1. PURPOSE

This Policy is issued to:

• Establish principles, requirements, and control mechanisms for the collection, recording, analysis, verification, storage, access, sharing, transmission, modification, destruction, deletion, and other forms of processing of personal data at the Company.
• Ensure that the Company complies with Vietnamese laws on personal data protection, cybersecurity, network information security, electronic transactions, and relevant legal regulations.
• Protect the lawful rights and interests of data subjects, customers, partners, personnel, and other individuals whose data is processed while the Company provides products, services, platforms, software, APIs, and digital technology solutions.
• Minimize legal, operational, security, and reputational risks arising from personal data processing activities.
• Establish an internal governance framework for the Company to implement, monitor, inspect, and demonstrate compliance.

2. LEGAL BASIS

This Policy is developed based on the current laws and regulations of Vietnam, including but not limited to:

• The 2025 Law on Personal Data Protection No. 91/2025/QH15, effective from 1 January 2026, and its implementing guidance.
• Decree No. 356/2025/ND-CP, effective from 1 January 2026, guiding the implementation of the Law on Personal Data Protection and replacing Decree No. 13/2023/ND-CP.
• The 2018 Cybersecurity Law No. 24/2018/QH14, promulgated on 12 June 2018, effective from 1 January 2019, and applicable through 30 June 2026.
• The 2025 Cybersecurity Law No. 116/2025/QH15, promulgated on 10 December 2025 and effective from 1 July 2026 (replacing the 2018 Cybersecurity Law).
• The 2015 Law on Network Information Security.
• The 2023 Law on Electronic Transactions, effective from 1 July 2024, and relevant legal instruments concerning electronic signatures, digital signatures, electronic signature certificates, data messages, and trust services. This Law classifies electronic signatures according to their scope of use and stipulates the legal validity of electronic and digital signatures.
• Other relevant legal regulations, depending on the Company's products, services, business model, technology infrastructure, business sector, and actual scope of operations.

3. SCOPE OF APPLICATION

• This Policy applies to all personal data processing activities carried out by the Company or by another party on the Company's behalf.
• This Policy applies to:
  • The Board of Management.
  • The Executive Management and all divisions/departments/units.
  • Employees, collaborators, consultants, and interns.
  • Contractors, suppliers, partners, agents, integrators, and third parties.
  • Organizations/individuals authorized by the Company to access, process, or assist in processing personal data.
• This Policy covers:
  • Personal data of individual customers.
  • Personal data of end users using the Company's products/platforms or products operated by the Company for enterprise customers.
  • Personal data of enterprise customers, representatives, signatories, administrator users, and authorized persons.
  • Personal data of internal personnel, job applicants, partners, and other relevant individuals.

4. PERSONAL DATA GOVERNANCE OBJECTIVES

The Company applies this Policy to achieve the following objectives:

• Protect personal data in accordance with the principles of lawfulness, transparency, security, and accountability.
• Process personal data only to the extent necessary, for the proper purpose, and under control.
• Integrate personal data protection requirements into the product lifecycle, software development, system operations, supplier management, and enterprise risk management.
• Establish mechanisms to prevent, detect, respond to, and remediate personal data incidents.
• Provide a basis for internal inspections, compliance assessments, regulatory inspections, audits, and legal due diligence.

5. TERMS AND DEFINITIONS

In this Policy, the following terms shall have the meanings set out below:

