GENERAL TERMS OF PERSONAL DATA PROTECTION POLICY

(Effective from August 1, 2024)

Please read this safety and security policy to understand our procedures for protecting you and your Personal Data, as well as updates to our Privacy Policy.

We take our responsibilities regarding information security seriously, in accordance with the personal information confidentiality regulations of Vietnamese Law, and are committed to respecting the privacy and concerns of all users of our website (“Platform”) (collectively, the Platforms and the services we provide as described in our Platform are the “Services”) that require viewers to provide information directly or indirectly.

We recognize the importance of the personal data you have entrusted to us and believe that it is our responsibility to properly manage, protect, and process your personal data. This Privacy Policy (“Privacy Policy” or “Policy”) is designed to help you understand how we collect, use, disclose, and/or process personal data you have provided to us and/or we possess about you, whether now or in the future, as well as to assist you in making informed decisions before providing us with any of your personal data.

1. DEFINITIONS AND INTERPRETATION

1. DEFINITIONS AND INTERPRETATION The terms used in this Privacy Policy shall be interpreted and have the following meanings:

“Privacy Policy” means the general terms, conditions and our commitments at each time regarding the protection of your personal data when you log in, use, or refer to the Services on our Platform.

“We” means Song De Investment Trading and Service Company Limited, including member companies that share the use of the Platform and collected data (if any).

“You” are the person who provides Personal Data to Us.

“Personal Data” or “personal data” means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which an organization has or is likely to have access. Common examples of personal data may include name, identification number, and contact information.

By “registering an account,” “using the Services,” or “accessing the Platform,” you acknowledge and agree that you accept the methods, requirements, and/or policies described in this Privacy Policy, and hereby confirm that you are fully aware and agree to allow us to collect, use, disclose, and/or process your personal data as described herein. IF YOU DO NOT AGREE TO THE PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS POLICY, PLEASE DO NOT USE OUR SERVICES OR ACCESS OUR PLATFORM OR WEBSITE. If we change our Privacy Policy, we will notify you, including by posting those changes or the revised Privacy Policy on our Platform. To the extent permitted by law, your continued use of the Services or Platform, including your transactions, is deemed to be your acknowledgment and agreement to the changes in this Privacy Policy.

“Personal Data Processor” means an organization or individual that processes data on behalf of the Data Controller, through a contract or agreement with the Data Controller.

“Personal Data Controller and Processor” means an organization or individual who simultaneously decides the purpose, means, and directly processes personal data.

“Third Party” means an organization or individual other than Us and you.

2. WHEN AND WHAT KIND OF PERSONAL DATA WE COLLECT FROM YOU

2.1 We will/may collect personal data about You:

• when You register and/or use Our Services or Platform, or open an account with Us;
• when You submit any form, including application forms or other forms relating to any of Our services, either online or otherwise;
• when you enter into any agreement or provide other documents or information relating to your interactions with Us, or when you use the services or operate on Our Platform;
• when you interact with us, such as through phone calls (which may be recorded), letters, faxes, face-to-face meetings, social media platforms and email;
• when you use Our electronic services, or interact with Us through Our Platform or Website or Our Services. This includes through cookies that we may deploy when you interact with Our Platforms or Websites;
• when you grant permission on your device to share information with Our Platform; • when you provide feedback or submit complaints to Us;
• when you register to participate in a program posted on Our Platform;
• when you submit your personal data to Us for any reason; and/or
• when you perform other activities on Our Platform.

The above cases are not intended to be an exhaustive list of cases and only provide some common instances of when your personal data may be collected.

2.2 Unless otherwise specified in this Policy, the personal data that We may collect includes basic personal data and sensitive personal data (as defined by Law) as listed below:

• full name;
• email address;
• date of birth;
• residential address (if any);
• phone number;
• gender;
• information sent by or in relation to the device(s) used to access Our Services or Platform;
• information about your network, including your contact list when you agree to share it on your device, and the people and accounts you interact with;
• images or audio or video;
• government-issued identification or other information for the purposes of legal assessment, potential customer and partner identification, personnel verification and/or fraud prevention;
• communication or contact data, such as your preferences for receiving promotional information from us or third parties, your preferred means of communication and communication history with us, our service providers, and other third parties;
• usage and transaction information, including details about your search history, transactions, advertisements and content displayed that interact with the Platform, as well as your related products and services;
• any other user information when the user logs in to use Our Services or Platform, and when the user uses the Services or Platform, as well as information about how the user uses Our Services or Platform; and
• aggregate data about the content users use.

