PERSONAL DATA PRIVACY POLICY FOR CUSTOMERS

Foreword

1. Definitions and Interpretations

• Personal Data Controller: is the organization that decides the purpose and means of processing Personal Data.
• Personal Data Processor and Controller: is the organization that simultaneously decides the purpose, means, and directly processes Personal Data.
• Personal Data Processor: is the organization that processes data on behalf of the Personal Data Controller, under a contract or agreement with the Personal Data Controller.
• Data Subject: is the individual to whom the Personal Data relates.
• Affiliate Company: is any other organization that is directly or indirectly controlled by Vietnam Select or that controls or is controlled by Vietnam Select over time.
• Personal Data: is any information in the form of symbols, writing, digits, images, sound, or similar forms in the electronic environment related to or helping to identify a specific individual. Personal Data includes Basic Personal Data and Sensitive Personal Data.
• Program: is the Member Program provided by Vietnam Select to Members, including but not limited to point accumulation and use programs, promotional programs, and other programs serving Members.
• Customer or Member: is the individual who is interested in and/or makes purchases on the Platform, whether or not they have a Vietnam Select Membership Card.
• Customer Consent: is the clear, voluntary expression of the Customer’s agreement to allow Vietnam Select to process their Personal Data.
• Website: is the website vietnamselect.com.
• Application: is the Vietnam Select App.
• Platform: refers to the online platforms of Vietnam Select, including the Website, Application, and other Customer Care channels provided by Vietnam Select for customers to access its services.
• Account: is the Vietnam Select account provided to the Customer to use and access the Platform for the services of Vietnam Select.
• Processing Personal Data: refers to one or more actions affecting Personal Data, such as: collecting, recording, analyzing, verifying, storing, editing, disclosing, combining, accessing, retrieving, retrieving, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, or destroying Personal Data, or other related actions.

2. Scope and Purpose of Processing Customer Personal Data

2.1 Scope of Processing:

The personal data of customers that Vietnam Select processes includes:

(a) Basic Personal Data:

• Full name, middle name, and birth name, other names (if any);
• Date of birth (day, month, year);
• Gender;
• Residence information (including permanent address, temporary address, current residence, hometown, contact address, workplace address, office address, and other contact information);
• Nationality;
• Personal image;
• Phone number, ID card number, citizen identification number, personal identification number, passport number;
• Email address;
• Recipient’s name, phone number, and address (if home delivery service is used);
• Product reviews and ratings from customers (including text, image, and video provided by customers) through Vietnam Select’s customer service channels such as the App, Website, Hotline, KakaoTalk, Email, and Fanpage of Vietnam Select;
• Purchase history;
• User activity history;
• Line ID, KakaoTalk ID provided by the customer;
• Information from third-party registration sources, including Zalo, Google, Kakao Talk, Apple ID;
• Data recorded from other data query services such as Facebook, Google, Zalo, and third-party partners used by Vietnam Select;
• For customers who are children (under 16 years old): information about the child’s parent or legal guardian, including their full name, ID number, citizen identification number, passport number, contact phone number, and their relationship to the child;
• Other information provided by customers to exercise their rights or requests, which does not fall under sensitive personal data, including but not limited to company information, workplace information in case of requiring VAT invoices for purchases, product information, product codes, invoice number, invoice date, membership card number when requesting returns or providing feedback;
• Any other data or information provided voluntarily by customers through the Platform during service use or participation in Vietnam Select’s programs or events, excluding sensitive personal data;
• Other information associated with a specific individual or that helps identify a specific individual, which does not fall under sensitive personal data.

When customers provide personal data of others (e.g., contact information for others to place orders and receive deliveries), customers must ensure that the individuals have been fully informed about the purpose of data processing and have agreed to allow Vietnam Select to process their information.

