KiNG Studio
Contact

Legal

Privacy

1. Who is responsible for your data

I am responsible for processing personal data on this website. My contact details:

Nguyễn Bá Duy Khánh, self-employed freelancer based in Vietnam.

12b Ngõ Hòa Bình 1
Phường Bạch Mai
Hà Nội, Vietnam

Email address: info@kngstudio.net

Phone: +84 868 317 088

For my own business, I decide why and how personal data is processed. Where needed, I process this data myself.

2. When this policy applies

This policy explains how I process personal data when you visit this website, contact me or inquire about working together.

I am based in Vietnam.

Data processing is subject to the applicable Vietnamese data protection rules. These include Law No. 91/2025/QH15 on personal data protection (Luật Bảo vệ dữ liệu cá nhân).

My services are also specifically offered to people in Germany and other EU countries. When I process data about people in the EU in connection with this offer, the General Data Protection Regulation (GDPR) also applies, in particular Article 3(2).

3. Principles of data processing

I process personal data where it is needed for a clear and lawful purpose. In particular, I follow these principles:

I only process data for a different purpose that is incompatible with the original purpose if there is an appropriate legal basis.

4. Website visits and technical data

When you visit the website, the hosting provider processes technical data to deliver and protect it. This may include:

This data helps deliver the website, investigate errors and prevent abuse or attacks.

Where the GDPR applies, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is to operate the website safely and reliably.

I use Cloudflare Workers for hosting. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare delivers the website through its worldwide network. Technical visitor data may also be processed outside the EU and Vietnam. The Self-Serve agreement incorporates the Data Processing Addendum (DPA) where Cloudflare processes data on my behalf. My own data processing in Vietnam may require additional measures. Cloudflare Web Analytics and application Workers logs are disabled.

5. When you contact me

When you email or call me, I process the information you share with me. This may include:

I use this information to answer your inquiry, communicate with you and, where appropriate, prepare a proposal or contract.

For an initial inquiry, you decide what information to share. Without enough details about your request or a way to contact you, I may be unable to reply.

Where the GDPR applies, I rely on Article 6(1)(b) GDPR if processing is needed for a contract with you or for steps you request before entering into a contract. For inquiries from company contacts or other business correspondence, Article 6(1)(f) GDPR may apply. My legitimate interest is to handle this communication, provided your interests and rights do not override it.

If Vietnamese data protection law requires your consent for a particular processing activity, I obtain it for that activity.

6. Email and phone links

You can contact me directly by email or phone; this website has no inquiry form. The contact links open the appropriate app on your device. Emails and phone calls use the relevant communication service. The data that service processes depends on the service and your settings.

I use your contact details and messages to handle your inquiry. I only use them for advertising or newsletters if there is a separate legal basis. Section 10 explains how Cloudflare Email Routing and Gmail process your emails.

7. Working together and client projects

If we work together, additional personal data may be needed. Depending on the project, this includes:

I use this data to prepare proposals, fulfill the contract, coordinate the project with you, invoice my services and document our work together.

Where the GDPR applies, the legal basis depends on the purpose and the person concerned. Article 6(1)(b) GDPR applies to necessary contract data if you are a party to the contract yourself. Article 6(1)(f) GDPR may apply to necessary communication with company contacts. My legitimate interest is to carry out and coordinate the project, provided the contacts' interests and rights do not override it.

8. Processing data for clients

In web design, web development, software development or automation projects, I may also process personal data on behalf of a client.

We establish the data protection roles separately for each client project. If I process data as a processor for a client subject to the GDPR, an agreement under Article 28 GDPR is required beforehand. I then follow the client's documented instructions. The necessary arrangements for sub-processors and data transfers to Vietnam must also be made.

This policy mainly describes the data processing for which I am responsible myself.

9. Data processing in Vietnam

Because I work in Vietnam, your data may be processed and stored there. Vietnam is outside the European Economic Area.

If a data transfer to a third country falls under Articles 44 et seq. GDPR, I assess the requirements for that transfer. Where needed, appropriate safeguards must be used, such as the European Commission's standard contractual clauses or other transfer grounds permitted by the GDPR.

