Privacy Policy

PERSONAL DATA PROTECTION POLICY

AN PHAT HOLDINGS JOINT STOCK COMPANY

This personal data protection policy describes how An Phat Holdings Joint Stock Company (hereinafter referred to as “ty le keo chau a Company”) collects, uses and processes personal data arising in ty le keo chau a course of ty le keo chau a Company’s business operations.

1. GENERAL PROVISIONS

1.1. Personal data: means digital data or information in other forms that identify or help identify a specific person. Personal data includes basic personal data and sensitive personal data.

1.2. Personal data subject: means ty le keo chau a person reflected by personal data, including all individual customers who are using ty le keo chau a Company’s products and services, employees of ty le keo chau a Company, shareholders/managers of ty le keo chau a Company, related persons of shareholders/managers of ty le keo chau a Company and/or other individuals who have legal relations with Company.

1.3. Processing of personal data: means one or more activities affecting personal data in accordance with ty le keo chau a provisions of current law.

1.4. This Policy may be updated, amended, supplemented or replaced by ty le keo chau a Company from time to time to ensure compliance with current legal regulations and/or changes in ty le keo chau a Company’s operations. Any changes will be posted by ty le keo chau a Company on ty le keo chau a Company’s official website and/or notified to ty le keo chau a Data Subject in an appropriate manner.

1.5. ty le keo chau a Company undertakes to comply with ty le keo chau a following principles when processing personal data:

  1. ty le keo chau a Company processes and protects personal data in accordance with ty le keo chau a provisions of Vietnamese law;
  2. ty le keo chau a Company collects personal data for specific, clear and lawful purposes in accordance with ty le keo chau a provisions of Vietnamese law;
  3. ty le keo chau a Company always applies and updates technical measures in accordance with ty le keo chau a provisions of Vietnamese law to ensure ty le keo chau a security of personal data, including protection measures from unauthorized access and/or destruction, loss or damage to personal data;
  4. ty le keo chau a Company stores personal data appropriately and to ty le keo chau a extent necessary for processing in accordance with ty le keo chau a provisions of Vietnamese law;
  5. ty le keo chau a Company does not collect personal data of children as customers or service users, except where ty le keo chau a data of ty le keo chau a Employee’s child is processed for welfare purposes, or information about ty le keo chau a relevant person of ty le keo chau a business manager, legal representatives, members of ty le keo chau a Control Board as prescribed by law.

2. PERSONAL DATA PROCESSED

2.1. Basic personal data includes:

  1. Surname, middle name, and given name at birth; other names (if any);
  2. Date of birth; date of death or missing;
  3. Gender;
  4. Place of birth; place of birth registration; place of permanent residence registration; place of temporary residence registration; current place of residence; hometown; contact address;
  5. Nationality;
  6. Images of ty le keo chau a individual;
  7. Phone number; personal identification number; passport number; driver’s license number; vehicle registration plate number;
  8. Marital status;
  9. Information on family relationships (parents, children, spouse);
  10. Information on ty le keo chau a individual’s digital accounts;
  11. Other information associated with a specific individual or capable of identifying a specific individual, other than ty le keo chau a information Section 2.2 below.

2.2. Sensitive personal data includes ty le keo chau a following main data:

  1. Data revealing racial origin or ethnic origin;
  2. Opinions on politics, religion, and belief;
  3. Information on private life, personal secrets, and family secrets;
  4. Health status;
  5. Biometric data and genetic characteristics;
  6. Data revealing an individual’s sexual life or sexual orientation;
  7. Data on crimes and violations of law collected and stored by law enforcement agencies;
  8. Location data of individuals determined through positioning services;
  9. Login names and passwords for access to individuals’ electronic identification accounts; images of ID cards, citizen ID cards, or 9-digit ID cards;
  10. Login names and passwords for access to bank accounts; bank card information; data on transaction history of bank accounts; financial and credit information and other information relating to financial activities and transaction history, securities, and insurance of clients at credit institutions, foreign bank branches, intermediary payment service providers, securities institutions, insurers, and other authorized organizations;
  11. Data monitoring behavior and activities related to ty le keo chau a use of telecommunications services, social networks, online communication services, and other services in cyberspace;;

3. PURPOSE OF PROCESSING PERSONAL DATA

Personal data may be processed for one or more of ty le keo chau a following purposes:

