Personal Data Processing Regulation

3.2. Sensitive Personal Data, including:

(i) Data reflecting behavior and activities in the use of telecommunications services, social networks, online communications services, and other services in cyberspace;
(ii) Other Personal Data that is required by law to be kept confidential or subject to enhanced security measures.

ARTICLE 4: METHODS OF COLLECTION AND PROCESSING OF PERSONAL DATA

The Personal Data of Website Users may be collected and processed by the Company through the following methods:

4.1. The Company may collect and process Personal Data directly or indirectly through information request forms available on the Company’s Website and through activities tracking Website Users’ behavior on the Internet.

4.2. Personal Data of Website Users may be processed in the form of electronic data messages.

4.3. The processing and/or transfer of Website Users’ Personal Data to domestic or foreign authorities, organizations, or individuals shall be carried out lawfully for purposes consistent with these Regulations or as otherwise determined by the Company from time to time.

ARTICLE 5: STORAGE OF PERSONAL DATA

5.1. Personal Data of Website Users, once collected, shall be stored by the Company on cloud platforms provided by third-party storage service providers engaged by the Company and/or on the Company’s servers and internal network systems and/or at any other location as required by law and depending on the Company’s operational scale and business conditions from time to time.

5.2. The Company undertakes to implement all necessary data protection measures under Article 9 below to ensure the security of Website Users’ Personal Data.

5.3. The period of Personal Data processing begins from the date on which the Website User agrees to provide and consents to the processing of his/her Personal Data.

5.4. Website Users’ Personal Data shall be retained for the period necessary to fulfill the purposes specified in Article 6 of these Regulations (the “Retention Period”).

5.5. The retention of Website Users’ Personal Data shall terminate when: (i) the purposes set out in Article 6 have been fulfilled; and/or (ii) the Personal Data has been destroyed or processing has been terminated pursuant to an agreement; and/or (iii) as otherwise required by law, except where a longer retention period is permitted or required under applicable laws from time to time.

ARTICLE 6:PURPOSES OF PERSONAL DATA PROCESSING

6.1. The Company uses and processes Website Users’ Personal Data for the performance of agreements in the relationship between the Company and Website Users and for activities related to the management and operation of the Company in compliance with applicable laws, including but not limited to:

(i) Relationship management and communication with prospective customers;
(ii) Receiving and handling requests and feedback;
(iii) Fulfilling legal obligations as required by law; and
(iv) Other purposes not contrary to applicable laws and subject to the Website User’s written consent.

ARTICLE 7: PERSONAL DATA PROCESSING

7.1. Personal Data may be processed by the Company through the following methods:

(i) The Company may process Personal Data itself or authorize a personal data processor through agreements or contracts (the“Personal Data Processor”) to process Website Users’ Personal Data in accordance with the purposes and scope set out in these Regulations or other documents applicable to Website Users from time to time, which permit the Company and/or the Personal Data Processor to carry out such processing;
(ii) The processing of Website Users’ Personal Data may be conducted in the form of electronic data messages;
(iii) The transfer of Website Users’ Personal Data to domestic or foreign authorities, organizations, or individuals, if any, shall be conducted in accordance with the purposes and provisions of these Regulations, Vietnamese law, or other relevant documents accepted by Website Users under the processing methods stipulated herein; and
(iv) Other processing methods as determined by the Company, provided that such methods do not violate applicable laws.

7.2. The Company applies technical measures and appropriate protection and security safeguards during the processing of Personal Data, including protection against violations of Personal Data protection regulations and measures to prevent loss, destruction, or damage caused by incidents.

Unfortunately, no data transmission over the Internet can be guaranteed to be completely secure. Therefore, although the Company makes its best efforts to protect Website Users’ Personal Data in accordance with applicable laws by implementing all necessary technical and legal measures, the Company cannot guarantee or warrant the security of any information transmitted to the Company by Website Users or from the Company’s internal systems.

