Data Deletion Instructions

1. First, work out which case applies to you

How to send the request depends on who you are in the system.

2. How to send the request

Email privacy@landsys.site with the subject "Personal data deletion request" and state:

• Your name.
• The phone number or email address you provided — this is what locates your data in the system.
• The name of the business you contacted, or the Page or Official Account you messaged, if you remember it.
• Whether you want everything deleted or only part of it (for example, conversation history only, keeping a signed contract).

3. Why verification is needed

We verify that you are the data subject before deleting. This is not an obstacle for its own sake: deleting on an unverified request would mean anyone who knows your phone number can erase your data — or erase the customer records of a competing business.

Verification is usually just a confirmation through the same phone number or mailbox you used.

4. Timelines

• Within 72 hours — you receive an acknowledgement that the request was received.
• Within 30 days — deletion is completed and you receive confirmation.
• Backups are rotated and overwritten within a further 30 days.

5. What gets deleted, and what has to be kept

Deleted: contact details, conversation content, notes, follow-up history, call recordings, and the custom fields that relate to you.

May have to be kept, and if so you are told the specific reason:

• Accounting records and invoices, for the period required by accounting law.
• Data that is the subject of a dispute or of a lawful request from a state authority.
• Anonymised audit log entries — no longer identifying you, but kept to demonstrate that the system operated correctly.

6. If you connected through Facebook

When an organisation no longer wants LandSys to access its Facebook Page, two separate things are involved:

• Disconnecting — go to Settings, Connected channels in LandSys and delete the channel, or open Page Settings on Facebook and remove the app permission. This stops the flow of new data immediately and deletes the stored access token.
• Deleting data already collected — a separate request, sent as described in section 2. Disconnecting does not automatically erase the leads a business already collected, because that data belongs to the business and not to the Facebook account whose permission was removed.

7. If you are not satisfied with the outcome

You have the right to complain, to denounce or to sue under Decree 13/2023/ND-CP, whether or not you sent us a request first. The competent authority is the Department of Cyber Security and High-Tech Crime Prevention (A05), Ministry of Public Security of Vietnam.