3.1. Assessing ty le keo chau a ability to provide goods, services or/and entering into contracts with personal data subjects, including but not limited to ty le keo chau a following purposes:

  1. Identify and verify information about personal data subjects;
  2. Evaluate, appraise and approve ty le keo chau a provision of goods and services according to registration documents, applications and contracts of personal data subjects;
  3. Consider providing or continuing to provide any of ty le keo chau a Company’s goods or services to ty le keo chau a personal data subject;

3.2. Fulfilling obligations in contracts, agreements, terms, conditions and other documents between ty le keo chau a Company and personal data subjects, customer support including but not limited to ty le keo chau a following purposes:

  1. Fulfilling obligations under contracts, agreements and providing goods and services to personal data subjects;
  2. Maintaining, updating and processing information of personal data subjects;
  3. Take care of and settle complaints and lawsuits of personal data subjects;
  4. Use and transfer to partners personal data and related information to identify and troubleshoot problems of products and services;
  5. Contact and notify personal data subjects;

3.3. Improving ty le keo chau a quality of ty le keo chau a Company’s goods and services, including but not limited to:

  1. Provide information that ty le keo chau a client has requested or ty le keo chau a Company finds useful to ty le keo chau a client;
  2. Manage customer accounts;
  3. Statistics and data analysis for research, construction, development and improvement of goods and services;
  4. Introduce new products and services offered by APH.

3.4. Serving ty le keo chau a Company’s business and operation activities including but not limited to ty le keo chau a performance of reporting, financial, accounting and tax obligations, activities for ty le keo chau a purpose of auditing, compliance and other activities serving ty le keo chau a Company’s legitimate business in cases that ty le keo chau a Company deems necessary.

3.5. Prevention, combat, prevention, investigation and detection of crimes.

3.6. Protecting social order and safety, protecting ty le keo chau a legitimate rights and interests of personal data subjects, ty le keo chau a Company and other related parties.

3.7. To comply with ty le keo chau a provisions of law and international treaties to which Vietnam is a signatory including but not limited to: To provide competent state agencies in accordance with ty le keo chau a provisions of law; To perform obligations in accordance with ty le keo chau a provisions of law and international treaties that ty le keo chau a Company must comply with (if any).

3.8. Other purposes with ty le keo chau a consent of ty le keo chau a personal data subject.

3.9. Data processing without ty le keo chau a consent of ty le keo chau a data subject ty le keo chau a Company reserves ty le keo chau a right to process personal data without ty le keo chau a consent of ty le keo chau a data subject in cases where

  1. In case of emergency, it is necessary to immediately process ty le keo chau a relevant personal data to protect ty le keo chau a life and health of ty le keo chau a data subject or other persons.
  2. ty le keo chau a disclosure of personal data in accordance with ty le keo chau a law.
  3. ty le keo chau a processing of data by competent state agencies in case of emergencies on national defense, national security, social order and safety, natural disasters and dangerous disasters.
  4. To fulfill ty le keo chau a contractual obligations of ty le keo chau a data subject with relevant agencies, organizations and individuals in accordance with ty le keo chau a law.
  5. Serving ty le keo chau a activities of state agencies that have been prescribed by specialized laws.

4. HOW PERSONAL DATA IS COLLECTED AND PROCESSED

4.1. Method of collection

  1. ty le keo chau a personal data collected is as follows:
  2. From ty le keo chau a Company’s websites and affiliated applications.
  3. From ty le keo chau a provision of products and services, ty le keo chau a fulfillment of obligations under contracts and agreements of ty le keo chau a Company.
  4. From exchanges and communications with personal data subjects.
  5. From social networks: means ty le keo chau a Company’s social networks and/or social networks that ty le keo chau a Company cooperates with partners.
  6. From audio and video recording devices.
  7. From interactions or automated data collection technologies: ty le keo chau a Company may collect automatically recorded information from ty le keo chau a connection: Cookies, pixel tags and other similar technologies; Any technology capable of tracking personal activity on devices or websites; Other data information provided by a device.
  8. Other means: ty le keo chau a Company may collect personal data through public, official sources of information or through ty le keo chau a receipt of internal data sharing within ty le keo chau a Group.

4.2. How to store

Personal data is stored in Vietnam in ty le keo chau a Company’s database system. ty le keo chau a retention period of personal data is determined based on ty le keo chau a purpose of use and in accordance with ty le keo chau a law.