(b) Sensitive Personal Data:

• Payment information, such as bank account numbers, credit card numbers, and other payment details;
• Account information, such as usernames, passwords, account usage details, and details about products or services purchased or obtained on Vietnam Select’s Platform and systems;
• Technical information and web data, including IP address, login data, browser type and version, time zone, location, browser plugin type and version, operating system, platform, device identification, and how customers use and view content on Vietnam Select’s Platform;
• Online payment information that is secured and recorded by payment service providers such as:
  • VNPay (PCI DSS standard)
  • Momo (PCI DSS standard)
  • ZaloPay (PCI DSS standard)
  • Banks

2.2. Purpose of Data Processing

Vietnam Select processes Customer’s Personal Data for the following purposes (hereinafter referred to as “Purpose of Processing”):

(a) Purpose of Processing for Programs:

• Provide and manage Programs, including but not limited to the following details:
  • Loyalty programs and points usage;
  • Member-exclusive offers such as discounts, promotions, and free services;
  • Provide services/benefits to Members, introducing new products or services based on Member needs and behaviors during their participation in the Program;
  • Other programs developed and offered to Members.
• Implement necessary services or services that support the provision and management of the Program;
• Optimize the Program (deploy marketing campaigns and communication to Members to improve the effectiveness of the Program);
• Identify, verify, and check Member information for Program purposes;
• Send notifications, advertisements, promotions, and materials related to the Program, products, and/or services within the Program (“Marketing Program”) to Members by methods complying with legal requirements. The content includes but is not limited to notifications, advertisements, promotions, and documents related to the Program, products, and/or services within the Program, such as marketing campaigns, promotions, customer care policies, warranty policies, gift programs, discounts, or other special offers;
• Methods and forms: The Company will contact Members via the hotline, email, text message, app, social media, or other interactive channels to send notifications, advertisements, promotions, and materials related to the Program, products, and/or services within the Program;
• Product introduction frequency: Marketing and product introduction will be carried out according to specific plans for the Marketing Programs that the Company is or plans to implement and/or has registered with the competent authorities;
• Communication and customer support for Members, exchange between Customers and the Company, and process valid Member requests;
• Adjust, update, secure, and improve products, services, apps, devices, and systems that Vietnam Select provides and/or manages;
• Conduct market surveys, research products, develop new products, gather statistics on Member information, consumption behaviors, and use detailed information related to the Program (such as transaction values, transaction time, shopping locations, service usage, and other related information) to support the Company’s operation and business;
• Detect and prevent fraud activities, account hijacking, or identity impersonation of Members within the Program;
• Prevent or investigate fraud, illegal activities, misconduct, or errors related to the entire operation of Vietnam Select and its services within the Program;
• Store, manage, back up data for disaster recovery or other similar purposes;
• Investigate accidents, resolve disputes, complaints, and other activities to comply with obligations under Vietnamese law;
• Comply with legal requirements and the requests of competent state authorities, including but not limited to obligations to disclose information, report as required by law regarding promotions, record-keeping, audits;
• Other lawful purposes in accordance with the Program’s objectives (if applicable).

(b) Purpose of Processing for Platform:

• Manage and operate customer orders: to process issues related to customer orders;
• Transaction and payment: Confirm transactions and carry out payments related to customer orders;
• Maintain Accounts: Create, manage, update, and maintain customer accounts, including loyalty programs or reward programs associated with the account;
• Customer service: This includes contacting, responding to customer inquiries, requests, and complaints; notifying customers of any changes related to products and orders;
• Personalization: Personalize the customer experience, such as recognizing preferences, shopping behaviors, to improve services at Vietnam Select and provide advertisements aligned with customer shopping needs;
• Security: Serve purposes of preventing activities that undermine the customer’s user account or fraudulent activities;
• Legal requirements: Depending on the law at the time, Vietnam Select may collect, store, and provide information as required by competent state authorities.

3. Organizations or Individuals Authorized to Process Customer’s Personal Data

Vietnam Select will not provide Customer’s Personal Data to any third parties except for relevant parties involved in the Purpose of Processing. These relevant parties include:

• Vietnam Fruits And More Co., Ltd., and its affiliated companies, units, and branches (if any);
• Service providers, or other third parties involved in processing Personal Data on behalf of or authorized by Vietnam Select to serve the Purpose of Processing, including but not limited to:
  • Transport service partners;
  • Payment partners;
  • Partners supporting data analysis about users (if any);
  • Cloud service providers, IT partners;
  • Advertising and marketing partners;
  • Advisors and consultants, such as legal advisors, etc.;
• Competent government agencies;
• Business transfers: Vietnam Select has the right to share Customer’s Personal Data with other parties related to any mergers, acquisitions, consolidations, collaborations, restructuring, funding, or any other business transactions;
• Other third parties that Vietnam Select deems necessary for the Purpose of Processing or in accordance with legal requirements.