• Personal Data means information in the form of symbols, text, numbers, images, sounds, or other similar forms that is associated with or helps identify a specific individual. Personal data includes basic personal data and sensitive personal data.
• Basic Personal Data means ordinary personal data used for identification, contact, transactions, or administration, including:
  • Surname, middle name(s), and birth name, and other names (if any).
  • Date of birth; date of death or disappearance.
  • Gender.
  • Place of birth, place of birth registration, permanent residence, temporary residence, current residence, place of origin, and contact address.
  • Nationality.
  • Images of the individual.
  • Telephone number, personal identification number, passport number, driver's license number, and vehicle registration number.
  • Marital status.
  • Information about family relationships (parents, children, spouse).
  • Information about the individual's digital accounts.
  • Other information associated with or helping identify a specific individual that does not fall within the definition of “Sensitive Personal Data” below.
• Sensitive Personal Data means personal data which, if infringed, may directly affect the data subject's rights, lawful interests, safety, privacy, or security. It includes:
  • Data revealing racial or ethnic origin.
  • Political opinions, religion, and beliefs.
  • Information about private life, personal secrets, and family secrets.
  • Health status.
  • Biometric data and genetic characteristics.
  • Data revealing an individual's sex life or sexual orientation.
  • Data on crimes and legal violations collected or stored by law enforcement authorities.
  • An individual's location determined through location services.
  • Usernames and passwords for an individual's electronic identification account; images of identity cards, citizen identity cards, and people's identity cards.
  • Bank account usernames and passwords; bank card information and bank account transaction history; financial and credit information, and information on customers' financial, securities, and insurance activities and transaction history held by credit institutions, foreign bank branches, payment intermediary service providers, securities and insurance organizations, and other authorized organizations.
  • Data tracking behavior and use of telecommunications services, social networks, online communication services, and other services in cyberspace.
  • Other personal data that the law requires to be kept confidential or protected by strict security measures.
• Personal Data Protection means activities to prevent, detect, stop, and handle violations relating to personal data in accordance with the law.
• Data Subject means the individual whose personal data is processed by the Company.
• Personal Data Processing means one or more operations performed on personal data, including but not limited to collection, recording, storage, classification, modification, analysis, linking, sharing, provision, transmission, encryption, decryption, deletion, and destruction.
• Data Subject's Consent means the data subject's clear, voluntary, and affirmative expression of permission to process their personal data.

• Personal Data Controller means an organization/individual that determines the purposes and means of personal data processing.
• Personal Data Processor means an organization/individual that processes personal data on behalf of the personal data controller.
• Personal Data Controller and Processor means an organization/individual that both determines the purposes and means of processing and directly processes personal data.
• Third Party means an organization/individual other than the Company, the data subject, and parties authorized to process data within a defined scope.
• Personal Data Incident means an event that results in, or may result in, unauthorized access, use, disclosure, loss, alteration, destruction, or encryption of personal data, or disruption of its availability.
• Personal Data Processing Information System means infrastructure, platforms, applications, databases, servers, devices, APIs, cloud services, software, or tools used to process personal data.
• Electronic Transaction Data means data generated during the authentication, signing, sending, receiving, storage, evidencing, or reconciliation of electronic transactions, data messages, electronic documents, or electronic signatures.

6. PERSONAL DATA PROTECTION PRINCIPLES

The Company protects personal data in accordance with the following principles:

6.1. Lawfulness

All personal data processing activities must have a lawful basis and comply with applicable laws, contracts, legal obligations, system security and safety requirements, or other valid grounds as prescribed by law.

6.2. Purpose limitation

Personal data may only be collected and processed for specific, clear, lawful, and necessary purposes. It must not be used for purposes outside the defined scope, except where permitted by law.

6.3. Data minimization

The Company only collects, stores, and processes the minimum amount of personal data necessary to fulfill the processing purpose.

6.4. Accuracy and updating

The Company applies appropriate measures to ensure that personal data is up to date, accurate, complete, and can be corrected when necessary.

6.5. Storage limitation

Personal data may only be retained for an appropriate period consistent with:

• The processing purpose.
• Legal obligations.
• Requirements for audits, dispute resolution, investigations, and transaction evidence.
• System security and safety requirements.

6.6. Security and integrity

Personal data must be protected by technical, organizational, personnel, and legal measures proportionate to the level of risk.

6.7. Transparency

The Company ensures that data subjects receive appropriate information about the processing of personal data relating to them, as required by law.

6.8. Accountability

The Company is responsible for establishing records, procedures, evidence, and control mechanisms to demonstrate compliance.

These principles are consistent with current personal data protection laws, which require processing to remain within scope and purpose, ensure accuracy, retain data for an appropriate period, and implement coordinated institutional, technical, and personnel measures.