A US provider's certification under the EU-US Data Privacy Framework does not cover data transfers to me in Vietnam. The safeguards needed for those transfers must be established separately from the hosting provider.

10. External service providers

I may use external technical providers for the website and my work, for example:

Providers receive the data they need for their respective tasks. If a data protection or processing agreement is required, it must be put in place.

I use Cloudflare for hosting, as described in section 4. Cloudflare Email Routing receives emails sent to info@kngstudio.net and forwards them to my regular Google Gmail account. Cloudflare and Google may process sender and recipient addresses, messages, attachments and technical metadata worldwide, including outside Vietnam and the EU.

Email Routing is also one of the Cloudflare services for which the Self-Serve agreement incorporates the DPA described in section 4. It applies where Cloudflare processes personal data on my behalf.

Cloudflare Data Processing Addendum

I currently reply from this Gmail account, so my replies come from a gmail.com address.

Google does not offer a data processing agreement for this regular Gmail account. Google states that it does not act as a data processor for this consumer service.

Google’s privacy notice

11. Cookies and browser storage

This website's code sets no cookies and stores no data in your browser's local storage or session storage. I do not use advertising, tracking or marketing cookies.

If I introduce technologies that require consent in the future, I only activate them after you have given your consent.

12. Analytics and tracking

I do not currently use Google Analytics, Meta Pixel, TikTok Pixel or similar tracking or advertising systems on this website. I do not create cross-site user profiles for advertising.

If this changes, I update this policy and obtain your consent beforehand where required.

13. Fonts

Fonts are loaded directly from this website. Your browser does not connect to Google Fonts or other font providers to load them.

14. No automated decision-making

I do not use data collected through this website for solely automated decisions that have legal or similarly significant effects on you. I do not assess prospective clients or clients through automated scoring or profiling.

15. Sharing data

Personal data is generally not sold. Data may be shared in the following circumstances:

Providers may only process the data to the extent necessary.

16. How long I keep data

Enquiries are not stored in the website. Your messages remain in the email account until the deletion criteria below are met. I do not use application Workers logs.

For emails sent to info@kngstudio.net, the Cloudflare Email Routing log shows me message and delivery details: sender and recipient names and addresses, the subject, the time received and the message ID. I also see the results of sender checks (SPF, DKIM, DMARC, ARC), the spam assessment, and the forwarding action and outcome. According to Cloudflare's documentation, event data can be queried for 31 days. Cloudflare does not state a contractual deletion period for these logs; availability does not guarantee that all data is deleted after 31 days.

I keep personal data only for as long as it is needed for the relevant purpose.

If your inquiry does not lead to working together, I generally delete the related data once I have finished handling it, unless there are practical or legal reasons to keep it longer.

I may keep data from ongoing or completed projects for longer if it is still needed for these purposes:

Once the purpose no longer applies and the required retention periods have expired, I delete the data or anonymize it where permitted.

17. Protecting your data

I protect personal data with appropriate technical and organizational measures. Depending on the processing activity, these may include:

I adapt the security measures to technical developments and the risks involved.

18. Your rights under the GDPR

If the GDPR applies to the processing of your data, you have the following rights in particular:

Objection: If I process data under Article 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving such grounds.

19. Rights under Vietnamese data protection law

You also have rights over your data under the applicable Vietnamese data protection law. Subject to the relevant legal conditions, these include in particular:

If you want to exercise any of these rights, you can contact me as described in section 20.

20. Contact about data protection

I have not appointed a representative in the European Union.

If you have questions about data protection or want to exercise your rights, email me or write to me by post. Both addresses are in section 1.

If there are reasonable doubts about whether a request is really from you, I may ask for additional information to verify your identity.

21. Children and young people

My services are intended for businesses, self-employed people and individuals. I do not specifically target children or young people. I do not knowingly collect children's data for advertising or profiling.

22. Changes to this policy

I update this policy when the website, the services I use, data processing or legal requirements change. You can always find the current version on this page.

As of October 2026