Privacy Policy (Personal Data Protection Policy)

This Personal Data Protection Policy (hereinafter referred to as the “Policy”) describes how personal data arising in the course of the operations and business activities of Vinpearl Joint Stock Company (hereinafter referred to as the “Company”), addressed at Hon Tre Island, Nha Trang Ward, Khanh Hoa City, Viet Nam, whose official website is https://vinpearl.com/vi, is processed. The Company processes personal data in the capacity of a Personal Data Controller or a Personal Data Controller and Processor in accordance with applicable laws and regulations.

The processed personal data is your personal data (and you are hereinafter referred to as the “Data Subject”) when you interact or establish a relationship with the Company in various roles, such as a customer, consumer, employee, job applicant, contact person of a partner, shareholder, or any other individual whose personal data is collected and processed by the Company. For further information regarding the processing of your personal data, please refer to the relevant provisions of this Policy corresponding to your specific role in your relationship with the Company.

This Policy is issued to ensure that personal data processing is conducted transparently, in a controlled manner, and in compliance with applicable laws and regulations, while enabling the Data Subject to clearly understand their rights and the privacy protection mechanisms in their relationship with the Company.

This Policy also serves as the Company’s Consumer Information Protection Rules, demonstrating the Company’s commitment to:

-Respecting the privacy and personal information of the Data Subject;

-Protecting personal information from unauthorized access, use, or disclosure;

-Building a safe, transparent, and trustworthy environment for transacting, living, and experiencing products and services.

The Company may update or amend this Policy from time to time to ensure compliance with applicable laws and regulations and its actual business operations. Updated versions will be published through the Company’s official channels.

1.DEFINITIONS

1.1.“Customer”: includes all individual customers; representatives or contact persons of customers that are organizations which have entered into and performed agreements with the Company; individuals who are researching and considering the use of the Company’s products and services; walk-in customers or individuals participating in events introducing the Company’s products and services, or participating in community activities; and users of the Company’s websites, applications, and digital platforms. This definition also includes consumers as prescribed by applicable laws on the protection of consumers’ rights.

1.2.“Personnel”: means individuals who currently have or have previously had an employment relationship with the Company, including but not limited to members of the Company’s leadership, managers, employees, job applicants, interns, and collaborators.

1.3.“Contact Person”: means an individual who is currently or was previously appointed, authorized, or actually assigned by a Partner to represent such Partner in contacting, exchanging information, conducting transactions, or coordinating work with the Company.

1.4.“Shareholder”: means any individual holding at least one share of the Company.

1.5.“Internal Person”: means an individual holding an important position in the Company’s corporate governance and management structure, as determined in accordance with applicable laws from time to time.

1.6.“Relevant Person”: means an individual who has a direct or indirect relationship with the Company, as determined in accordance with applicable laws from time to time.

1.7.“Consumer”: means an individual who purchases or uses products, goods, or services for personal, family, or household consumption, or for the internal use of an agency or organization, and not for commercial purposes.

1.8.“Partner”: means organizations or individuals working with the Company for the purposes of cooperation, providing products and services, or supporting the Company’s business operations. Individual Partners include, but are not limited to, individual contractors, consultants, and personnel provided to the Company by third parties.

1.9.“Personal Data”: means digital data or information in other forms that identifies or helps identify a specific individual, including Basic Personal Data and Sensitive Personal Data. Personal Data that has been de-identified is no longer considered Personal Data.

1.10.“Basic Personal Data”: means personal data reflecting common identity and background information, regularly used in transactions and social relationships, as specified in the list promulgated by the Government.

1.11.“Sensitive Personal Data”: means personal data associated with an individual’s privacy, the infringement of which may directly affect the lawful rights and interests of agencies, organizations, or individuals, as specified in the list promulgated by the Government.

1.12.“Data Subject”: means the individual to whom the Personal Data relates.

1.13.“Personal Data Processing” or “Processing”: means any operation or set of operations performed on Personal Data, including but not limited to collection, analysis, aggregation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer, or other activities affecting Personal Data.