7. PERSONAL DATA CLASSIFICATION

Depending on its products, services, and actual operating model, the Company may process the following categories of data:

7.1. Individual Customers/End Users

Including, but not limited to:

• Full name.
• Phone number.
• Email address.
• Personal identification number/identity card/passport (if applicable).
• Portrait/identity images/eKYC data (if applicable).
• Login and account identification information.
• Device information, IP address, cookies, system logs, and access history.
• Electronic transaction data and data messages.
• Electronic signature data, signature metadata, and signing history.
• Electronic documents, electronic contracts, digital records, uploaded files, or signed files.
• Multi-factor authentication data, OTPs, and verification history.

7.2. Corporate Customers and Their Representative Users

Including, but not limited to:

• Company information, representatives, and contacts.
• Job titles, business units, work email addresses, and work phone numbers.
• Information about signatories, authorized persons, and administrators.
• System configuration history, access rights, and administrative actions.
• User lists provided by corporate customers for processing by the Company.

7.3. Company Internal Data

Including, but not limited to:

• Employee and applicant records.
• Employment contracts and appendices, tax and insurance information, and attendance records.
• Email accounts, internal system accounts, and login logs.
• Camera images, device data, VPN data, and access history.
• Training, assessments, disciplinary actions, and internal security information.

7.4. Data Specific to Digital Products, Platforms, and Services

Including, but not limited to:

• Data messages.
• Electronic signatures/digital signatures.
• Electronic signature/digital signature certificates (to the extent the Company is permitted to process them).
• Timestamps, reconciliation data, and transaction evidence.
• API payloads, access tokens, refresh tokens, and session data.
• Authentication and authorization data, and electronic approval workflows.
• Security activity logs, operational logs, and data used to investigate incidents.

7.5. Data Classification by Protection Level

The Company applies a minimum four-level data classification:

8. BASES AND PURPOSES FOR PROCESSING PERSONAL DATA

8.1. Purposes of Personal Data Processing

The Company processes personal data only for one or more of the following general lawful purposes:

• Establishing, providing, maintaining, and operating the Company's accounts, products, services, platforms, or technology solutions.
• Providing electronic/digital signature software, electronic authentication, signing workflow management, electronic document management, digital transaction platforms, integration services, or APIs.
• Authenticating users, assigning access rights, and ensuring the integrity, authenticity, and verifiability of electronic transactions.
• Processing records, contracts, documents, data messages, electronic transactions, or digital business workflows.
• Ensuring cybersecurity and information security, and preventing fraud, impersonation, unauthorized access, and system abuse.
• Providing customer and technical support, maintenance, troubleshooting, and incident investigation.
• Reconciling and tracing transactions, providing transaction evidence, resolving disputes and complaints, and responding to inspection/audit requests.
• Fulfilling legal, contractual, and reporting obligations and requests from competent state authorities.
• Internal administration, recruitment, personnel management, system administration, training, assessment, and internal control.
• Researching, improving, and developing features and optimizing products to the extent permitted by law and contract.
• Other lawful purposes directly related to the Company's business activities.

Specific personal data processing cases also include:

For employees and job applicants participating in interviews

• Verifying applicants and employees.
• Contacting applicants or relevant parties and providing or sending messages, correspondence, or other notices.
• Establishing, performing, and terminating employment relationships.
• Personnel management and administration, including payroll, insurance contributions, and performance reviews.
• Providing employee personal data to third-party processors for payroll, tax filings, periodic health checks, training, health/unemployment insurance, and bidding activities.
• Providing information to competent state authorities and handling other legally compliant cases, such as issuing invoices and personal income tax documents.
• Other business-related purposes that the Company considers appropriate from time to time.

For partners and customers

• Performing executed contracts and agreements.
• Receiving and resolving complaints and improving the quality of goods, products, and services.
• Contacting partners to exchange information and provide documents relating to transactions and the delivery of products and services.
• Evaluating proposals relating to rights, interests, or obligations under contracts between the partners and the Company.
• Other business-related purposes that the Company considers appropriate from time to time.
• Any other purpose required or permitted by laws, regulations, guidelines, or requests from competent state authorities.