ARTICLE 8: RIGHT AND OBLIGATIONS OF WEBSITE USERS

8.1. In terms of the Personal Data, the Employee, Candidate, Individual contractor, Other Individuals have the following rights:

(i) The Right To Know

Upon entering into this Policy, the Website Users have the right to know information regarding the processing activities of his/her Personal Data, unless otherwise provided by law.

(ii) The Right To Consent

The Website Users have the right to consent or refuse to allow the Company to process his/her Personal Data, except as provided in Article 10.2 hereof, and otherwise provided for by law.

For the avoidance of doubt, the Web User’s consent shall be evidenced by actively checking the consent box on the website (which is not pre-ticked) prior to allowing the Company to process their Personal Data.

(iii) Quyền xem, chỉnh sửa hoặc yêu cầu chỉnh sửa Dữ liệu Cá nhân

Unless otherwise provided by law, Website Users shall have the right to access, rectify, or request the rectification of their Personal Data to ensure the accuracy of such Personal Data after it has been collected by the Company based on their consent. Where direct rectification is not possible due to technical or other reasons, Website Users may request the Company’s assistance in rectifying their Personal Data.

Requests to access, rectify, or request the rectification of Personal Data must be submitted in writing by Website Users in their capacity as Data Subjects, using the form issued by the Company, duly signed by the relevant Data Subject, and sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise required by law. In such case, the request relating to the access, rectification, or requested rectification of the Personal Data of the Employee, Candidate, or Individual Contractor shall form an integral part of the Personal Data Processing Agreement entered into with the Company.

Upon receipt of an access, rectification, or rectification request from an Employee, Candidate, or Individual Contractor, the Company shall acknowledge and respond to such request via email within two (2) working days and shall implement the request as soon as reasonably practicable, but no later than ten (10) days, or fifteen (15) days where the involvement of a Personal Data Processor or another third party is required, from the date of receipt of the request or as otherwise prescribed by applicable law.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to ten (10) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable.

(iv) The Right to withdraw consent

Website Users shall have the right to withdraw their consent to the processing of their Personal Data where they have concerns regarding the scope of processing, the purposes for which their Personal Data is processed, or the accuracy of such Personal Data.

Website Users, in their capacity as Data Subjects, shall have the right to withdraw their consent to the processing of their Personal Data by submitting to the Company a written notice, in the form prescribed by the Company and duly signed by the relevant Data Subject, which shall be sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise required by applicable law. In such case, the notice recording the Employee’s, Candidate’s, or Individual Contractor’s request to withdraw consent shall form an integral part of the Personal Data Processing Agreement entered into with the Company.

Upon receipt of a valid notice of withdrawal of consent in accordance with these Regulations, the Company shall acknowledge and respond to the Website Users via email within two (2) working days and shall process such request within fifteen (15) days, or within twenty (20) days where the involvement of a Personal Data Processor or a third party is required, from the date of receipt of the aforesaid notice, except with respect to Personal Data specified in Article 10.2 of these Regulations or where otherwise provided by applicable law.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to fifteen (15) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable. The withdrawal of consent shall not affect the lawfulness of any processing of Personal Data carried out on the basis of consent prior to such withdrawal.

(v) The Right to Data Deletion

The Website Users shall be entitled to request the Company to delete his/her Personal Data in the following cases:

(a) The Website User requests the deletion of their Personal Data and acknowledges and accepts any losses, damages, costs, or expenses that may arise from or be incurred as a result of such deletion request;
(b) The purposes for processing the Personal Data as set out in Article 6 of these Regulations have been fulfilled;
(c) The statutory retention period for the Personal Data has expired;
(d) The deletion is carried out pursuant to a decision of a competent state authority;
(e) The deletion is carried out pursuant to an agreement between the Website User and the Company;
(f) The Personal Data is required to be deleted in accordance with applicable law.

