Personal Data Protection Policy

 

PERSONAL DATA PROTECTION POLICY

(Issued under Decision No. 75/QD-LV/2023 by Lac Viet Informatics Joint Stock Company on June 30, 2023)

ARTICLE 1. DEFINITIONS

1.1. "The Company" or "Lac Viet" refers to Lac Viet Informatics Joint Stock Company, including all branches of the company.

1.2. "Personal data" is information in the form of symbols, writing, numbers, images, sounds, or similar forms in electronic environments associated with a specific individual or helping identify a specific individual. Personal data includes basic personal data and sensitive personal data.

1.3. "Personal Data Protection" is the activity of preventing, detecting, preventing, and processing violations related to personal data as required by law.

1.4. "Customers" include all individual or organizational customers using products, goods, and services provided by Lac Viet and/or other individuals or organizations related to or arising from relationships providing products, goods, and services to Lac Viet.

1.5. "Products, Goods, and Services" are any products, goods, or services provided by Lac Viet and/or by Lac Viet in collaboration with partners that customers search for, access, purchase, register for use, or use.

1.6. "Third Party" refers to individuals and/or organizations not belonging to Lac Viet and having legal obligations to Lac Viet through contracts, agreements, or other commitments.

1.7. "Processing Personal Data" is one or more activities affecting personal data, such as collecting, recording, analyzing, confirming, storing, editing, publishing, combining, accessing, retrieving, recovering, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, erasing personal data, or other related actions.

1.8. "Personal Data Control" means determining the purpose and means of processing personal data.

1.9. "Lac Viet's Transaction Channels" include hotline channels, electronic transaction channels (applications, electronic information pages such as https://lacviet.vn/, social networks), and physical transaction channels (branches, etc.) of Lac Viet or other transaction channels as determined by Lac Viet provided or authorized by Lac Viet.

ARTICLE 2. TYPES OF PERSONAL DATA COLLECTED AND PROCESSED

The types of personal data that may be collected and processed are the following and may vary depending on the circumstances and the relationship between the Customer and Lac Viet:

2.1. Basic personal data includes:

1. Last name, middle name, and first name (if any);
2. Date of birth:
3. Gender;
4. Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address;
5. Nationality;
6. Personal image;
7. Phone number, identity card number, personal identification number, passport number, driver's license number, vehicle registration number, personal tax identification number, social security number, health insurance card number;
8. Marital status;
9. Information about family relationships (parents, children);
10. Information about individual bank accounts; personal data reflecting activities; history of activities on the internet;
11. Other information related to a specific individual or helping to identify a specific individual is not covered in Section 1.3.

2.2 Sensitive personal data is personal data linked to an individual's privacy rights that, when infringed upon, directly affects the individual's legal rights and interests, including:

1. Political opinions, religious beliefs;
2. Health status and private information recorded in medical records, excluding blood type information;
3. Information related to racial or ethnic origin;
4. Information about the inherited or acquired genetic characteristics of the individual;
5. Information about physical attributes, individual biological characteristics;
6. Information about sexual life and the sexual orientation of the individual;
7. Data on criminal offenses, criminal behaviors collected, stored by law enforcement agencies;
8. Customer information of credit institutions, foreign bank branches, intermediary payment service providers, other authorized organizations, including: customer identification information as prescribed by law, account information, deposit information, asset deposit information, transaction information, organization, individual as a guarantor at credit institutions, bank branches, and intermediary payment service providers;
9. Data about the individual's location determined through location-based services;
10. Other personal data is specified by law as special and requires necessary security measures.

2.3. The data that customers provide to Lac Viet when registering for use and all data generated during the customer's use of Lac Viet's products, goods, and services, including but not limited to: exchanges between Lac Viet and customers; Call information, messages, and call recordings generated during the customer's use of Lac Viet's telephone, messaging, and call center services; Data uploaded, stored, and generated on the software systems provided by Lac Viet; Personal images, including images provided during registration and the use of Lac Viet's products, goods, and services.

ARTICLE 3. PURPOSES OF PROCESSING PERSONAL DATA

3.1. Customer support, updating customer information when purchasing, and using products, goods, and services provided by Lac Viet or Lac Viet's partners according to contracts and legal regulations.

3.2. Providing Lac Viet's products, goods, and services, as well as products, goods, and services in collaboration with partners for customers.

3.3. Fulfilling the rights and obligations under the contract of the Customer and Lac Viet during the customer's use of products, goods, and services provided by Lac Viet or Lac Viet's partners.

