Legal
Privacy, in plain language.
Written to meet the EU GDPR, UK GDPR, US state privacy laws and Vietnam's personal data protection rules in one notice. Where those regimes differ, the stricter requirement is applied to everyone. Version 2026-11-06.
Who is responsible
Samlution is the controller for the personal data described here. For anything in this notice, write to [email protected].
We are a small firm and answer these requests ourselves, usually within a few days.
What we collect
Only what the forms ask for, plus standard server logs. There are no advertising trackers and no third-party analytics.
We do not ask for special-category data such as health, ethnicity, religion, political views or biometrics through the website forms.
What the form collects
- Contact and checklist forms
- Name, work email, and anything you choose to add: firm, role, area of interest, budget range, message, and your AI Readiness Checklist result.
- Server logs
- IP address, browser user agent, requested URL and timestamp, recorded by our hosting provider for security and reliability.
- After an engagement starts
- Project correspondence and documents. Those are governed by the data processing terms in the engagement agreement, not by this notice.
Why we hold it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Replying to your inquiry | Name, email, firm, message | Steps taken at your request before a contract (GDPR Art. 6(1)(b)) |
| Preparing a relevant call or proposal | Role, interest, budget range, checklist result | Legitimate interest in answering usefully (GDPR Art. 6(1)(f)) |
| Sending the checklist result you asked for | Name, email, checklist result | Consent (GDPR Art. 6(1)(a)), withdrawable at any time |
| Keeping the site secure | IP address, user agent, request metadata | Legitimate interest in security (GDPR Art. 6(1)(f)) |
Website inquiries are not used for marketing sequences. If we ever want to send you something you did not ask for, we ask first and you can decline without affecting the inquiry.
Your rights
These apply to everyone who contacts us. EU and UK law, US state privacy statutes including the CCPA/CPRA in California, and Vietnam's personal data protection law grant overlapping rights; we honour the broadest version.
Access and copies
Ask what we hold about you and receive a copy in a portable format.
Correction
Have inaccurate or incomplete details fixed.
Deletion
Ask us to erase your details where we no longer have a lawful reason to keep them.
Restriction and objection
Limit how we use your data, or object to processing based on legitimate interest.
Withdraw consent
Consent can be withdrawn at any time; processing before that stays lawful.
No sale, no automated decisions
We do not sell or share personal data for advertising, and no automated decision with legal effect is made about you.
Complain to a regulator
You can complain to your local supervisory authority - for example your EU or UK authority, or Vietnam's Ministry of Public Security.
How to exercise them
Email [email protected] with what you want changed. We reply within 30 days, and sooner where local law requires it. We may ask one question to confirm the request comes from you, but we will not ask for more identity documents than necessary.
If we cannot fulfil a request, we explain why and tell you which authority you can complain to. Making a request and complaining are both free.
Who processes it
The website runs on a hosting provider that stores server logs. Inquiries are recorded in our CRM, which we self-host on our own infrastructure.
Email and calendar providers process messages you send us. AI model providers are used only inside client engagements, under separate terms, and never for website form data.
Each provider is bound by a data processing agreement or equivalent terms, and access is limited to people who need it.
International transfers
Samlution is based in Vietnam. If you contact us from the EU, the UK or elsewhere, your details are transferred to and stored in Vietnam.
For EU and UK visitors, transfers rely on the European Commission's Standard Contractual Clauses and the UK Addendum, supported by a transfer risk assessment covering the data, the storage location and the safeguards applied.
Where Vietnamese rules on cross-border transfer apply, the required impact documentation is maintained.
How long we keep it
Inquiry records: up to 24 months after the last contact, then deleted.
If you become a client, project records follow the retention schedule in the engagement agreement.
Server logs are kept by the hosting provider for a short operational window, typically 30 days or less.
Security
Traffic is served over HTTPS. Form submissions are validated on the server, rate limited, and forwarded only to systems we control.
CRM access requires individual accounts and least-privilege permissions. Backups are encrypted at rest.
If a breach affects your data, we notify the relevant authority within 72 hours of becoming aware where the law requires it, and tell you directly if the risk to you is high.
Children
This site is aimed at businesses. It is not directed at children and we do not knowingly collect their data.
Automated decision-making
The AI Readiness Checklist scores seven answers to suggest a starting point. It is a recommendation shown to you, not a decision made about you, and no legal or similarly significant effect follows from it.
Changes
This notice is version 2026-11-06. If we change how we handle personal data, we update this page and its version, and the version you consented to is recorded with your submission.
Contact
Data requests and questions about this notice: [email protected]. General inquiries: [email protected]. See also our terms.