1.14.“Personal Data Controller”: means any organization or individual that determines the purposes and means of Personal Data Processing.

1.15.“Personal Data Processor”: means any organization or individual that processes Personal Data on behalf of the Company based on an agreement with the Company.

1.16.“Applicable Laws”: means all Vietnamese laws, decrees, circulars, and other regulatory guiding documents governing or relating to the protection of Personal Data and other data-related obligations, as amended from time to time.

1.17.“Personal Data Protection Policy” (or “Policy”): means the entire content of this Policy, comprising 14 sections.

2.COMMITMENT TO PERSONAL DATA PROTECTION

The Company undertakes NOT to buy or sell Personal Data and shall comply with the following principles when conducting Personal Data Processing:

-Fully comply with all contracts, agreements, and other documents established with the Data Subject.

-Process Personal Data only for specific, clear, and lawful purposes as set out in this Policy and in compliance with Applicable Laws.

-Always apply and regularly update appropriate technical, organizational, physical, and operational security measures in accordance with Applicable Laws to safeguard Personal Data against security incidents, unauthorized access, or unauthorized use, alteration, disclosure, destruction, loss, or damage.

-Retain Personal Data appropriately and only for as long as necessary to fulfill the processing purposes in compliance with Applicable Laws.

3.SCOPE OF APPLICATION

This Policy applies to all Data Subjects of the Company, including:

-Customers;

-Personnel of the Company;

-Contact Persons; and

-Shareholders, Internal Persons, and Relevant Persons of the Company.

4.TYPES OF PERSONAL DATA COLLECTED AND PURPOSES OF PROCESSING

4.1.For Customers

For Customers

4.2.For Personnel, including candidates

For Personnel

4.3.For Contact Persons of Partners and individual Partners

For Partners

4.4.For Shareholders and Internal Persons (including Relevant Persons)

For Shareholders

5.SHARING AND TRANSFER OF PERSONAL DATA

5.1.General principles

When sharing or transferring Personal Data to third parties, the Company undertakes to:

-Share Personal Data only to the extent necessary and appropriate for the Personal Data Processing purposes specified for each category of Data Subject; and

-Require recipients to implement appropriate data security and protection measures.

5.2.Data Recipients

Depending on each category of Data Subject and the specific purposes and activities of Personal Data Processing, the Company may share, provide, or transfer Personal Data to the following recipients:

Data Recipients

Purpose of Sharing

Parent company, subsidiaries, and affiliates of the Company

To share and transfer Personal Data to the extent necessary and appropriate for the Personal Data Processing purposes and activities specified in this Policy.

Service providers and operational partners

Service providers may include:

•Public utilities, maintenance, repair, and upgrade services;

•Information technology services, digital platforms, and management systems (including sales, brokerage, human resources, shareholder, and contract management systems);

•Payment and transaction processing services;

•Payroll, tax, insurance, benefits, and other human resources administrative services;

•Data storage, database management, and database operations;

•Recruitment, assessment, training, and personnel development services;

•Operational support, brokerage management, and sales system services;

•Contract management and information exchange with Partners;

•Legal, financial, auditing, corporate governance, and other professional advisory services.

The Company may share or transfer Personal Data to service providers and operational partners to perform Personal Data Processing activities on behalf of the Company. These parties are permitted to Process Personal Data solely within the scope and for the purposes designated by the Company, and must strictly comply with all confidentiality and information security requirements under their respective agreements with the Company and Applicable Laws.

Media and advertising partners

To perform communication and product promotional activities, the Company may coordinate and share Personal Data with media and advertising partners, provided that:

•Such sharing is consistent with the notified purposes of processing;

•Applicable laws and regulations governing advertising are strictly complied with;

•The explicit consent of the Data Subject is obtained where required by law.

The Company does not share the contact information of Customers with third parties for independent marketing purposes without an appropriate and legal basis.