3.4. Providing customer data to the customer themselves or third parties at the Customer's request, as agreed between the Customer and Lac Viet, as required by competent state authorities or other cases as prescribed by law and within the scope of the law.

3.5. Organizing introductions and commercial promotions, market research, public opinion surveys, brokerage.

3.6. Researching, developing new services, and providing suitable products, goods, and services for customers.

3.7. Marketing services, product advertising.

3.8. Measuring, analyzing internal data, evaluating, and other processing to improve and enhance the quality of services provided by Lac Viet to customers.

3.9. Investigating and resolving Customer inquiries and complaints.

3.10. Adjusting, updating, securing, and improving the products, goods, and services that Lac Viet is providing.

3.11. Verifying the identity and ensuring the security of customer information.

3.12. Notifying customers of changes to policies, promotions of products, and services provided by Lac Viet.

3.13. In relation to the exercise of Lac Viet's rights and obligations when working with legal advisors, financial advisors, or complying with contracts between Lac Viet and other third parties.

3.14. Preventing and combating fraud, identity theft, and other illegal activities.

3.15. Complying with all legal normative documents, laws, regulations, rules, directives, orders, instructions, and/or current requirements from any competent local or foreign authorities, including but not limited to government, tax, and law enforcement agencies or other competent authorities.

3.16. Performing other activities related to the business, operation, management, and activities of Lac Viet.

ARTICLE 4. RIGHTS AND OBLIGATIONS OF LAC VIET

4.1. Rights of Lac Viet

1. Process the personal data of Customers according to the agreed purposes, scope, and other contents that have been consented to by the Customer and/or agreed upon.
2. Lac Viet will only fulfill Customer requests within a reasonable period of time as required by law when such requests are lawful, complete, and valid, and the Customer pays any applicable processing fees (if any).
3. Lac Viet reserves the right to reject unlawful requests from Customers.
4. Have the right to decide on the means and methods of processing data appropriate to the processing purposes.
5. Have the right to decide on the application of appropriate measures to protect the personal data of Customers.
6. Modify, update, or adjust the contents of this policy as necessary.
7. Other rights are specified in this policy and in accordance with legal regulations.

4.2. Obligations of Lac Viet:

1. Shall not process personal data for purposes other than those stated in this Policy and in compliance with legal regulations.
2. Implement appropriate information security measures to prevent unauthorized access, alteration, use, or disclosure of Customers' personal data.
3. Ensure mechanisms allowing Customers to exercise their rights related to their personal data.
4. Be responsible to Customers for damages resulting from Lac Viet's failure to comply with legal regulations on data processing or failure to adhere to the scope and purposes agreed upon with Customers.
5. Coordinate with the Ministry of Public Security and other competent state authorities in protecting personal data, providing information to serve investigations, and prosecuting violations of legal regulations on personal data protection.

ARTICLE 5. RIGHTS AND OBLIGATIONS OF CUSTOMERS

5.1. Rights of Customers:

1. To be informed about the processing of their personal data, except where otherwise provided by law.
2. To consent or refuse consent to the processing of their personal data, except where otherwise provided by law
3. To access, rectify, or request rectification of their personal data in writing to Lac Viet, except where otherwise provided by law.
4. To withdraw their consent in writing to Lac Viet, except where otherwise provided by law. The withdrawal of consent shall not affect the lawfulness of processing prior to such withdrawal based on the Customer's consent. If the Customer withdraws consent/permission for Lac Viet to process the personal data of the Data Subject, such withdrawal may: (i) affect the legal validity of contracts, legal relations between Lac Viet and the Customer; (ii) limit, restrict, suspend, or terminate Lac Viet's services to the Customer on a case-by-case basis. Lac Viet shall not be liable for any costs, damages, or losses incurred by the Customer and/or any related Third Party due to such an impact. In such cases, Lac Viet's legal rights shall remain fully reserved, and Lac Viet may continue to process the Customer's personal data within the required scope or according to prevailing laws.
5. To be erased or request erasure of their personal data in writing to Lac Viet, except where otherwise provided by law.
6. To request restriction of processing of their personal data in writing to Lac Viet, except where otherwise provided by law. The restriction of processing shall be carried out by Lac Viet upon receipt of a suitable request from the Customer, subject to technical conditions, except where otherwise provided by law or agreed upon by the parties.
   To request Lac Viet to provide them with their personal data in writing to Lac Viet, except where otherwise provided by law.
7. Lac Viet shall be requested to provide the Customer with their personal data in writing sent to Lac Viet, except where otherwise provided by law
8. To object to Lac Viet, organizations process their personal data for the purpose of preventing or limiting the disclosure or use of personal data for advertising or marketing purposes, except where otherwise provided by law. The objection shall only be effective when made in writing and sent to Lac Viet. Lac Viet, organizations processing personal data shall comply with the Customer's request within 72 hours of receiving the request, except where otherwise provided by law. If the Customer's objection affects the performance of contracts between Lac Viet and the Customer, Lac Viet's legal obligations, life, property, and rights and legitimate interests of other individuals, organizations, tasks of national security protection, social order, and safety, Lac Viet has the right to restrict, suspend, terminate, or cancel all or part of the contract for the provision of products, goods, and services between Lac Viet and the Customer.
9. To have the right to complain, denounce, or file lawsuits in accordance with legal regulations.
10. To have the right to claim compensation for actual damages as prescribed by law if Lac Viet violates provisions on protecting their personal data, except where otherwise agreed by the parties or provided by law.
11. To have the right to self-defense under the Civil Code, related laws, and Decree No. 13/2023/NĐ-CP, or to request competent authorities and organizations to implement civil rights protection measures as prescribed in Article 11 of the Civil Code 2015.