You may provide additional personal data of other individuals such as: references; current colleagues, superiors; representatives; relatives; or Third Parties who are other individuals to Us. You undertake that: (i) before providing the personal data of such individuals to Us, You have obtained the legally valid consent of each such individual in relation to the provision, collection, processing, transfer and other actions in accordance with the law for such data; (ii) promptly notify Us if any of the above individuals withdraw or modify their consent.

You agree to indemnify and hold Us harmless from and against any liabilities, damages, disputes, losses and risks arising from the processing of personal data You provide to Us.

3. HOW WE USE THE INFORMATION YOU PROVIDE

We may collect, use, disclose and/or process your personal data for the following purposes:

• to administer, operate, provide and/or manage your use of and/or access to Our Services and platforms (including your employment needs), as well as your relationship and user accounts with us;
• to fulfill, process, resolve or complete a transaction and/or fulfill your requests for certain services and notify you of service issues and unusual account activity;
• to enforce our Terms of Service or any applicable end user license agreement;
• to protect the personal safety and rights, property or safety of others;
• for identification, verification, legal assessment or to identify potential customers, partners, personnel;
• to assess and make decisions regarding your profile and risk and eligibility for cooperation, if any;
• to maintain and manage any updates on Our Platform and/or other updates and support that may be requested from time to time to ensure Our Services run smoothly;
• to address or facilitate customer service, fulfill Your requests, resolve or respond to any inquiries submitted by (or intended to be submitted by) You or on your behalf;
• to contact You or communicate with You by phone, text message and/or fax, email and/or mail or otherwise for the purpose of administering and/or managing your relationship with Us or your use of Our Services, such as communicating administrative information to you regarding Our Services. You acknowledge and agree that such communications from us may be by way of mailing letters, documents or notices to You, which may include disclosing certain personal data about you to deliver those materials as well as on the packaging/envelope;
• to conduct research, analysis and development activities (including but not limited to data analysis, surveys, development of Our services), to analyze how you use Our Services, to make recommendations according to your interests, to improve Our services or products and/or to improve your user experience;
• for marketing and advertising purposes, in which case, to send you through various means and methods of communication, marketing and promotional information and materials relating to the Services (including, but not limited to, products and/or services of third parties with whom We may cooperate or affiliate) that We (and/or its affiliates or related companies) may sell, market or promote, whether such products or services exist at this time or are created in the future. You may unsubscribe from receiving marketing information at any time. We may use Your contact information to send newsletters and/or media materials from us or from our related companies;
• to comply with legal procedures or to comply with or as required by applicable law, and the requirements of competent state agencies or the requirements of any jurisdiction or when we truly believe that disclosure of information is necessary, including but not limited to, responding to requests for disclosure of information as required by any law binding on Us or Our related companies or branches (including, if any, the display of your name, contact details and personal data details);
• to compile statistics and research to meet internal or regulatory reporting requirements;
• to carry out due diligence or other screening activities (including but not limited to background checks) in compliance with regulatory obligations or competent state agencies or Our risk control procedures, which may be required by law or may have been applied by Us;
• To respond to any actual threats or demands asserted against Us or other requests regarding infringing Content of third parties;
• to store, host, back up (whether for disaster recovery purposes or otherwise) your personal data;
• any purpose for which we notify you at the time we seek your consent.

We will process the personal data you provide ourselves or through a service contract or similar arrangement with a Third Party. The personal data you provide may be collected and processed in a variety of ways as we deem appropriate under applicable personal data protection laws. The personal data you provide will be stored in an online or offline database owned by the Company or a third party provider. The time and duration of storage and processing of personal data provided by You will depend on the actual needs identified by Us, in accordance with the purposes of data processing stated above and will not exceed the time limit prescribed by law. applicable to each type of personal data (if any).

The personal data You provide may be transferred abroad, stored or processed outside the territory of Vietnam for the purposes of personal data processing stated above. We may transfer the personal data you provide abroad in accordance with applicable personal data protection laws. The Company may share the personal data You provide with third parties including member companies, parent companies, affiliates, and other individuals and organizations acting as consultants to carry out the above purposes.