4.3. Manner of data transfer/sharing

  1. ty le keo chau a Company will not sell personal data to any party. ty le keo chau a Company uses ty le keo chau a necessary security measures to ensure ty le keo chau a secure transfer/sharing of personal data. Personal data is shared by ty le keo chau a company with (i) In ty le keo chau a An Phat Holdings system; (ii) individuals/organizations involved in ty le keo chau a processing of personal data; or (iii) competent state agencies or other cases in accordance with ty le keo chau a provisions of law.
  2. If ty le keo chau a recipient of personal data is headquartered outside ty le keo chau a territory of Vietnam, when providing/transferring personal data abroad (including but not limited to ty le keo chau a use of cyberspace, devices, electronic means or other forms to transfer personal data outside ty le keo chau a territory of Vietnam), ty le keo chau a Company will require ty le keo chau a recipient to ensure ty le keo chau a safety and confidentiality of ty le keo chau a personal data provided/transferred.
  3. ty le keo chau a company is committed to fully complying with ty le keo chau a regulations and compliance requirements of Vietnamese law to protect ty le keo chau a safety of personal data.

5. UNINTENDED CONSEQUENCES AND DAMAGES THAT ARE LIKELY TO OCCUR

5.1. ty le keo chau a Company uses various information security technologies to protect and prevent unauthorized access, use or sharing of personal data. However, ty le keo chau a Company cannot commit to ensuring ty le keo chau a absolute security of personal data in some cases such as:

  1. Hardware and software errors in ty le keo chau a process of data processing that cause data loss of personal data subjects;
  2. Security vulnerabilities are beyond ty le keo chau a Company’s control, ty le keo chau a system is attacked by hackers, causing data leakage and leakage.

5.2. ty le keo chau a personal data subject should be aware that at any time when ty le keo chau a personal data subject discloses and makes his/her personal data public, it may be collected and used by others for purposes beyond ty le keo chau a control of ty le keo chau a personal data subject and ty le keo chau a Company.

5.3. In case ty le keo chau a data storage server is attacked, resulting in ty le keo chau a loss, disclosure or leakage of personal data, ty le keo chau a Company shall be responsible for notifying ty le keo chau a case to ty le keo chau a investigating authorities for timely handling and notifying ty le keo chau a subject of personal data in accordance with ty le keo chau a law.

6. TIME OF COMMENCEMENT AND END OF PROCESSING OF PERSONAL DATA

6.1. Personal data is processed from ty le keo chau a moment ty le keo chau a Company lawfully receives ty le keo chau a personal data and ty le keo chau a Company has an appropriate legal basis to process ty le keo chau a data in accordance with ty le keo chau a law.

6.2. Personal data will be processed until ty le keo chau a purposes for which ty le keo chau a data processing has been completed.

6.3. ty le keo chau a Company may have to store personal data even if ty le keo chau a contract between ty le keo chau a parties has been terminated in order to fulfill its obligations in accordance with ty le keo chau a law and/or ty le keo chau a requirements of competent state agencies.

7. ORGANIZATIONS AND INDIVIDUALS PARTICIPATING IN ty le keo chau a PROCESS OF PROCESSING PERSONAL DATA

7.1. As ty le keo chau a case may be, ty le keo chau a Company may be ty le keo chau a controller of personal data or ty le keo chau a controller and processor of personal data.

7.2. To ty le keo chau a extent permitted by law, ty le keo chau a personal data subject understands that ty le keo chau a Company may share personal data for ty le keo chau a purposes specified in this policy with ty le keo chau a following organizations and individuals:

  1. Internally, An Phat Holdings;
  2. Organizations and individuals providing services and/or cooperating with ty le keo chau a Company, including but not limited to: agents, auditors, lawyers, business cooperation partners, providing information technology solutions, software, applications, operation, management, troubleshooting services, etc. infrastructure development;
  3. Any individual or organization that is ty le keo chau a representative or authorized party of ty le keo chau a personal data subject, acting on behalf of ty le keo chau a personal data subject;
  4. ty le keo chau a data sharing will be carried out in accordance with ty le keo chau a order, method and current legal regulations. Parties receiving personal data are obliged to keep personal data confidential in accordance with this Policy, ty le keo chau a Company’s internal regulations, standards for personal data protection and applicable laws.

7.3. ty le keo chau a Company may be required to share personal data with competent state authorities in accordance with ty le keo chau a law.