5.2. Obligations of Customers:

1. To protect their personal data; actively apply measures to safeguard their personal data when using Lac Viet’s products, goods, or services; promptly notify Lac Viet upon discovering any inaccuracies or suspicions regarding their personal data being compromised.
2. To provide complete, truthful, and accurate personal data, and other information as required by Lac Viet when entering into contracts or using products, goods, or services provided by Lac Viet In case of providing incorrect, incomplete, or inaccurate information, if risks or damages arise, the Customer shall be responsible for any errors or fraudulent acts when using the services due to their own fault or failure to provide correct, complete, and accurate information, including financial losses, expenses arising from the provision of incorrect or inconsistent information.
3. In case of changes or adjustments to personal data, the Customer is responsible for promptly contacting and notifying Lac Viet for timely updating of such changes or adjustments. The Customer shall be solely responsible for any delay in this notification; moreover, any delay in notification by the Customer shall exempt Lac Viet from any damages, risks arising for the Customer and related parties (if any).
4. If the Customer is an organization and provides personal data of related individuals or individuals under their management to Lac Viet, the Customer ensures obtaining consent from those individuals regarding the provision of their data.
5. To respect and protect the personal data of others.
6. To comply with legal regulations, provisions, and instructions of Lac Viet related to the processing of their personal data by Lac Viet.
7. To cooperate with Lac Viet, competent state authorities, or third parties in case of issues affecting the security of the Customer's personal data.
8. To regularly update the Regulations, Policies on personal data protection of Lac Viet in each period as notified to the other party or posted on Lac Viet's transaction channel. To take actions as instructed by Lac Viet to clearly indicate consent or refusal regarding the purposes of processing personal data as informed by Lac Viet in each period.
9. Other obligations according to this Policy and legal regulations.

ARTICLE 6. ORGANIZATIONS AUTHORIZED TO PROCESS PERSONAL DATA

6.1. Organizations authorized to process personal data include:

a. LAC VIET COMPUTING CORPORATION

• Address: 23 Nguyen Thi Huynh, ward 8, Phu Nhuan district, Ho Chi Minh city
• Tax code: 0301448733

b. THE HANOI CITY BRANCH

• Address: 8th Floor, Tower A, Sky City Building, 88 Lang Ha, Lang Ha Ward, Dong Da District, Hanoi City
• Tax code: 0301448733-001

c. THE DA NANG CITY BRANCH

• Address: 36 Ham Nghi, Thac Gian Ward, Thanh Khe District, Da Nang City
• Tax code: 0301448733-002

d. THE HUE CITY BRANCH

• Address: 6 Le Loi, Vinh Ninh Ward, Hue City, Thua Thien - Hue Province
• Tax code: 0301448733-003

6.2. In cases where other organizations are involved in personal data processing activities, the Customer agrees that Lạc Việt will notify the Customer through Lac Viet's transaction channels before proceeding with such processing.