The deletion of Personal Data shall not apply in the circumstances set out in Article 10.2 of this Regulation and/or where such deletion would result in a violation of the principles governing the exercise of rights and performance of obligations by Website Users under Article 8.3 of this Regulation.

Website Users, in their capacity as Data Subjects, shall have the right to request the deletion of their Personal Data by submitting to the Company a written notice, in the form prescribed by the Company and duly signed by the relevant Data Subject, which shall be sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise required by applicable law. In such case, the notice recording the Employee’s, Candidate’s, or Individual Contractor’s request for deletion of Personal Data shall form an integral part of the Personal Data Processing Agreement entered into with the Company.

Upon receipt of a valid notice requesting the deletion of Personal Data in accordance with this Regulation, the Company shall acknowledge and respond to the Employee, Candidate, or Individual Contractor via email within two (2) working days and shall implement the request within twenty (20) days, or within thirty (30) days where the involvement of a Personal Data Processor or a third party is required, from the date of receipt of such notice.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to twenty (20) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable.

(vi) The Right to Restrict Personal Data Processing

Website Users shall have the right to request the restriction of the processing of their Personal Data where they have concerns regarding the scope of processing, the purposes for which their Personal Data is processed, or the accuracy of such Personal Data, unless otherwise provided by applicable law.

Website Users acknowledge and understand that the processing of Personal Data is a complex process involving multiple activities of the Company and may affect third parties. Therefore, any restriction on the processing of Personal Data must be implemented by the Company with due care to ensure: (i) the lawful rights and interests of Website Users under the Personal Data Processing Agreement, this Regulation and those of other relevant parties; (ii) compliance with applicable laws and requirements of competent authorities; and (iii) the continuous, safe, and stable operation of the Company. Accordingly, Website Users agree that any request for restriction of the processing of Personal Data must clearly and specifically state the scope of the restriction, the proposed duration of such restriction, and the reasonable grounds on which the request is based.

Website Users, in their capacity as Data Subjects, may request the restriction of the processing of their Personal Data by submitting to the Company a written notice, in the form prescribed by the Company and duly signed by the relevant Data Subject, which shall be sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise required by applicable law. In such case, the notice recording the request for restriction of the processing of Personal Data shall form an integral part of the Personal Data Processing Agreement entered into with the Company. Restricting the processing of Personal Data shall not affect the lawfulness of any processing activities carried out prior to such restriction.

Upon receipt of a valid notice requesting the restriction of the processing of Personal Data in accordance with this Regulation, the Company shall acknowledge and respond to the Employee, Candidate, or Individual Contractor via email within two (2) working days and shall implement the request within fifteen (15) days, or within twenty (20) days where the involvement of a Personal Data Processor or a third party is required, from the date of receipt of such notice, except with respect to Personal Data specified in Article 10.2 of this Regulation or where otherwise provided by applicable law.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to fifteen (15) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable.

(vii) The Right to data provision

The Employee, Candidate, Individual contractor have the right to request the Company to provide his/her Personal Data for legitimate personal purposes, except as provided by law;

Upon receipt of a valid written request to provide Personal Data, the Company shall notify the Employee, Candidate, Individual contractor of (i) the term, location, and form of Personal Data provision; (ii) costs for printing, photocopying, and delivery by post and fax (if any); and (iii) the method and term of payment of such costs; and

Requests for the Provision of Personal Data must be submitted by Website Users, in their capacity as Data Subjects, in writing using the form prescribed by the Company, duly signed by the relevant Data Subject, and sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise provided by applicable law. In such case, the request recording the Employee’s, Candidate’s, or Individual Contractor’s request for the provision of Personal Data shall form an integral part of the Personal Data Processing Agreement entered into with the Company.