Relevant parties in corporate restructuring or reorganization, such as division, separation, merger, or consolidation

In the event that the Company participates in or is involved in corporate restructuring or reorganization, such as division, separation, merger, or consolidation, Personal Data may be disclosed or transferred as part of such transaction, provided that the recipient of such data continues to comply with all Personal Data protection and security requirements under Applicable Laws and this Policy.

Relevant parties for compliance with legal obligations and the protection of the lawful rights and interests of the Company and the Data Subject outside of contractual obligations

The Company may provide Personal Data to competent state authorities, legal advisors, or other relevant parties where necessary to:

•Comply with Applicable Laws or lawful requests from competent authorities;

•Establish, exercise, or protect the lawful rights and interests of the Company;

•Prevent, detect, investigate, and handle fraud or other legal violations;

•Protect the life, health, safety, rights, and lawful interests of the Data Subject or other individuals and organizations.

Entities engaged in research and development of blockchain technology, metaverse, artificial intelligence, and other automated systems

The Company may provide, share, or transfer Personal Data for the research and development of technological products and services, including blockchain technology, the metaverse, artificial intelligence, and other automated systems, subject to full compliance with Applicable Laws.

Third parties upon the request or consent of the Data Subject

The Company may share Personal Data with third parties in accordance with the explicit consent or instruction of the Data Subject.

Any transfer of Personal Data in accordance with this Policy and Applicable Laws, regardless of whether a fee is charged, shall not be construed as the purchase or sale of Personal Data.

6.PROCESSING OF PERSONAL DATA IN SCIENTIFIC AND TECHNOLOGICAL ACTIVITIES

6.1.Transfer of Personal Data for scientific and technological development

Subject to a valid legal basis and in strict compliance with Applicable Laws, the Company may transfer Personal Data to its parent company, subsidiaries, affiliates, and technology partners for the purposes of scientific and technological development and innovation, including:

-Research and development (R&D) of financial technology (Fintech) products and services;

-Processing of Big Data;

-Development and operation of blockchain technology, metaverse systems, and cloud computing;

-Cybersecurity technologies; and

-Development and application of technologies utilizing machine learning algorithms, artificial intelligence (AI) systems, and other automated systems.

6.2.Compliance requirements for data transfer and processing in technological environments

All activities involving the transfer and Processing of Personal Data in Big Data, artificial intelligence, blockchain, metaverse, and cloud computing environments shall be conducted solely for the specified purposes, limited to the necessary scope, and in strict compliance with Applicable Laws. The Company shall only Process Personal Data upon ensuring compliance with the following requirements:

-The Processing is consistent with the purposes notified to the Data Subject and is supported by a valid legal basis. Where Applicable Laws require the Data Subject’s consent for the transfer or Processing of Personal Data for artificial intelligence or automated systems, the Company shall obtain such consent;

-Continuous monitoring, inspections, and periodic assessments of cybersecurity and data security are actively conducted;

-A risk-based classification of Processing activities involving artificial intelligence is performed; the Data Subject is notified of automated Processing activities, provided with explanations regarding the underlying algorithmic principles, and granted the right to opt out;

-All Data Recipients are bound by data transfer or data processing agreements that impose strict confidentiality obligations and restrict Processing solely to the scope and purposes designated by the Company; and

-Personal Data is not used to develop or operate systems that cause harm to national defense, national security, or social order and safety, or that infringe upon the lawful rights and interests of any third party.

7.DATA RETENTION PERIOD

7.1.The Company shall retain Data Subjects’ Personal Data only for the period necessary to fulfill the processing purposes specified in this Personal Data Protection Policy or as required by applicable laws.

7.2.Upon the completion of the Personal Data Processing purposes or when the Personal Data is no longer required for the notified purposes, the Company shall promptly delete, destroy, or de-identify such Personal Data, except where Applicable Laws permit or require continued retention for a specific period.

The Company may be required to retain Personal Data even after the termination of contracts or agreements between the parties in order to fulfill its statutory obligations under Applicable Laws and/or requests from competent state authorities.

7.3.Where Applicable Laws require the deletion or destruction of Personal Data, the Company shall promptly perform such deletion or destruction in accordance with applicable regulations, and shall implement all necessary measures to ensure that the Personal Data can no longer be accessed, recovered, or used without authorization.