8. RIGHTS OF PERSONAL DATA SUBJECTS

8.1. ty le keo chau a right to know about ty le keo chau a processing of their personal data, unless otherwise provided for by law.

8.2. ty le keo chau a right to consent or disagree to ty le keo chau a processing of his/her personal data, unless otherwise provided for by law.

8.3. ty le keo chau a right to access to view, correct or request correction of his/her personal data, unless otherwise provided for by law.

8.4. Right to withdraw consent.

8.5. Right to erasure of data.

8.6. ty le keo chau a right to restrict ty le keo chau a processing of their personal data in accordance with ty le keo chau a law.

8.7. ty le keo chau a right to request ty le keo chau a provision of his/her own personal data, unless otherwise provided for by law.

8.8. Right to object to data processing.

8.9. ty le keo chau a right to complain, denounce and initiate lawsuits.

8.10. Right to claim compensation for damages.

8.11. Right to Self-Defense.

ty le keo chau a personal data subject may exercise these rights by making a request to ty le keo chau a Company. ty le keo chau a request form must be sent to ty le keo chau a Company and contain basic contents such as information of ty le keo chau a requester, detailed content of ty le keo chau a request, reason, purpose when making ty le keo chau a request, etc. ty le keo chau a Company makes a lawful and valid request from ty le keo chau a personal data subject within ty le keo chau a time prescribed by law.

ty le keo chau a Company reserves ty le keo chau a right to refuse to comply with ty le keo chau a requests of ty le keo chau a personal data subject in certain cases, including but not limited to: (i) ty le keo chau a personal data subject does not comply with ty le keo chau a order and procedures instructed by ty le keo chau a Company in which ty le keo chau a content of ty le keo chau a request is lacking information or is invalid; or (ii) ty le keo chau a fulfillment of ty le keo chau a request may infringe upon ty le keo chau a life, health, or property of others; or (iii) ty le keo chau a data subject fails to properly implement ty le keo chau a identity verification process; or (iv) ty le keo chau a provisions of ty le keo chau a law do not permit ty le keo chau a fulfillment of ty le keo chau a request of ty le keo chau a personal data subject.

9. OBLIGATIONS OF PERSONAL DATA SUBJECTS

9.1. Self-protection of your personal data;

9.2. Respect and protect ty le keo chau a personal data of others.

9.3. Fully and accurately provide personal data when consenting to ty le keo chau a processing of personal data. If there is any false information, ty le keo chau a personal data subject shall bear at his/her own expense in ty le keo chau a event that such information affects or restricts ty le keo chau a rights of ty le keo chau a personal data subject. Note that ty le keo chau a withdrawal of consent, ty le keo chau a request for data deletion or ty le keo chau a restriction of data processing may result in ty le keo chau a Company not being able to continue to provide products and services or perform a contract with ty le keo chau a data subject. In this case, ty le keo chau a Company is not responsible for any losses incurred and ty le keo chau a Company’s legal rights are reserved.

9.4. Comply with ty le keo chau a law on personal data protection and participate in ty le keo chau a prevention and control of violations of regulations on personal data protection.

9.5. Other responsibilities as prescribed by law.

10. MISCELLANEOUS

10.1. ty le keo chau a personal data subject confirms that, by accepting this policy, ty le keo chau a personal data subject has consented to ty le keo chau a personal data being processed by ty le keo chau a Company, organizations and individuals participating in ty le keo chau a processing of personal data as stated in this policy, clearly know ty le keo chau a type of data being processed, ty le keo chau a purpose of data processing, organizations and individuals entitled to process personal data, and their rights and obligations related to personal data. ty le keo chau a subject of personal data has been notified by ty le keo chau a Company, has known and agreed to all ty le keo chau a contents that need to be notified before personal data is processed by ty le keo chau a Company, organizations and individuals participating in ty le keo chau a process of processing personal data. ty le keo chau a personal data subject agrees that ty le keo chau a company, organization or individual participating in ty le keo chau a process of processing personal data does not need to notify again before processing personal data.

10.2. If you have any questions about ty le keo chau a protection of ty le keo chau a Company’s personal data, please contact us and we will respond in accordance with ty le keo chau a provisions of ty le keo chau a law. You can also contact us at ty le keo chau a address below:

Contact address: An Phat Holdings Group Joint Stock Company

Email Address: info@anphatholdings.vn

Phone: 024 3206 1119

10.3. This policy applies from January 1, 2026.