Upon receipt of a request for the provision of Personal Data from an Employee, Candidate, or Individual Contractor, the Company shall acknowledge and respond to such request via email within two (2) working days and shall comply with the request as soon as reasonably practicable, but no later than ten (10) days, or fifteen (15) days where the involvement of a Personal Data Processor or a third party is required, from the date of receipt of the request or as otherwise prescribed by applicable law.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to ten (10) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable.

(viii) The Right To Object To Processing Of Personal Data

Website Users shall have the right to object to the processing of their Personal Data.

Website Users, in their capacity as Data Subjects, may exercise their right to object to the processing of their Personal Data by submitting to the Company a written notice, in the form prescribed by the Company and duly signed by the relevant Data Subject, which shall be sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise provided by applicable law. In such case, the notice recording the Employee’s, Candidate’s, or Individual Contractor’s objection to the processing of Personal Data shall form an integral part of the Personal Data Processing Agreement entered into with the Company.

Upon receipt of a valid notice of objection to the processing of Personal Data in accordance with this Regulation, the Company shall respond within two (2) working days and shall process the request within fifteen (15) days, or within twenty (20) days where the involvement of a Personal Data Processor or a third party is required, from the date of receipt of such notice, except with respect to Personal Data specified in Article 10.2 of this Regulation or where otherwise provided by applicable law.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to fifteen (15) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable.

(ix) The Right To Complain, Denounce, And Initiate Lawsuits

The Employee, Candidate, Individual contractor shall be entitled to file complaints or denunciations or initiate lawsuits in accordance with the provisions of the law.

(x) The Right To Claim Compensation

Website Users shall have the right to claim compensation for actual damages in accordance with applicable law where a violation of the regulations on the protection of their Personal Data occurs due to the fault of the Company, unless otherwise agreed by the parties or provided by applicable law.

(xi) Right to Request the Implementation of Measures and Solutions for the Protection of Personal Data in Accordance with Applicable Law

Website Users shall have the right to request the Company to implement measures and solutions for the protection of their Personal Data in accordance with applicable law.

Website Users, in their capacity as Data Subjects, may request the Company to implement measures and solutions for the protection of their Personal Data by submitting to the Company a written notice, in the form prescribed by the Company and duly signed by the relevant Data Subject, which shall be sent to the Company’s Personal Data Protection Department via email at vietnam_dpo@greenyellow.com, unless otherwise provided by applicable law. In such case, the notice recording the request for the implementation of measures and solutions for the protection of Personal Data shall form an integral part of the Personal Data Processing Agreement entered into with the Company.

Upon receipt of a valid notice requesting the implementation of measures and solutions for the protection of Personal Data in accordance with this Regulation, the Company shall respond within two (2) working days and shall implement the requested measures and solutions within fifteen (15) days from the date of receipt of such notice.

Where a request is of such nature or complexity that additional processing time is required, the Company may extend the processing period once for up to fifteen (15) additional days and shall notify the Employee, Candidate, or Individual Contractor of the reasons for such extension. The Company shall be responsible for demonstrating that such extension is necessary and reasonable.

In the case that the Employee, Candidate, Individual contractor exercise the aforementioned rights, including but not limited to refusing to accept the terms, withdrawing consent, or any request or activity that restricts the processing of his/her Personal Data, such requests or activities may, as the case may be, make the payment of salaries, bonuses or benefits to the Employee, Candidate, Individual contractor, use of site features on the Company’s electronic devices, applications or devices or other related rights of the Employee, Candidate, Individual contractor affected, interrupted, limited, restrict, suspend, cancel, prevent, or prohibit. The Employee, Candidate, Individual contractor agree that the Company shall not be liable to him/her for any loss or damage incurred in connection with such limitation, restriction, suspension, cancellation, suppression, or prohibition.