7.4.The Company commits to ensuring that the retention, deletion, and destruction of Personal Data are always carried out with due care, securely, and in full compliance with Applicable Laws, with the primary objective of safeguarding the lawful rights and interests of both the Data Subject and the Company.

8.PERSONAL DATA PROTECTION MEASURES

8.1.To ensure the optimal protection of Customer information, the Company has implemented and continues to enforce the following specific measures:

8.1.1.Technical measures to prevent unauthorized access to or unauthorized use of Personal Data. The Company regularly collaborates with cybersecurity experts to stay updated on the latest security techniques and ensure data safety. All new software systems or major updates must undergo a rigorous security assessment and penetration testing (Pentest) process before being deployed into actual operation.

8.1.2.Organizational measures, including establishing internal regulations on Personal Data protection, implementing third-party risk management procedures, appointing dedicated personal data protection personnel, and establishing a compliance monitoring function. The Company conducts regular and ad-hoc compliance audits and inspections to promptly detect and mitigate potential security risks.

8.1.3.Operational measures, including maintaining periodic and daily data control procedures, and implementing robust data backup and disaster recovery plans to ensure that Personal Data is stored and Processed strictly within the committed scope and purposes. The Company has also established cybersecurity incident response procedures and conducts regular security awareness training for its Personnel.

8.1.4.Physical measures, including establishing physical barriers and strict access control systems for information technology infrastructure areas, server rooms, and data storage facilities. The Company strictly safeguards the physical security of its equipment and facilities to prevent any form of unauthorized physical access.

8.2.In addition, where it is necessary to share Personal Data with third parties for the purposes specified in this Policy, the Company requires such third parties to implement equivalent and appropriate data protection measures to ensure that Personal Data remains securely processed.

However, due to the inherent nature of technology and the internet environment, no security measure can guarantee absolute safety. Therefore, while the Company constantly strives to implement appropriate security controls, we cannot absolutely guarantee or warrant that your Personal Data will remain secure under all circumstances.

9.PROTECTION OF THE RIGHTS AND INTERESTS OF VULNERABLE CONSUMERS

9.1.Where a Customer belongs to the group of vulnerable consumers as prescribed by Applicable Laws, the Processing of such Customer’s Personal Data shall be conducted with due care, in an appropriate manner, and with enhanced protective measures to safeguard the Customer’s lawful rights and interests.

9.2.Where necessary to receive and process a Customer’s request, the Company may collect relevant information and documents to verify the Customer’s status as a vulnerable consumer, subject to the following principles:

9.2.1.Such collection shall be strictly limited to the minimum extent necessary;

9.2.2.The collected data shall be used solely for the purpose of receiving and processing the specific request;

9.2.3.Appropriate security measures shall be applied to any Personal Data arising from or related to such activities;

9.2.4.Where the Customer’s rights and interests have been infringed and the Customer requests protection, the receiving officer shall promptly forward the Customer’s request to the competent authority responsible for resolving customer complaints in accordance with the Company’s internal regulations as amended from time to time, ensuring that the Customer receives timely support, service, and a response as soon as practicable;

9.2.5.The Company shall prioritize the direct receipt and processing of requests from Customers who are vulnerable consumers over requests from ordinary Customers.

9.3.Processing of Personal Data of children and individuals who have lost or have limited civil act capacity:

9.3.1.The Company shall only Process Personal Data to the extent necessary to protect the lawful rights, interests, and safety of the aforementioned individuals, including but not limited to:

-Assisting children or vulnerable individuals in accessing and utilizing services, utilities, and amenities;

-Ensuring security, safety, and an appropriate, child-friendly environment for the provision of products and services;

-Fulfilling statutory obligations in accordance with Applicable Laws.

9.3.2.Where Applicable Laws require consent for the Processing of Personal Data, such consent must be granted by the legal representative on behalf of the child or the individual who lacks full civil act capacity, unless otherwise provided by law. For children aged seven (07) years or older, where the Processing is intended to publish or disclose information concerning their private life or personal secrets, the Company shall only proceed with such Processing upon obtaining the prior consent of both the child and their legal representative.

