PERSONAL DATA PROTECTION POLICY

SIK VIETNAM CO., LTD.

This Personal Data Protection Policy (“Policy”) stipulates how SIK Vietnam Co., Ltd. (“SIK Vietnam”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects the Personal Data of individuals in accordance with current Vietnamese laws.

We recommend that you read this Policy carefully to understand the methods and purposes for which your Personal Data is processed.

1. Scope and Definitions

1.1 Personal Data

“Personal Data” refers to information in the form of symbols, letters, numbers, images, sounds, or similar forms that is associated with a specific individual or helps identify a specific individual, as prescribed by Vietnamese law from time to time.

1.2 Classification of Personal Data

• Basic Personal Data, including but not limited to:
  • Full name, middle name, and birth name, alias (if any);
  • Date of birth;
  • Gender;
  • Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address;
  • Nationality;
  • Personal images;
  • Phone number, Citizen Identity Card number, personal tax identification number, social insurance number, health insurance card number;
  • Marital status;
  • Information on family relationships (parents, children).
• Sensitive Personal Data (if any):
  • Health status recorded in the Employee's health certificate, excluding blood group information;
  • Criminal record information or Curriculum Vitae information;
  • Customer information of credit institutions, foreign bank branches, payment intermediary service providers, and other permitted organizations, including: information on accounts at credit institutions, bank branches, and payment intermediary service providers.

1.3 Consent of the Data Subject

When you register for or use any products, services, or programs provided by SIK Vietnam, or when you submit information or contact SIK Vietnam and express clear consent according to instructions on our platform, you confirm and agree to allow SIK Vietnam and its affiliates, representatives, and/or authorized units (collectively “we”) to collect, use, and disclose your Personal Data in accordance with this Policy.

“You” or “your” refers to individuals within the scope of the Law, including existing or potential individual customers, but excluding organizations, enterprises, or entities excluded by Law.

2. Collection of Personal Data and Consent

2.1 Methods of Collection

We may collect your Personal Data through:

• Transactions, contracts, and business contacts;
• Direct communication, telephone, or email;
• Contact registration via the website;
• Participation in events, training, or programs organized by SIK-V;
• Security camera (CCTV) systems at company premises;
• Other legal methods as prescribed by law.

2.2 Principles of Collection

• Collect only what is accurate, sufficient, and appropriate for the notified purposes;
• Process only with valid consent, except where the law permits processing without consent;
• Do not request unnecessary data.

2.3 Your Responsibility

You commit that:

• The information provided is accurate and complete;
• You have the legal right when providing the Personal Data of others (if any).

2.4 Children

We do not intentionally collect Personal Data from persons under 16 years of age without the legal consent of a parent or guardian.

3. Purposes of Processing Personal Data

SIK Vietnam processes Personal Data for the following purposes:

• Personnel management, recruitment, payroll, and benefits;
• Performance of contracts, provision of products and services;
• Contacting, responding to requests, resolving complaints, and customer care;
• Storing and recording personal information (phone numbers, emails, etc.) to interact with customers to ensure quality, train staff, evaluate job performance, and for identity verification;
• Managing payments, invoicing, accounts, credit checks, and debt recovery matters;
• Compliance with legal obligations, audits, and inspections;
• Ensuring security and safety at the premises;
• Improving operations and internal governance;
• For other legal purposes based on your consent.

4. Sharing and Transferring Personal Data

4.1 Data Recipients

Personal Data may be shared with:

• Banks and payment solution providers;
• Debt collection agencies;
• Credit information companies;
• Shipping and delivery service companies;
• Call center service providers;
• Our business partners;
• Relevant government regulatory agencies, authorities, or law enforcement agencies;
• Our insurance companies and advisors, including consultants, auditors, and lawyers;
• Data intermediaries; and
• Any other party to whom you authorize us to disclose your Personal Data.

4.2 International Data Transfer

If necessary, Personal Data may be stored or processed outside the territory of Vietnam for various purposes, including supporting international customers, improving services, backup, data storage, enhancing your experience with us, and fulfilling our legitimate business objectives.

We commit to ensuring a level of protection equivalent to or higher than that required by Vietnamese law. Accordingly, you agree to the transfer, storage, and/or processing of your Personal Data outside of Vietnam when necessary for the purposes mentioned above and in accordance with this Policy.

5. Rights and Obligations of the Data Subject

5.1 Rights of the Data Subject

1. Right to be informed: Be informed about the processing of their personal data, unless otherwise provided by law.
2. Right to consent: Give or withhold consent for the processing of their personal data, except for cases specified in Article 17 of Decree 13/2023/ND-CP.
3. Right of access: Access to view, correct, or request correction of their personal data, unless otherwise provided by law.
4. Right to withdraw consent: Withdraw their consent, unless otherwise provided by law.
5. Right to delete data: Delete or request the deletion of their personal data, unless otherwise provided by law.
6. Right to restrict data processing:
   • Request restriction of processing, unless otherwise provided by law.
   • Restriction shall be implemented within 72 hours of the request.
7. Right to data provision: Request the Personal Data Controller or Personal Data Controller-cum-Processor to provide their personal data to them.
8. Right to object to data processing: Object to processing to prevent or restrict disclosure or use for advertising/marketing purposes. Requests shall be implemented within 72 hours.
9. Right to complain, denounce, or sue: As per the provisions of the law.
10. Right to claim damages: Claim compensation for damages when violations of personal data protection regulations occur.
11. Right to self-protection: Protect themselves according to the Civil Code and relevant laws.

5.2 Obligations of the Data Subject

1. Protect their own personal data; request relevant organizations and individuals to protect their personal data.
2. Respect and protect the personal data of others.
3. Provide full and accurate personal data when consenting to its processing.
4. Participate in disseminating personal data protection skills.
5. Comply with legal regulations on personal data protection and participate in preventing violations.

6. Data Security and Safety

We apply appropriate technical and organizational measures to protect Personal Data against the risk of unauthorized access, use, or disclosure. However, no system is absolutely secure when transmitting data over the Internet.

7. Data Storage and Deletion Duration

Personal Data will be stored:

• For the time necessary for the processing purpose;
• As required by law;
• Thereafter, it will be deleted or anonymized in accordance with regulations or at the request of the data subject.

8. Cookies and Website

We collect website activity data (such as number of visits, pages viewed, time and duration of access) through server logs and cookies on an aggregated, anonymous basis, not linked to Personal Data. The website does not automatically collect Personal Data unless you actively provide it or register via a contact form.

9. Contact

For any inquiries or requests related to Personal Data, please contact: Personal Data Protection Department SIK Vietnam Co., Ltd. Lot A7–8, Japan–Hai Phong Industrial Zone Hong An Ward, Hai Phong City, Vietnam Email: xuan.adm@sikv.com.vn

10. Policy Updates

This Policy may be amended from time to time. The updated version will be officially published on the company's information channels.