8.2. Legal Bases for Personal Data Processing

The Company processes personal data on one or more of the following applicable bases:

• The data subject's valid consent (where consent is required for the processing activity).
• Performing or preparing to perform a contract, transaction, service, or obligation at the request of the data subject or customer.
• Compliance with the Company's legal obligations.
• Protecting the lawful rights and interests of the Company, customers, partners, data subjects, or other relevant parties.
• Ensuring security and safety and preventing fraud, impersonation, abuse, unauthorized access, or system incidents.
• Other lawful bases under applicable law.

Application principles:

• The Company does not rely on consent where the law or nature of the transaction is better served by a contractual, legal obligation, or system security basis.
• Business units must identify the applicable processing basis before launching any product, process, or new feature involving personal data.

9. PERSONAL DATA PROCESSING ACTIVITIES

9.1. Methods of Collecting Personal Data

The Company may collect personal data of Data Subjects from one or more of the following sources, including but not limited to:

• Directly from the Provider during contact, work, interviews, in-person meetings, contract performance, or when the Provider supplies information.
• From the Company's websites when the Provider visits or uses features or resources available on them.
• From communications with the Provider by email, telephone, electronic or other means, including surveys and investigations.
• From competent State authorities in Vietnam.
• From public sources such as telephone directories, advertisements/leaflets, online information, or notices at workplaces.
• From suppliers, service providers, partners, affiliates, and third parties related to the Company's business.
• From other sources the Provider agrees to share or provide data, or sources from which collection is required or permitted by law.

When providing another person's personal data to the Company, the Provider represents, warrants, and is responsible for ensuring that:

• The information provided is complete, and the Provider will notify the Company of changes or errors in the data supplied.
• The Provider has informed the Data Subject and obtained lawful consent/approval or valid authorization to provide the data and allow processing under this Policy; the Provider is responsible for retaining evidence. The Company is released from liability and may seek compensation if these commitments are not met.
• The Provider complies with other personal data processing representations in any personal data undertaking signed with the Company from time to time.

9.2. Personal Data Lifecycle Management

The minimum data lifecycle stages are:

• Collection/receipt.
• Classification/recording.
• Use/processing.
• Storage/backup.
• Sharing/transmission (if any).
• Logging/verification.
• Restriction/archiving/storage.
• Destruction/deletion/deactivation.

9.3. Retention Period

For each type of personal data, the following must be specified:

• Storage purpose.
• Retention period.
• Conditions for extending or ending retention.
• Destruction/deletion method.

Personal data must not be retained indefinitely without a legal basis, a transaction evidence obligation, or a legitimate business requirement.

9.4. Destruction, Deletion, and Deactivation

When personal data reaches the end of its retention period or is no longer necessary for the processing purpose, the Company must apply one or more appropriate measures:

• Logical deletion.
• Physical deletion.
• Access deactivation.
• Anonymization.
• Destruction of copies, extracts, locally stored data, or data in auxiliary environments.

Destruction/deletion must ensure:

• It cannot be unlawfully recovered.
• Appropriate logging is retained.
• Complying with requirements for backups, recovery, and electronic evidence.

Personal data is stored in Vietnam through the Company's database systems. The Company takes reasonable measures within its capabilities to protect the data and undertakes not to unlawfully sell, lease, or trade it.

The Company will delete stored personal data upon the Data Subject's request unless deletion is prohibited by law. Deletion is carried out as follows:

• Within 72 hours after receiving a request, the Company deletes all personal data collected by the Personal Data Controller or Personal Data Controller and Processor, unless otherwise provided by law.
• Depending on the storage method at the relevant time, the Company deletes electronic files or shreds paper documents.

If the Data Subject does not request deletion, the Company may continue to store and protect data for management purposes and delete it when necessary.

9.5. Transfer/Sharing

• Data transfers/sharing with relevant parties are described in Section 8.1.
• Data transfers/sharing must follow applicable procedures, methods, and laws.

9.6. Start and End of Personal Data Processing

• Processing begins when the Company lawfully receives and/or collects personal data and continues until the processing purpose is fulfilled.
• The Company may need to retain personal data after a contract ends to fulfill legal obligations and/or requests from competent state authorities.