9.4.In the event that the Company refuses to resolve a Customer’s request, the Company shall respond to the Customer in writing, clearly specifying the legal basis and the reasons for which the Customer’s request is deemed inappropriate or ineligible.

10.RIGHTS AND OBLIGATIONS OF THE DATA SUBJECT

10.1.The Data Subject has the following rights in relation to their Personal Data:

10.1.1.The right to be informed of Personal Data Processing activities.

10.1.2.The right to give or withhold consent, and to withdraw or request the withdrawal of consent to the Processing of Personal Data.

10.1.3.The right to access, review, and rectify or request the rectification of their Personal Data.

10.1.4.The right to request the provision, deletion, or restriction of Personal Data Processing, and to object to the Processing of Personal Data.

10.1.5.The right to lodge complaints, denunciations, or initiate legal proceedings, and to claim compensation for damages in accordance with Applicable Laws.

10.1.6.The right to self-protection or to request the implementation of measures and solutions to protect their Personal Data in accordance with Applicable Laws.

10.2.The Data Subject may exercise their rights in relation to their Personal Data by submitting a request to the department in charge of Personal Data protection using the contact details provided in Section 12 hereof, either directly in writing, via email, or through other electronic channels.

10.3.Any request to exercise the rights of the Data Subject must, at a minimum, specify the following:

10.3.1.Information of the Data Subject (such as full name, email address, or telephone number).

10.3.2.The specific right that the Data Subject wishes to exercise and the category of Personal Data related to such request.

10.3.3.The reasons and purposes for exercising such right (if any); and

10.3.4.Supporting information and documents relevant to the verification and fulfillment of the request.

10.4.Upon receipt of a request, the Company shall verify the identity of the requester, as well as the validity, completeness, and accuracy of the request in accordance with Applicable Laws, and assess the feasibility of fulfilling such request. The Company reserves the right to request additional information for verification purposes or to refuse to process the request if:

10.4.1.The Data Subject fails to provide sufficient information to verify their identity and the validity of the request; or

10.4.2.Applicable Laws do not permit or require the Company to fulfill the request; or

10.4.3.There is a specific request or directive from a competent state authority.

10.5.Please note that the aforementioned rights of the Data Subject are not absolute and may be subject to limitations, exemptions, or other statutory requirements under Applicable Laws. In specific circumstances, the Company is entitled to refuse or restrict the fulfillment of such requests in accordance with Applicable Laws.

11.REVISIONS AND UPDATES

11.1.This Policy may be updated, amended, supplemented, or replaced by the Company from time to time, provided that such revisions do not contravene Applicable Laws and/or are aimed at enhancing the protection of the Data Subject’s Personal Data.

11.2.Any update, amendment, supplement, or replacement of this Policy shall be publicly posted by the Company in accordance with Applicable Laws. The Data Subject is encouraged to regularly access and check the website for the latest updates.

12.CONTACT INFORMATION OF THE DEPARTMENT IN CHARGE OF PERSONAL DATA PROTECTION

Should you have any inquiries, complaints, or requests regarding the Company’s Personal Data Processing or protection activities, please contact our department in charge of personal data protection through the contact channels below.

Company: Vinpearl Joint Stock Company

Registered Address: Hon Tre Island, Nha Trang Ward, Khanh Hoa City, Viet Nam

Email: [email protected]

13.NOTICE

This Policy shall be deemed to constitute prior notification to the Data Subject before their Personal Data is Processed by the Company. Accordingly, the Company and any other organizations or individuals involved in the Processing of Personal Data are not required to provide a separate notification to the Data Subject prior to conducting such Processing.

14.EFFECTIVE DATE

This Personal Data Protection Policy shall take effect on and from 29/08/2026 (the “Effective Date”), fully superseding and replacing the Personal Data Protection Policy dated 01/07/2024 and the Consumer Information Protection Rules dated 01/07/2024.