ARTICLE 7. OTHER INDIVIDUALS, ORGANIZATIONS RELATED TO THE PROCESSING OF PERSONAL DATA

7.1. In order to enhance Customer experience and to enable Lac Viet to fulfill the purposes of using personal data as stated in this Privacy Policy, the Customer agrees that Lac Viet may share the Customer's personal data with the following organizations or individuals:

1. Suppliers of products, goods, and services to Lac Viet, including but not limited to marketing services, market research, training services, legal services, audit services, and transportation services;
2. Consulting companies, auditors, law firms, and lawyers of Lac Viet;
3. Employees and workers of Lac Viet;
4. Subsidiaries and affiliates of Lac Viet;
5. Any individuals, authorities, or third parties that Lac Viet is allowed or required to disclose to under the laws of any country, or under any contracts or commitments between the third party and Lac Viet;
6. Any individuals involved in enforcing or maintaining any rights or obligations under agreements between the Customer and Lac Viet;
7. Service providers to Lac Viet for whom sharing or disclosing data to them is necessary for Lac Viet to fulfill its rights and obligations to the Customer;
8. Third parties responsible for processing personal data according to their contract or agreement with Lac Viet, including research companies, survey agencies, and rating agencies;
9. State authorities with jurisdiction;
10. Parties agreed by the Customer or Lac Viet with legal grounds to share the Customer's personal data.

7.2. In addition to the cases mentioned above, Lac Viet will not disclose the Customer's personal data to any other party unless:

1. The Customer gives consent;
2. Lac Viet is required or permitted to disclose under the provisions of the law;
3. Lac Viet transfers rights and obligations according to agreements between the Customer and Lac Viet.

Article 8. METHODS OF COLLECTING, PROCESSING PERSONAL DATA

8.1. Lac Viet may collect the personal data of Customers from the following sources:

1. Lac Viet's electronic platforms, including Lac Viet's digital products, and third parties, including websites, interactions, or technologies for automatic data collection, product promotion programs, etc.
2. Through interactions between Lac Viet and Customers (in-person meetings, via mail, phone, online, call center systems, electronic communication, or any other means), including customer surveys.
3. Through Customers' searches, accesses, purchases, registrations, and usage of any products, goods, or services provided by Lac Viet.
4. From Lac Viet's social media and/or social media platforms, Lac Viet cooperates with partners.
5. From recording and video devices installed at stores, business locations, or places where customers encounter, appear, or interact with Lac Viet. The placement of these recording and video devices is intended to contribute to maintaining social order and safety, protecting the legitimate rights and interests of both customers and Lac Viet in accordance with legal regulations;
6. Through receiving personal data from other third parties, Lac Viet is assured of the relevant third party's commitment and confirmation of the Customer's consent regarding the provision of personal data to Lac Viet and the processing of data for Lac Viet's purposes according to this policy. If the Customer does not agree, please refrain from providing personal data to the third party.
7. Lac Viet may indirectly collect personal data from customers through legitimate public sources or by receiving necessary data sharing from subsidiary companies or partners, collected during their collaboration with Lac Viet in providing products, goods, and services to customers, and permitted by customers for sharing.
8. From state agencies and authorized agencies in Vietnam.
9. From other sources permitted by law.

8.2. Lac Viet applies one or more activities affecting personal data, such as collection, recording, analysis, confirmation, storage, editing, disclosure, combination, access, retrieval, erasure, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, or destruction of personal information, as well as other related actions. Lạc Việt has the right to determine the means and methods of data processing appropriate to the processing purpose.

ARTICLE 9. STARTING TIME, END TIME OF PROCESSING PERSONAL DATA

9.1. Data Processing Start Time:

1. As soon as it is collected into Lac Viet's system and/or Lac Viet's partners' and/or relevant third parties' systems related to Lac Viet's data processing activities.
2. Lac Viet has a legal basis to process the data according to legal regulations.

9.2. Data Processing End Time

1. Until the time when the Customer or Lac Viet completes all obligations for the other party related to the contract and the Customer requests deletion of Personal Data or withdraws consent.
2. Or other time as required by law.

9.3. Lac Viet may need to retain Customer's Personal Data even after the contract between the Customer and Lac Viet has terminated to fulfill Lac Viet's legal obligations according to legal regulations and/or the requirements of competent state authorities.

9.4. The Customer understands and agrees that for data processing activities aimed at preventing and handling fraudulent, deceptive, or illegal acts by the Customer, reporting to competent state authorities will be conducted in accordance with the legal regulations of each period and/or Lac Viet's internal regulations without being limited by the Personal Data Protection Policy in this Terms of Use.