9.7. Possible Unintended Consequences and Damage

The Company values and strives to secure personal data and prevent unauthorized access, use, or sharing. However, absolute security cannot be guaranteed in certain cases, including:

• Hardware or software errors during data processing that result in data loss.
• Security vulnerabilities beyond the Company's control or attacks by other persons/organizations that expose data.
• A Data Subject discloses their own data through carelessness, fraud, visiting a website, or downloading an application containing malware.
• Other consequences or damage caused by objective circumstances that the Company could not foresee.

The internet is not a secure environment, and absolute confidentiality of data shared online cannot be guaranteed. Data Subjects should use secure systems to access websites, applications, or devices and must keep their authentication information confidential.

To the extent permitted by law, the Company will notify competent authorities and relevant parties within the prescribed period and endeavor to mitigate damage within its capabilities.

10. ROLES, RESPONSIBILITIES, AND GOVERNANCE MODEL

10.1. The Company's Roles in Personal Data Processing

Depending on the activity, product, or contractual relationship, the Company may act as:

• A Personal Data Controller, for data whose processing purposes and means are determined by the Company.
• A Personal Data Processor, when processing data under another customer's/business's instructions, contract, or lawful request.
• A Personal Data Controller and Processor, when the Company both determines the purposes and means and directly processes the data.
• A Third Party, when participating in part of the processing within a service or integration structure.

Each project, product, contract, and data flow must have its role clearly identified in the Controller/Processor/Third Party Matrix.

To the extent permitted by law, Data Subjects understand that the Company may share personal data with the following organizations and individuals for processing:

• The Company's employees, subsidiaries, and affiliates.
• Organizations and individuals acting as the Company's partners or contractors.
• Any individual or organization representing, or authorized by, a Data Subject to act on their behalf.
• Consultants, auditors, lawyers, notaries, and parties acting on behalf of the Company.
• Competent state authorities as prescribed by law.
• Organizations and individuals participating in personal data processing who must protect the data under this Policy and applicable law.

10.2. Responsibilities of the Board of Management

The Company's Board of Management is responsible for:

• Approving and directing the implementation of this Policy.
• Allocating appropriate personnel, budget, technology, and internal control resources.
• Directing the development of procedures, forms, records, and compliance control systems.
• Periodically monitoring and assessing personal data protection across the Company.
• Taking ultimate responsibility for compliance direction and personal data risk governance.

10.3. Responsibilities of the Personal Data Protection Function

The function responsible for personal data protection is responsible for:

• Leading the development, review, and update of relevant policies, procedures, regulations, and forms.
• Monitoring compliance with personal data protection laws.
• Coordinating risk assessments, processing impact assessments, and cross-border transfer assessments, if any.
• Managing compliance and registration/declaration/reporting records where required by law.
• Receiving, coordinating, and monitoring the handling of Data Subject requests.
• Coordinating the response to personal data incidents.
• Reviewing contract terms and data processing addenda with customers, partners, and vendors.
• Organizing training, communications, and internal compliance checks.

Current law assigns the personal data protection function/personnel responsibility for developing policies, procedures, and forms and organizing the exercise of Data Subject rights.

10.4. Responsibilities of the Technical Department/ISMS Committee/ISO Committee

Technical departments are responsible for:

• Establishing and maintaining technical safeguards for personal data.
• Managing accounts, access rights, authentication, system logs, backups, monitoring, and alerts.
• Separating development, testing, and production environments.
• Controlling data storage, transmission, backup, and recovery.
• Implementing incident response, isolation, investigation, and remediation measures.
• Preventing production access or personal data retrieval beyond approved authority.
• Coordinating risk assessments for new systems, features, APIs, or integrations.

10.5. Responsibilities of Software and Product Development Staff (Dev/Tester)

Software and product development staff are responsible for:

• Applying Privacy by Design and Security by Design throughout the product lifecycle.
• Assessing personal data from requirements design and business analysis through development and deployment.
• Not deploying a new feature that processes personal data before assessing its purpose, scope, legal basis, and risks.
• Not using real customer data for development, testing, debugging, or demos without approval and appropriate controls.
• Not placing personal data in source code, repositories, tickets, logs, or unauthorized environments.

10.6. Responsibilities of Sales/Support/Operations Departments

10.6.1. Sales/Accounting Staff

• Collecting and using customer data only to the extent necessary.
• Not extracting, sharing, or using customer data outside the service scope or an unapproved purpose without authorization.

