PERSONAL DATA PROTECTION NOTIFICATION AND CONSENT
OF CUSTOMERS/INDIVIDUALS (DATA SUBJECT)

VEDAN Viet Nam Enterprise Corp., Ltd (hereinafter referred to as “the Company”) hereby notifies you of the following matters according to the personal data protection provisions of Vietnam (“PDPD”), in connection with your personal data which may have been (or may in future be) necessary for the Company to directly or indirectly collect, use, process, and/or disclose within the scope of business which it may conduct according to the laws and to the extent necessary for it to carry out the business activities in which it is involved (which still has to conform to the class of business in which the Company has dealings with you).

1. Purpose of Collection and Classification of Personal Data

Personal data which are collected in the relevant applications, agreements, contracts, or from the business, accounts or services provided to you by the Company or from third parties for the following specific purposes in accordance with legal regulations, may include both basic personal data and sensitive personal data, namely:

a) Basic Personal Data
Surname, middle name and given name, and allias (if any); date of birth, date of death or missing; sex; place of birth; place of birth registration, place of permanent residence; place of temporary residence, place of current residence; hometown; contact address; nationality(ies); personal image; telephone number, I.D.card number, citizen card number, passport number, driving license number, car plate number, personal tax code, social insurance number, health insurance number; marital status; family relationship (parents, children); Information about digital account of the individual; personal data on activities, history of activities in cyberspace; other information which is associated with you, other than sensitive personal data.

b) Sensitive Personal Data

Political viewpoint, religious viewpoint; medical treatment and personal life in medical records (excluding the information on blood type); racial origin, ethnic origin; inherited or acquired genetic characteristics; unique physical or biological characteristics; sexual life, sexual orientation; crime records and offenses are collected and stored by law enforcement authorities; KYC information, including: customer identification information, information on accounts, deposits, deposited assets, transactions, organizations and individuals being securing parties; location data identified through location services; other personal data classsifed as particular and requiring for necessary security measures by laws.

Your personal data held by the Company shall be kept confidential. However, in order to carry out the purposes in accordance with legal regulations, the Company may share your personal data with its related corporations and third parties, whether in Vietnam, Taiwan or elsewhere. When doing so, the Company will require them to ensure that your personal data disclosed to them are kept confidential and secured.

By providing personal data relating to a third party (e.g. your dependent, spouse, children and/ or parents) to the Company, you represent and warrant that the consent of that third party has been obtained for the collection, use and disclosure of the personal data for the purposes in accordance with legal regulations.

You shall ensure and take responsibility that at all times, the information provided by you to the Company is correct, accurate and complete. You shall update us in a timely manner of all changes to the information provided to the Company.

2. Time Period, Areas, Targets and Ways of Use of the Personal Data (non exhaustive)

a) Time Period

The period will vary according to the specific purpose of collecting the personal data, retention period prescribed by the relevant laws and regulations or stipulated by contract and/or the safekeeping period in line with the Company’s operation.

b) Areas

Vietnam, the location of the receivers of the internationally transmitted personal data who are not restricted by the central regulatory authority of the subject business industry, the location of the Company’s business outsourced institutions, and the business location of institutions which have business relationship with the Company.

c) Targets

The Company, the parent company which controls the Company, the parent company’s affiliated enterprises, correspondent companies, credit guarantee institutions, companies which engage in joint marketing with the Company or which reciprocally use client information with the Company, companies which cooperate with the Company in business promotion, other institutions which have business relationship with the Company, agencies which have investigation right by laws and other relevant authorities.

d) Ways of Use

By means of automatic machines or other non-automatic measures.

3. Rights

According to the PDPD, you may exercise the following rights with respect to your personal data collected by the Company:

a) Acknowledge
By this notification, you are duly informed of the Company’s processing of your personal data for the stated purposes accordance with legal regulations.

b) Consent

By reading through the notification and signing off the consent, you are considered as granting consent to the Company’s processing of your personal data, except for cases specified in Article 17 of Decree 13/2023/ND-CP. You understand that the Company is unable to conduct the whole or part of its business activities to provide products/services as requested/applied by you if you do not give the Company such consent.

c) Access

You may request for access to your personal data provided by you to the Company, which is in the possession or under the control of the Company, and for information about the ways in which your personal data has been or may have been used or disclosed by the Company within a year before the date of request.

d) Correction

You may request for correction of error or omission in relation to your personal data which is in the possession or under the control of the Company.

e) Provision of data

You may at any time give notice to the Company to provide you with your personal data provided by you to the Company, which is in the possession or under the control of the Company.

f) Withdrawal of consent

You may at any time give notice to the Company to withdraw your consent in respect of the collection, use or disclosure of your personal data for any purpose. If you withdraw your consent to any or all purposes and depending on the nature of your request, the Company’s ability to continue its business relationship with you may be affected. Your withdrawal may be considered a termination by you of any contractual relationship which you may have with the Company, and a breach of your contractual obligations or undertakings, and the Company’s legal rights and remedies in such an event are expressly reserved.

g) Deletion

To the extents permitted by law, you may at any time give request to the Company to delete your personal data provided by you to the Company, which is in the possession or under the control of the Company.

h) Restriction or objection of data processing

To the extents permitted by law, you may at any time give request to the Company to restrict or object the Company’s processing of your personal data. If you restrict or object any or all purposes or processing and depending on the nature of your request, the Company’s ability to continue its business relationship with you may be affected. This act may result in a termination by you of any contractual relationship which you may have with the Company, and a breach of your contractual obligations or undertakings, and the Company’s legal rights and remedies in such an event are expressly reserved.

i) Complaint

You have the right to send a compliant in relation to the Company’s collecting, use and processing of your personal data.

j) Request for compensation or self-defense

To the extents permitted by law, in case of any breach by the Company which cannot be amicably resolved between the parties, you may take appropriate actions to request for compensation or self-defense.

4. /Potential adverse consequences

Please note that while the Company always strives to ensure that the Personal Data of the Data Subject is best protected in accordance with the law, the Company cannot completely and absolutely eliminate all risks to Personal Data during the processing. The transmission of information over the Internet or the Company’s internal information systems still carries certain risks arising from force majeure or cyber security incidents, crimes such as cyberattacks, cyberterrorism, unauthorized cyber espionage, disruption of data processing, or leakage of Personal Data. In such cases, the Company will immediately take the necessary actions to prevent, remedy, and minimize potential adverse consequences to Personal Data, and cooperate with the competent state authorities to handle violations. The Data Subject also agrees that to the extent that reasonable measures have been taken to prevent these risks, the Company shall not be liable for damages caused by the acts of any third party that adversely affects the Personal Data of the Data Subject without being the fault of the Company.

It should be noted that all the above rights shall be subject to exceptional circumstance and restrictions provided in any laws, regulations, rules of Vietnam by any regulators, competent state enforcers, including without limitation, those in the Company’s field, tax.

If you wish to exercise any of the rights, your request must be submitted to the Company in written form.

ACKNOWLEDGEMENT AND CONSENT

You acknowledge that you have read and understood the above Personal Data Protection Notification (the “Notification”) and consent to the collection, use and disclosure of my Personal Data by the Company for the Purposes set out in the Notification.