ARTICLE 10. PROCESSING OF PERSONAL DATA IN CERTAIN SPECIAL CASES

10.1. Processing of personal data in cases where the consent of the Customer is not required:

1. In urgent cases, it is necessary to process personal data immediately to protect the life or health of the Customer or others.
2. Disclosure of personal data according to the provisions of the law.
3. Processing of data by state authorities with jurisdiction in cases of emergency concerning national defense, national security, social order and safety, major disasters, and dangerous epidemics; when there is a risk of threatening security or national defense but has not reached the level of emergency declaration; prevention, control of riots, terrorism, prevention, and suppression of crimes and law violations as prescribed by law.
4. To fulfill obligations under the contract/agreement between the Customer and Lac Viet as prescribed by law.
5. Serving the operations of state agencies as regulated by specialized laws.

10.2. Processing of personal data obtained from audio and video recording activities in public places:

Audio recordings, video clips from surveillance cameras, in specific cases, may also be used for the following purposes:

1. For quality assurance purposes;
2. For public security and labor safety purposes;
3. Detecting and preventing suspicious, inappropriate, or unauthorized use of Lac Viet's utilities, products, services, and/or facilities;
4. Detecting and preventing criminal activities; and/or
5. Conducting investigations and verifying incidents.

10.3. Lac Viet always respects and protects the personal data of children. In addition to the personal data protection measures provided by law, before processing the personal data of children, Lac Viet will verify the age of the child and request consent from:

1. Children in cases where children are 7 years of age or older and/or
2. Parents or legal guardians of children as prescribed by law.

10.4. In addition to compliance with other relevant legal provisions, for the processing of personal data related to the personal data of missing persons/deceased persons, Lac Viet must obtain the consent of one of the related parties as prescribed by current laws.

ARTICLE 11. UNINTENDED CONSEQUENCES, DAMAGES THAT MAY OCCUR

Lac Viet employs various information security technologies to protect personal data from unauthorized access, use, or sharing. However, no data can be guaranteed to be 100% secure. Therefore, Lac Viet commits to maximizing the security of personal data. Some unintended consequences and damages may occur, including but not limited to:

11.1. Hardware or software errors during data processing leading to the loss of Customer data;

11.2. Security vulnerabilities beyond Lac Viet's control, third-party attacks compromising data security;

11.3. Customer inadvertently disclosing personal data due to carelessness or fraud; accessing websites/downloading apps containing malicious software, etc.

11.4. Lac Viet advises Customers to secure information related to login passwords, OTP codes and not share this content with anyone else.

11.5. Customers should safeguard personal devices (phones, tablets, computers, etc.) during use. Customers should lock, log out, or exit their accounts when not in use.

11.6. In the event Lac Viet becomes aware of a third-party attack on the data storage server resulting in the loss of Customer personal data, Lac Viet will be responsible for promptly notifying the relevant authorities for investigation and informing the Customer accordingly.

ARTICLE 12. GENERAL PROVISIONS

12.1. This Personal Data Protection Policy is an integral part of the Terms and Conditions/Contract and governs the relationship between the Customer and Lac Viet. Customers are required to read and understand this policy as they would the content of those Terms and Conditions/Contract. By registering to use Lac Viet's products or services, entering into a contract with Lac Viet, and/or allowing Lac Viet to use personal information, process Customer's personal data, the Customer accepts the policies referenced herein.

12.2. Each Party acknowledges and agrees that this policy also serves as the Notice of Personal Data Processing specified in Article 13 of Decree 13/2023/NĐ-CP on Personal Data Protection and its amendments and supplements as applicable at the time before Lac Viet processes personal data. Accordingly, Lac Viet is not required to take any further measures to notify the Customer of the processing of personal data.

12.3. This policy is interpreted and governed by the laws of Vietnam.

12.4. In the event that any provision of this policy is adjudged by a competent court to be invalid, such provision shall be automatically invalidated and shall no longer bind the Parties. However, such adjudication shall not affect the validity of the remaining provisions of this policy, and the validity of those provisions shall remain in full force and effect.

ARTICLE 13. EFFECTIVE DATE

13.1. This Policy shall be effective July 1, 2023.

13.2. Customers understand and agree that this policy may be amended, updated, or revised at any time. The latest version of the Personal Data Protection Policy will be posted on Lac Viet's official website (https://lacviet.vn/). Lac Viet recommends that Customers regularly check the Personal Data Protection Policy on Lac Viet's official website to stay updated on any changes and to be informed of how the Company is protecting Customers' personal data. The continued use of services after being notified of any amendments or supplements implies that Customers have accepted those amendments or supplements.

13.3. In order to protect personal data in compliance with legal regulations, this policy shall also apply to contracts, agreements, documents, etc., between the parties signed before, during, and after the effective date of this policy.