10.6.2. Customer Care/Operations Staff

• Accessing only the data necessary to support customers.
• Not taking screenshots, downloading, or sending personal data through unauthorized channels.

10.6.3. Business Development Staff

• Using personal data for marketing only where an appropriate legal basis exists.
• Not using product customer data for marketing beyond the agreed scope or commitments.

10.6.4. Human Resources Staff

Managing applicant and employee records, attendance, camera footage, internal accounts, and employment data within job duties and legal requirements.

10.6.5. Responsibilities of All Personnel

Everyone within the scope of this Policy is responsible for:

• Fully complying with personal data protection requirements.
• Processing personal data only within their authority and for work purposes.
• Keeping personal data confidential and not disclosing it without authorization.
• Promptly reporting any discovered or suspected incident, violation, or risk to their manager and the responsible function.
• Participating in all personal data protection training, awareness, and assessment programs.

11. MANDATORY REQUIREMENTS FOR PERSONAL DATA PROCESSING

11.1. General Requirements for Data Collection and Processing

All personal data processing activities at the Company must ensure:

• A clear purpose and lawful basis.
• Collection of only data that is genuinely necessary.
• Appropriate notices, terms, or transparency mechanisms.
• An assigned responsible person or function.
• Proportionate access controls and safeguards.
• A defined retention period or a basis for determining it.
• Traceability, auditability, and accountability.

11.2. Prohibited and Restricted Processing

The Company strictly prohibits:

• Collecting unnecessary personal data or data beyond the approved scope.
• Using personal data for personal purposes or purposes unrelated to work.
• Unauthorized access or intentional access privilege escalation.
• Unauthorized sharing, copying, downloading, exporting, or transferring personal data outside the system.
• Taking screenshots or sending data through unauthorized personal chat apps, email, or devices.
• Using real customer data for testing, training, demonstrations, research, or model training without approval.
• Concealing, delaying, or failing to report a personal data incident.
• Connecting, integrating, or sharing data with a third party without approval.

11.3. Personal Data Control Rules

Given the Company's work in IT, digital platforms, electronic/digital signatures, and related products, it also applies these mandatory controls:

• Engineers, technical staff, and vendors may not access production without approval and logging.
• Signed documents, e-contracts, transaction records, or customer identity data may not be used unlawfully for demos, training, marketing, or internal development.
• Real data may not be used for debugging unless suitable anonymization, masking, or access controls are applied.
• Every data export requires a business basis, an approver, and an audit trail.
• For every API, webhook, integration, batch job, or synchronization, assess the permitted data fields.
• Review legal compliance and risks before deploying AI, OCR, recognition, behavioral analysis, anti-fraud, face matching, analytics, or profiling features.

12. PERSONAL DATA PROTECTION MEASURES

12.1. Organizational Measures

The Company applies at least these organizational measures:

• Issue policies, procedures, guidance, forms, and compliance records.
• Clearly assign roles and responsibilities.
• Establish approval mechanisms for high-risk processing.
• Provide training and periodic awareness checks.
• Conduct internal and periodic reviews, address gaps, and improve controls.
• Establish channels for personal data feedback, requests, and complaints.

12.2. Minimum Technical Measures

The Company applies at least these technical measures:

12.2.1. Access Control

• Use individually identified accounts.
• Apply role-based access control (RBAC).
• Follow the least-privilege principle.
• Require MFA for administrator and other high-risk accounts.
• Review access rights periodically.

12.2.2. Data Protection

• Encrypt stored and transmitted data where appropriate.
• Use secure protocols (TLS/HTTPS/VPN or equivalent).
• Protect keys, certificates, tokens, secrets, and credentials.
• Use masking, tokenization, pseudonymization, or anonymization when needed.

12.2.3. Logging and Monitoring

• Log sign-ins, access, administrative actions, and important data changes.
• Monitor unusual access or behavior, after-hours access, bulk access, and unusual exports.
• Keep event records for investigation, audit, and accountability.

12.2.4. Infrastructure and Software Security

• Separate development, test, staging, and production environments.
• Manage vulnerabilities and patches; harden systems and use secure configurations.
• Perform security testing, code reviews, and integration/dependency checks.
• Control APIs, endpoints, webhooks, and system connections.