4. Customer’s Rights and Obligations Regarding Personal Data

4.1. Customer’s Rights

As the data subject, the Customer has the following rights regarding their Personal Data, except as otherwise required by law:

• Right to Know: The Customer has the right to be informed about the processing of their Personal Data.
• Right to Consent: The Customer has the right to consent to or refuse the processing of their Personal Data, except when the law permits processing without the data subject’s consent.
• Right to Access: The Customer has the right to access and view, modify, or request modification of their Personal Data by logging into their account on the platform and editing personal information or requesting Vietnam Select to do so via Customer Care channels such as Hotline, KakaoTalk, Email, or Fanpage.
• Right to Withdraw Consent: The Customer has the right to withdraw their consent.
• Right to Erasure: The Customer has the right to delete or request the deletion of their Personal Data.
• Right to Restrict Processing: The Customer has the right to request the restriction of their Personal Data processing.
• Right to Data Portability: The Customer has the right to request the provision of their Personal Data.
• Right to Object to Processing: The Customer has the right to object to the processing of their Personal Data to prevent or limit its disclosure or use for advertising and marketing purposes.
• Right to Complain, Report, and Sue: The Customer has the right to file complaints, reports, or lawsuits according to the law.
• Right to Claim Compensation for Damages: The Customer has the right to request compensation for damages if there is a violation of the regulations on the protection of their Personal Data.
• Right to Self-Protect: The Customer has the right to self-protect according to the provisions of the Civil Code, other relevant laws, and Decree 13/2023/ND-CP on Personal Data Protection, and request competent authorities or organizations to implement civil protection measures. The Customer has the right to file a complaint about the disclosure of personal information to third parties with Vietnam Select’s management team.

Exercising certain rights, such as withdrawing consent, deleting data, restricting, or objecting to data processing, may result in Vietnam Select being unable to take the necessary actions to fulfill the Purpose of Processing or be unable to provide, support, or resolve the Customer’s requests.

4.2. Customer’s Obligations

As the data subject, the Customer has the following obligations regarding their Personal Data:

• Self-protection of Personal Data: The Customer must protect their Personal Data and ensure that other relevant organizations or individuals do the same. If Personal Data is disclosed due to negligence or any fault on the Customer’s part, the Customer accepts any resulting risks and damages.
• Account Security and Use: The Customer is responsible for the security and storage of all activities conducted under their registration name, password, and email. The Customer must notify Vietnam Select promptly of any unauthorized use, abuse, or security breaches related to their registration details or password, and take appropriate measures to resolve such issues. The Customer is also responsible for notifying any errors or suspicions regarding the compromise of their Personal Data.
• Respecting the Personal Data of Others: The Customer must respect and protect the Personal Data of others.
• Providing Accurate Personal Data: The Customer must provide accurate and complete Personal Data to Vietnam Select when consenting to the processing of their Personal Data.
• Updating Personal Data: The Customer must update Vietnam Select promptly if there are any changes to the Personal Data they have provided.
• Providing Legal Documents: The Customer must provide legally valid documents upon request from Vietnam Select to prove that they have obtained the necessary consent from the third parties or references to provide their Personal Data.
• Compliance with Personal Data Protection Laws: The Customer must comply with personal data protection regulations and participate in preventing violations of these regulations.

5. Data Processing Start and End Time

Vietnam Select processes the Customer’s Personal Data from the moment it receives the Customer’s consent to process their data (as defined in Section 1 of this Privacy Policy). The processing of the Customer’s Personal Data will continue for as long as necessary to achieve the processing purposes and to comply with applicable legal requirements (e.g., for tax and audit purposes), or to fulfill obligations that Vietnam Select has informed the Customer about. Certain types of Personal Data may be retained for longer than other types of data.

Vietnam Select will permanently delete the Customer’s Personal Data in the following cases:

• The data is processed for purposes other than originally intended;
• The purpose for which the data was collected has been fulfilled, and no further processing is required;
• Retention of the data is no longer necessary for the operations of Vietnam Select;
• Vietnam Select is dissolved, ceases to operate, declares bankruptcy, or discontinues its business operations according to the law.

