Cookie and Tracking Technology Policy
LEGAL BASIS
- Law on Personal Data Protection 2025 (Law No. 91/2025/QH15, effective 01/01/2026);
- Decree 356/2025/NĐ-CP — on consent and the processing of personal and device data;
- The Cybersecurity Law 2025 (Law No. 116/2025/QH15) — on the right to opt out of tracking and to refuse the collection of tracking data;
- Decree 147/2024/NĐ-CP; Decree 13/2023/NĐ-CP (applicable to the extent it does not conflict with Law No. 91/2025/QH15 of the National Assembly: the Personal Data Protection Law);
- GDPR (Article 6, Recital 32) and the ePrivacy Directive 2002/58/EC (as amended in 2009) — applied by reference to data subjects within their scope;
- Decision No. 4567/QD-VBPL dated 01/06/2026 issuing the company's Legal Compliance Framework.
This policy forms part of, and is read together with, Personal Data Protection Policy (PDPD) — giving effect to Article 16 of the PDPD — and Terms of Service.
PART I – INTRODUCTION
Article 1. What are cookies and tracking technologies?
1.1. Cookies are small text files sent from a web server to the user's browser and stored on the device (computer, phone, or tablet). Cookies are sent back to the server on subsequent visits to maintain session state, remember preferences, and analyze behavior.
1.2. Beyond conventional cookies, HiTechCloud uses similar tracking technologies: (a) web beacons / tracking pixels (1×1 pixel images in emails or web pages); (b) Local Storage / Session Storage; (c) IndexedDB (client-side database); (d) device fingerprinting (identifying a device by screen resolution, fonts, time zone and so on); and (e) UTM parameters (URL parameters that track traffic source).
1.3. To the extent that the technologies described above process data that identifies or could identify an individual, that data is treated as personal data and protected under the Personal Data Protection Law 2025 (Luật Bảo vệ dữ liệu cá nhân 2025) and HiTechCloud's PDPD.
Article 2. Classifying cookies by necessity
Group 1 – Strictly necessary cookies — these CANNOT be declined:
Legal basis: necessary in order to provide the service the user has requested, and for the legitimate interest of operating and securing the system, under the Personal Data Protection Law 2025 (Luật Bảo vệ dữ liệu cá nhân 2025). These cookies cannot be switched off because the website will not function without them.
| Cookie name | Purpose | Term | Origin |
|---|---|---|---|
| PHPSESSID | Keep the login session active | Session (deleted when tab is closed) | HiTechCloud |
| XSRF-TOKEN | Protection against CSRF attacks | Session | HiTechCloud |
| remember_token | Stay logged in (Remember Me) | 30 days | HiTechCloud |
| cookie_consent | Save the user's cookie preferences | 12 months | HiTechCloud |
| __cfduid | Cloudflare security cookie | 30 days | Cloudflare CDN |
| cart_session | Cart (if any) | 7 days | HiTechCloud |
Group 2 – Analytics cookies — May be declined:
Legal basis: user consent. Used to understand how visitors use the website and to improve the experience.
| Cookie name | Purpose | Term | Origin |
|---|---|---|---|
| _ga, ga* | Google Analytics – tracks page views and sessions | 2 years | Google LLC |
| _gid | Google Analytics – distinguishes users | 24 hours | Google LLC |
| gat_gtag* | Google Analytics – throttle rate | 1 minute | Google LLC |
| _hjid | Hotjar – session recording, heatmap | 1 year | Hotjar Ltd |
| _hjTLDTest | Hotjar – TLD check | Session | Hotjar Ltd |
| ajs_user_id | Analytics.js – anonymized user ID | 1 year | HiTechCloud/Segment |
Group 3 – Functional cookies — May be declined:
Legal basis: user consent. Improves the experience by remembering preferences.