The Company shall, by reasonable endeavors, comply with a lawful and valid request from an Employee, Candidate, Individual contractor, Other Individuals within the time required by law. For the avoidance of doubt, the Company reserves the right to refuse to comply with the Employee, Candidate, Individual contractor, Other Individuals’s requests in certain circumstances, including but not limited to: (i) The Employee, Candidate, Individual contractor, Other Individuals fail to comply with the order and procedures instructed by the Company; (ii) The Employee, Candidate, Individual contractor, Other Individuals fail to provide or provides insufficient documents to verify the revised information; or (iii) where the Company assesses signs of fraud or breach of the Employee, Candidate, Individual contractor, Other Individuals’s Personal Data protection; or (iv) The provisions of law do not permit the fulfillment of the Employee, Candidate, Individual contractor’s request. In such cases, the Company reserves its lawful rights and remedies. Accordingly, the Company shall not be liable to the Employee, Candidate, Individual contractor for any loss incurred, and the lawful rights of the Company shall be expressly reserved to limit, restrict, suspend, cancel, or prevent such Personal Data.

To exercise their rights as Personal Data Subjects, Webite Users shall follow Procedures for exercising data subject rights and the Data Subject Rights Request Form.

8.2. In terms of the Personal Data, the Website Users have the following obligations:

(i) To self-protect his/her Personal Data and request other relevant organizations, and individuals to protect his/her Personal Data in accordance with the applicable laws;

(ii) To respect, protect, and refrain from intruding, unlawfully using the Personal Data of others;

(iii) To cooperate and provide full, accurate Personal Data to the Company when consenting to allow the processing of his/her Personal Data or as required by law.

(iv) To comply with the provisions of the law on the protection of Personal Data and participate in preventing and combating violations of Policies on Personal Data protection.

8.3. Website Users, in exercising their rights and performing their obligations under this Regulation, shall fully comply with the following principles:

(i) To act in accordance with applicable law and comply with the obligations of Website Users, in their capacity as Data Subjects, under this Regulation. The exercise of rights and performance of obligations by Website Users as Data Subjects shall be for the purpose of protecting their own lawful rights and interests;

(ii) Not to cause difficulties for, obstruct, or interfere with the exercise of the lawful rights and obligations of the Company or any Personal Data Processor;

(iii) Not to infringe upon the lawful rights and interests of the State, the Company, or any other agencies, organizations, or individuals.

ARTICLE 9: PERSONAL DATA PROTECTION

9.1. The Company undertakes that, by its highest reasonable resources and efforts, the processing and protection of the Website User’s Personal Data shall, at all times, be given the highest priority by the Company, in order to ensure the highest safety, confidentiality, and the Website User’s legitimate rights as required by law.

9.2. Both Parties hereby agree that the Internet system, electronic information networks, and information technology environment shall not be a secure environment, whereby, the transmission and sharing of the Employee, Candidate, Individual contractor’s Personal Data may have potential risks, so the Employee, Candidate, Individual contractor agrees that the Company shall not guarantee that the Employee, Candidate, Individual contractor’s Personal Data shall be secured at all times.

9.3. In order to protect Personal Data, the Company shall implement the following measures to prevent and minimize possible risks, including but not limited to:

(i) To carry out impact assessments on the processing of Personal Data in accordance with the law and to complete other administrative procedures as required by applicable law;
(ii) To implement appropriate technical, managerial, and security measures within the Company to protect Personal Data, and to periodically review, inspect, and update such measures as necessary;
(iii) To designate a department or personnel with appropriate qualifications and capabilities for Personal Data protection, or engage organizations or individuals providing Personal Data protection services in accordance with applicable law;
(iv) To organize propaganda and training for Employees, Candidates, Individual contractors and managers in the Company responsible for processing and applying necessary measures to protect Personal Data;
(v) To only establish contractual relationships with personal data processing third parties that have security infrastructure, systems, and personal data protection commitments in accordance with Policies and standards of law. The Company shall transfer Personal Data to Personal Data Processors only within the permitted scope of processing and for purposes consistent with this Regulation;
(vi) To commit not to exchange, or rent the Employee, Candidate, Individual contractor’s Personal Data without his/her consent, or sell the Employee, Candidate, Individual contractor’s Personal Data in any form;
(vii) To strictly comply with the application of Personal Data protection, và
(viii) The Company shall, by all reasonable and necessary endeavors, conduct an assessment of the possible consequences and by itself or request the Third Party to provide the data protection services contracted by the Company to handle and remedy the problems and consequences as quickly as possible.