12.2.5. Backup and Recovery

• Back up data according to system criticality.
• Protect backup copies.
• Test recovery capability periodically.

12.2.6. Endpoint and Email Protection

• Manage endpoint devices.
• Encrypt devices where appropriate.
• Protect email and prevent phishing and data loss.
• Control local storage and mobile devices.

12.3. Privacy by Design and Security by Design

Before deployment, review at least the following for any product, feature, process, integration, or system change involving personal data:

• What data will be collected?
• Does it include personal or sensitive data?
• What is the processing purpose?
• Is collection truly necessary?
• Where will the data be stored?
• Who may access it?
• Will data be shared with third parties or processed outside Vietnam?
• Must privacy notices, contract terms, or impact assessment records be updated?

Do not release a feature to production until required internal assessments are complete.

13. THIRD-PARTY AND SUPPLIER MANAGEMENT

13.1. Third-Party and Supplier Management

Before allowing a third party, supplier, contractor, integration partner, or technical support provider to access or process personal data, the Company must at least:

• Clearly identify that party's legal role.
• Assess necessity and risk.
• Sign an appropriate contract, addendum, or data processing terms.
• Specify data scope, purpose, duration, safeguards, audit rights, and incident notification duties.
• Apply least-privilege access limited to assigned tasks.
• At the end of the relationship, terminate access and return or delete data.

13.2. System, API, and Cloud Integration Management

For integrations or use of cloud, SaaS, APIs, monitoring, email, ticketing, CRM, authentication, OTP, OCR, KYC, anti-fraud, or similar services, the Company must:

• Identify data transmitted, stored, processed, or synchronized.
• Identify storage locations and access scope.
• Assess legal, technical, and operational risks.
• Limit data fields and sharing frequency to what is necessary.
• Use encryption, tokenization, or data minimization where appropriate.
• Ensure integrations are approved and logged.

14. DATA SUBJECT RIGHTS AND HOW TO EXERCISE THEM

14.1. Data Subject Rights

Data Subjects have the following rights:

• Right to be informed and consent: Data Subjects may know about and consent or refuse to the processing of their personal data, except as otherwise provided by law. This Policy informs them about the Company's processing. Consent may be confirmed using the form in this Policy by signature, email, or the Company's link.
• Right to withdraw consent: except as otherwise provided by law.
• Right to erasure: except as otherwise provided by law.
• Right to restrict processing of personal data: except as otherwise provided by law.
• Right to access, view, or correct personal data: except as otherwise provided by law.
• Right to obtain a copy of personal data: except as otherwise provided by law.
• Right to object to the processing of one's personal data in accordance with law.
• Right to protect oneself.
• Right to complain, denounce, or sue.
• Right to claim compensation for damage.

Notes on exercising Data Subject rights

• Except for the rights to be informed and to consent, Data Subjects may exercise the above rights by submitting a request to the Company. The request should identify the requester and detail the requested action and data, the reason, and relevant delivery preferences or supporting information.
• The Company will handle lawful and valid requests within the period required by law. For security, it may verify the Data Subject's identity before processing a request.
• Withdrawing consent, requesting deletion, or exercising other rights over some or all personal data may affect the Company's ability to provide services or maintain a contractual relationship. Such action may be treated as unilateral termination and may breach contractual obligations or commitments. The Company is not liable for resulting losses, and retains its lawful rights.
• The Company may refuse a request in certain cases, including where identity documents are missing or insufficient, or where the law does not permit the request.

14.2. Data Subject Obligations

• Protect one's personal data and request relevant organizations or individuals to protect it.
• Respect and protect other people's personal data.
• Provide complete and accurate personal data when consenting to its processing.
• Participate in promoting and sharing personal data protection skills.
• Comply with personal data protection laws and help prevent violations.

14.3. Principles for Ensuring Data Subject Rights

The Company commits to respecting and implementing mechanisms for Data Subject rights under applicable law.

These rights are exercised through internal procedures, contact points, identity verification, and appropriate responses.

