory authorities

For any questions, requests to exercise Data Subject rights, or reports regarding information security, please contact our Data Protection Team:

• Centralized Support Portal: www.support.sudo.vn
• Data Protection & Security Email: info@sudo.vn
• Official Response SLA: Within 72 business hours of receiving a verified request.

If a privacy concern or dispute cannot be resolved through direct negotiation, Clients in Switzerland and Europe have the statutory right to contact the competent Data Protection Supervisory Authority:

• In Switzerland: Office of the Federal Data Protection and Information Commissioner (FDPIC / EDÖB) — Feldeggweg 1, CH-3003 Bern, Switzerland (www.edoeb.admin.ch);
• In the European Union (EU/EEA): The competent national Data Protection Authority (DPA) in your EU Member State (List of EDPB Member Authorities).

This Privacy Policy is officially effective as of October 24, 2026, and supersedes all previous versions.