| Cookie name | Purpose | Term | Origin |
|---|---|---|---|
| lang | Preferred language (VI/EN) | 1 year | HiTechCloud |
| timezone | Preferred time zone | 1 year | HiTechCloud |
| theme | Dark/light mode | 1 year | HiTechCloud |
| sidebar_state | Status bar on the dashboard | Session | HiTechCloud |
| intercom-id-* | Identifies users in Intercom live chat | 9 months | Intercom Inc. |
Group 4 – Marketing cookies — require active consent (opt-in):
Legal basis: active, explicit consent. Used to display relevant advertising and measure campaign performance. These cookies activated only after the user actively consents.
| Cookie name | Purpose | Term | Origin |
|---|---|---|---|
| _fbp | Facebook Pixel – remarketing | 3 months | Meta Platforms |
| fr | Facebook – advertising and measurement | 3 months | Meta Platforms |
| _gcl_au | Google Ads – conversion tracking | 90 days | Google LLC |
| IDE | Google DoubleClick – display advertising | 13 months | Google LLC |
| MUID | Microsoft/Bing Ads tracking | 13 months | Microsoft Corp. |
PART II - COOKIE CONSENT, MANAGEMENT, AND CONTROL
Article 3. Consent and the “do not track” mechanism
3.1. For non-essential cookies (analytics, functional and marketing cookies), HiTechCloud collects and processes them only after the user has given consent. Technically necessary cookies are enabled by default so that the website can operate.
3.2. In accordance with the Cybersecurity Law 2025 (Luật An ninh mạng 2025) and Article 16 of the PDPD, HiTechCloud gives users the option to opt out of the collection and sharing of tracking data files, as well as a “do-not-track” option. When a user enables the “do-not-track” signal in their browser, HiTechCloud honors that choice for non-essential cookies.
3.3. Users have the right to withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Marketing cookies are off by default until affirmative consent is given.
Article 4. How to manage cookies
4.1. Users can manage cookies through:
(a) Banner cookie: on a first visit, the banner presents the options “Accept all”, “Reject non-essential” and “Customize”. The buttons are designed to be balanced and not misleading. The choice is stored for 12 months.
(b) Cookie settings page: visit hitechcloud.vn/cookie-settings to review and change your choices at any time.
(c) Browser settings: Chrome (Settings → Privacy and Security → Cookies); Firefox (Settings → Privacy & Security → Cookies and Site Data); Safari (Preferences → Privacy → Block all cookies); Edge (Settings → Cookies and site permissions).
(d) Opt out directly per service: Google Analytics (tools.google.com/dlpage/gaoptout); Facebook Pixel (facebook.com/settings?tab=ads); Google Ads (adssettings.google.com).
4.2. Note: disabling cookies may affect some website functions, particularly login, the shopping cart, and interface preferences.
PART III - DATA SHARING, CROSS-BORDER TRANSFER, AND CONTACT
Article 5. Data sharing through cookies and cross-border transfer
5.1. Some analytics and marketing cookies are provided by third parties (Google, Meta, Microsoft, Hotjar, Intercom, Cloudflare) and may result in data being processed and stored outside the territory of Vietnam. This cross-border data transfer and processing complies with the Personal Data Protection Law 2025 (Luật Bảo vệ dữ liệu cá nhân 2025), the Data Law 2024 (Luật Dữ liệu 2024), and Article 12 of HiTechCloud's PDPD.
5.2. HiTechCloud does not sell personal data collected through cookies. Sharing with a third party for marketing purposes takes place only with the user's affirmative consent.
Article 6. Contact
6.1. For any question or request concerning cookies and personal data, users may contact the data protection officer (DPO): email legal@photuesoftware.com; or submit a request to exercise your rights under Article 8 of the PDPD; complain under Article 18 of the PDPD.
Article 7. Updates to the Cookie Policy
7.1. The Cookie Policy is updated when: cookies or tracking technologies are added or removed; the analytics provider changes; or new legal requirements arise.
7.2. When a material update occurs (such as adding marketing cookies or changing the purpose of use), HiTechCloud will re-display the cookie banner to re-collect consent and/or post a notice on the website before applying the change. The cookie inventory table in Article 2 is reviewed periodically to keep it accurate.
This policy takes effect from 01/07/2026 and supersedes all previous versions. The Vietnamese version prevails as the legally binding text.