4. YOUR RIGHTS AND RESPONSIBILITIES

4.1 Your Rights as a Data Subject:

a) Right to be informed: You have the right to be informed about the processing of your personal data, unless otherwise provided by law;

b) Right to consent: You have the right to consent or not to consent to the processing of your personal data by using or refusing to use Our Platform;

c) Right of access: You have the right to access, view, modify or request modification of your personal data, unless otherwise provided by law;

d) Right to withdraw consent: You have the right to withdraw your consent, unless otherwise provided by law;

e) Right to erasure: You have the right to erase or request the erasure of your personal data, unless otherwise provided by law;

f) Right to restrict processing: (i) You have the right to request restriction of the processing of your personal data, unless otherwise provided by law; (ii) The restriction of data processing shall be carried out within 72 hours after receiving Your request, with all personal data that You request to be restricted, unless otherwise provided by law;

g) Right to data portability: You have the right to request the data controller, the personal data controller and processor to provide you with your personal data, unless otherwise provided by law;

h) Right to object to processing: (i) You have the right to object to the data controller, the personal data controller and processor processing your personal data to prevent or limit the disclosure of personal data or use for advertising and marketing purposes, unless otherwise provided by law; (ii) the data controller, the personal data controller and processor shall comply with Your request within 72 hours of receiving the request, unless otherwise provided by law;

i) Right to complain, denounce, and sue: You have the right to complain, denounce, or sue as prescribed by law;

j) Right to claim compensation for damage: You have the right to claim compensation for damage as prescribed by law in case of violation of regulations on protection of your personal data, unless otherwise agreed by the parties or otherwise provided by law;

k) Right to self-protection: You have the right to self-protect personal data as prescribed by law;

l) Other obligations under applicable personal data protection laws as well as this Policy;

4.2 Your Obligations as a Data Subject:

a) Protect your personal data yourself; request other relevant organizations and individuals to protect your personal data;

b) Ensure to read, understand, and voluntarily agree to the terms of collection, processing and use of personal data before providing it;

c) Respect and protect the personal data of others;

d) Provide complete and accurate personal data when consenting to the processing of personal data;

e) Self-study and protect personal data;

f) Implement the provisions of law on personal data protection and participate in preventing and combating acts of violation of regulations on personal data protection;

g) Fully comply with applicable laws on personal data protection as well as these Terms and Conditions.

5. RISKS AND MEASURES TO PROTECT PERSONAL DATA

We are committed to using technical and other appropriate measures to protect the personal data you provide from unlawful acts. However, You acknowledge that no matter what level of such measures We apply, there is a risk that cyber attacks, data theft, data destruction, security breaches, illegal acts of others, errors or damage to electronics, computers, technology, systems, servers or other similar events may still occur. Accordingly, the personal data you provide may be leaked, disclosed, lost, deleted, destroyed, damaged, encrypted, stolen, altered, infringed, used for fraud or for illegal purposes or subject to other adverse effects. In this case, We will take reasonable measures to protect the personal data You provide, however, You also agree that, We will not be considered in violation of this Policy and will not be liable for any damages or adverse effects arising.

6. CONFIRMATION OF NOTICE, EFFECTIVENESS AND OTHER TERMS

By agreeing to this Policy, You acknowledge that You have received the necessary and relevant notices from Us and affirm Your consent to the collection and processing of personal data as stated above and that there is no objection to any content of this Policy. You agree that We do not need to re-notify before processing personal data.

This Policy is effective for You from the date You confirm your agreement by any means. You will be solely responsible for any arising liabilities and hold Us harmless from and against any liabilities, damages, disputes, losses and risks arising from this action.

You also agree that We have the full right to amend and supplement this Policy from time to time in accordance with applicable laws without having to obtain Your confirmation and consent. Such amended and supplemented Policy will automatically take effect and be applied from the date it is successfully posted on our website.

This Policy is governed by Vietnamese law. If any provision of this Policy is declared invalid by the judgment of a competent State agency or due to a change in law, the remaining provisions shall remain in full force and effect for the parties.

This Policy may be expressed in Vietnamese and foreign languages, in case of conflict of content between the Vietnamese version and the foreign language version, the Vietnamese version shall prevail.