ARTICLE 10: RIGHTS OF THE COMPANY

10.1. Rights that require the Website User’s consent

The Company shall be entitled to carry out the processing of the Website User’s Personal Data from the time of validity obtaining the Website User’s information and it must obtain the Website User’s written consent to the processing thereof, except for the case specified in Article 10.2 hereof, and as required by law.

10.2. Rights without the Website User’s consent

The Company shall be entitled to process Website User’s Personal Data without his/her consent in the following cases:

(i) For the purpose of protecting the life, health, honor, dignity, rights, and lawful interests of Website Users in their capacity as Data Subjects, or of other individuals in emergency situations; and where necessary to protect the lawful rights or interests of other persons, the State, or the Company against acts infringing upon such rights or interests;
(ii) For the purpose of addressing emergency situations; responding to threats to national security that have not yet reached the level requiring the declaration of a state of emergency; preventing and combating riots, terrorism, crimes, and violations of law;
(iii) For the purpose of serving the operations of state authorities and state management activities in accordance with applicable law;
(iv) For the performance of agreements between Website Users and the Company and/or with relevant agencies, organizations, or individuals in accordance with applicable law;
(v) In any other circumstances as provided by applicable law.

ARTICLE 11: PROVISION OF PERSONAL DATA TO THIRD PARTIES

The Company shall be entitled to process and provide the Website User’s Personal Data to banks, medical facilities, partners, organizations, and other agencies including foreign government agencies (if any) for the purposes set out in Article 6 hereof, including but not limited to the Company’s branches, representative offices, employees; member companies, affiliated companies, subsidiaries/parent companies, organizations, partners related to or having a cooperative relationship with the Company; organizations, partners, contractors/subcontractors to support and provide services to the Company; auditing organizations, or individuals, agencies or entities to which the Company must provide information in accordance with (i) legal obligations, or (ii) provisions of law, or (iii) requests of regulatory agencies or authorities, provided that such disclosure of Personal Data is lawful.

ARTICLE 12: VIOLATIONS AND HANDLING OF VIOLATION

12.1. If any person is in violation of any obligations on protection of the Website User’s Personal Data set forth herein, such violation shall be deemed a violation of the Policies on personal data protection, and he/she shall be handled in accordance with the Labor Code, the applicable Policies on processing and protection of Personal Data.

12.2. The person who commits the violation shall pay monetary compensation for actual damages, costs, losses, and legal proceedings costs (including but not limited to attorney fees) incurred by the Company as a result of such person’s violation.

ARTICLE 13: ENFORCEMENT PROVISIONS

13.1. The Company’s General Director shall be liable for performing and organizing the implementation of this Policy throughout the Company.

13.2. This Regulation shall be provided to Website Users at the time of execution of the Personal Data Processing Agreement, and to Customers prior to the execution of any contract or agreement. This Regulation shall also be disseminated and publicly disclosed in accordance with the Company’s internal regulations and in compliance with the applicable laws on Personal Data protection.

ARTICLE 14: GENERAL PROVISIONS

14.1. This Policy consists of fourteen (14) Articles, and takes effect from 01/07/2026.

14.2. The Company shall be entitled to amend, update, or modify the terms of this Policy, and General Conditions on the protection of Personal Data from time to time.

14.3. Notification of any amendments, updates, or modifications shall be updated, posted on the Company’s internal information page, and/or shall be notified to the entire the Website User by other means as the Company deems appropriate.

14.4. All members of the Board of Directors, personnel and employees of the Company shall be obliged to strictly comply with this Policy.