14.4. Receiving and Handling Requests

The Company provides one or more channels for receiving Data Subject requests:

• Support email: info@mobile-id.vn.
• Phone: +84 28 3622 2982 or hotline 1900 6884.
• Customer support groups on Zalo, Telegram, WhatsApp, MS Teams, and other platforms.

The Company may verify identity or lawful representative authority before handling a request.

Every request must be:

• Recorded.
• Classified.
• Handled under internal SLA.
• Documented with records demonstrating the handling.

The Company may refuse or limit a request where permitted by law or where it affects security, legal duties, or the lawful rights and interests of relevant parties.

14.5. Data Subject Notice and Consent

When the Company receives personal data from a Data Subject, it will provide this Policy for review and confirmation through the Company website or a confirmation sent by Human Resources.

15. PERSONAL DATA INCIDENT MANAGEMENT

15.1. Incident Response Principles

Any actual or suspected personal data incident must be handled according to these principles:

• Detect early.
• Report promptly.
• Contain quickly.
• Assess fully.
• Remediate effectively.
• Keep records and learn from the incident.

15.2. Internal Reporting Duties

Any employee, contractor, or relevant party who discovers or suspects a personal data incident must immediately report it to:

• Their direct manager and/or
• The personal data protection function and/or
• The information security function.

The following are prohibited:

• Concealing an incident.
• Taking action outside the established procedure.
• Deleting logs or evidence, or altering digital evidence.

Every incident must be recorded in the Personal Data Incident Register.

15.3. Incident Response Process

At a minimum, the personal data incident response process includes:

• Receive and record the incident.
• Verify and classify its severity.
• Contain, control, and reduce impact.
• Investigate causes and scope.
• Remediate, recover, and strengthen controls.
• Assess legal and contractual notification/reporting duties.
• Review the incident and implement corrective and preventive actions (CAPA).

16. TRAINING, AUDITS, AND DISCIPLINARY ACTION

16.1. Training and Awareness

The Company provides internal personal data protection training and communications, including at least:

1. Mandatory training for new employees.
2. Periodic training at least annually.
3. Advanced training for high-risk teams:
   • Engineering/DevOps/Security.
   • Product/Engineering.
   • Customer Care/Support/Sales/Marketing.
   • HR/Admin/Finance.
   • System and data administrators.
4. Assess awareness and retain training records.

16.2. Compliance Checks, Monitoring, and Assessment

The Company conducts:

1. Periodic or ad hoc checks of compliance with this Policy.
2. Periodic or project-based personal data risk assessments.
3. Reviews of access rights, data flows, systems, suppliers, and external integrations.
4. Recording of findings, gaps, weaknesses, and remediation actions.

16.3. Violations

Depending on their nature and severity, violations of this Policy may result in:

• Reminder.
• Required retraining.
• Warning.
• Temporary suspension of access rights.
• Employment discipline.
• Compensation for damages.
• Referral for action under law or contractual obligations.

Disciplinary action does not exclude compensation, administrative, civil, or other legal liability under applicable law.

17. COMPANY COMMITMENTS FOR PERSONAL DATA PROCESSING

• The Company collects, processes, and stores employee, applicant, and partner personal data in accordance with law, applicable contracts and agreements, and legitimate lawful purposes.
• Depending on its role in each case—as Controller, Processor, or Controller and Processor—the Company performs the corresponding rights, duties, and processing principles required by applicable law.
• The Company processes and protects personal data provided by Data Subjects in accordance with Vietnamese law, this Policy, and agreements made with the Data Subject.
• The Company collects, stores, and uses personal information for specific, clear, lawful purposes within the scope stated in this Policy and permitted by Vietnamese law.
• The Company treats the Provider's personal data as private and confidential and will not disclose it to another party except as described in this Policy.

18. IMPLEMENTATION PROVISIONS

18.1. Effective Date

• This Policy takes effect on the date of approval.
• Any previous internal provision that conflicts with this Policy ceases to apply to the extent of the conflict.
• If the law changes, the responsible function must review this Policy and propose updates within an appropriate period.

18.2. Implementation

• The personal data protection function advises on and coordinates implementation of this Policy.
• Relevant departments, units, and individuals are responsible for implementing it diligently.
• Appendices, regulations, procedures, and forms issued with this Policy form an integral part of it.