Vietnam Select will take the necessary steps to prevent access to or use of the Customer’s Personal Data for purposes other than those compliant with this Privacy Policy or for reasons related to safety, security, fraud detection, and preventing risks to information systems, cybersecurity, and the protection of the Customer’s Personal Data.

6. Transfer of Personal Data Abroad

Vietnam Select may transfer or grant access to the Customer’s Personal Data to foreign organizations, management bodies (including Vietnam Fruits And More Co., Ltd., and its Affiliates, units, and branches, if any), or overseas partners and service providers for processing in accordance with the processing purposes agreed upon by the Customer. In some cases, service providers of Vietnam Select based in Vietnam may use data processing equipment or systems located outside of Vietnam. These situations are considered as transferring Personal Data abroad.

It is important to note that some countries may have lower or higher standards of Personal Data protection compared to Vietnam. In any case of transferring Personal Data abroad, Vietnam Select will take appropriate measures to ensure the protection of the Customer’s Personal Data. This includes entering into agreements or commitments on data security, selecting partners who are suitable Data Processors with clear responsibilities, and ensuring that these partners implement appropriate data protection measures.

7. Methods of Processing and Measures for Protecting Personal Data

Vietnam Select will implement appropriate measures to protect Personal Data, including organizational, human resource, and technical measures in accordance with legal regulations to detect and prevent leaks or violations concerning Personal Data. These measures include, but are not limited to:

• Developing and issuing regulations on personal data protection, specifying actions required by law.
• Appointing a department and personnel responsible for protecting Personal Data.
• Logging and storing records of the system’s process for handling Personal Data.
• Conducting cybersecurity checks on systems, devices, and tools used for processing Personal Data before processing, ensuring irreversible deletion, or destroying devices containing Personal Data.
• Designing security systems, access controls, intrusion prevention, authentication processes, data encryption, and backup solutions.
• Implementing other measures as required by law.

8. Potential Consequences and Unwanted Damages

Please note that, while Vietnam Select strives to ensure that the Personal Data of Customers is well protected in accordance with legal regulations, Vietnam Select cannot completely eliminate all risks related to Personal Data during processing. The transmission of information via the Internet or internal systems of Vietnam Select may still carry certain risks arising from force majeure events or cybersecurity incidents such as cyberattacks, network terrorism, illegal cyber espionage, disruption of data processing, or leakage of Personal Data.

In such cases, Vietnam Select will immediately take necessary actions to prevent, rectify, and mitigate potential damages to Personal Data, while coordinating with relevant authorities to handle the violations. Customers also agree that, to the extent that reasonable measures have been applied to prevent such risks, Vietnam Select will not be liable for compensating any damages caused by actions of third parties that negatively affect the Customer’s Personal Data beyond the control of Vietnam Select.

9. Data Protection Department

If Customers wish to exercise their rights or have any questions, requests for support, concerns, or complaints related to this Privacy Policy or the processing of Personal Data by Vietnam Select, Customers may contact Vietnam Select as follows:

• Contact Information: [Provide contact details such as email, hotline, or physical address where the Data Protection Department can be reached]

The Data Protection Department is responsible for addressing all inquiries and requests regarding the protection of Personal Data in accordance with the law and the company’s privacy policy.

10. Commitment to Protecting Customers’ Personal Data

Vietnam Select is committed to safeguarding the personal data of its Customers on its Platform in accordance with this Privacy Policy. The collection and use of Customers’ Personal Data will only occur with the consent of the Customer, except in cases where the law provides otherwise.

Vietnam Select commits to:

• Non-disclosure: Not to use, transfer, provide, or disclose Customers’ Personal Data to any third parties (except for those organizations or individuals listed in Section 3 of this Privacy Policy) without the Customer’s permission or consent, unless required by law.

• Security Breach: In the event that Vietnam Select’s servers or information systems are hacked, leading to the loss of Customers’ Personal Data, Vietnam Select will take responsibility for promptly notifying the relevant authorities for investigation and processing, and will inform the affected Customers accordingly.

• Secure Transactions: Vietnam Select will ensure the absolute security of all Customers’ online transaction information, including invoices and digital accounting documents, which will be stored in a secure data center.