Privacy Policy

1. Who we are

OpenLiti ("OpenLiti", "we", "us") operates the website openliti.com and provides press release distribution and media placement services in Vietnam to businesses, agencies and organisations. For the purposes of the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), OpenLiti acts as the data controller for the personal data described in this policy.

You can reach our privacy contact at contact@openliti.com. We answer data protection requests within 30 days, or within 45 days where CCPA/CPRA timelines apply.

2. Data we collect

We only collect what is necessary to quote, deliver and account for a media placement:

• Contact data you submit voluntarily: name, company, job title, business email, phone or messaging handle, country.
• Project data: press release drafts, images, brand assets, target outlets, publication dates and approval records.
• Billing data: company name, tax identification number, billing address, invoices and payment status. Card data is never stored by OpenLiti; invoicing and payments are handled by our banking and payment providers.
• Technical data: IP address, browser and device type, referring page, pages visited and timestamps, collected through server logs and — where you consent — analytics cookies.
• Communication records: emails, chat transcripts and call notes related to your project.

3. Legal bases and purposes

Under Article 6 GDPR we rely on: performance of a contract (delivering the placement you ordered), legitimate interests (responding to enquiries, preventing abuse and improving our service), consent (analytics and advertising cookies, and marketing emails where consent is required) and legal obligation (tax, accounting and record-keeping duties).

We use your data to prepare quotations, translate and submit your release, issue invoices, provide acceptance reports, answer support requests, prevent fraud, and comply with Vietnamese and international law.

4. Sharing and international transfers

We do not sell personal data. We share it only with parties required to deliver the service:

• Newsrooms and publishers, limited to the content needed for editorial review and publication. Journalists see the article and the contact person you authorise, not your billing data.
• Service providers under contract: hosting, email delivery, analytics and accounting providers. They act as processors on documented instructions.
• Professional advisers, auditors and authorities where legally required, or to establish, exercise or defend legal claims.

5. Retention

Project files and published links are retained for the duration of our business relationship and for three years afterwards so that we can respond to republication or verification requests. Accounting records are kept for the period required by tax law. Analytics data is retained for a maximum of 14 months in an identifiable form.

6. Your rights

Subject to applicable law, you may request:

• Access to your personal data and a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten"), where no legal retention duty applies.
• Restriction of, or objection to, processing based on legitimate interests.
• Data portability in a structured, machine-readable format.
• Withdrawal of consent at any time, without affecting prior lawful processing.
• Under the CCPA/CPRA: the right to know, delete, correct, opt out of "sale" or "sharing" (we do neither), and to be free from discrimination for exercising these rights.

7. Security

We apply technical and organisational measures proportionate to the risk: encrypted transport (HTTPS/HSTS), least-privilege access to project folders, two-factor authentication on administrative accounts, restricted server access, and documented retention and deletion routines. If a personal data breach affects your rights, we notify you and the competent authority without undue delay and, where required, within 72 hours of becoming aware.

8. Children and changes

Our services are directed to businesses. We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact us and we will delete it.

We may update this policy to reflect legal or operational changes. The version published on this page, with its "last updated" date, is the applicable version.