ARTICLE 2: PERSONAL DATA PROTECTION CONTENT

1. The Parties acknowledge and agree as follows: (i) ITS is the personal data processor under the Data Protection Law; (ii) The Provider is the data subject or the data controller or both controller and processor, with respect to the Personal Data under the Data Protection Law; and (iii) Each Party shall comply with its respective obligations under applicable Data Protection Laws relating to the processing of Personal Data.

2. Purpose of data collection and processing:

ITS will collect, store, and process Personal Data as necessary for: executing the Contract signed with the Provider and performing related tasks under that Contract.

The Provider consents to ITS processing the Provider’s data and sharing the processed data for the following purposes:

– Sending notifications regarding communication activities between the Provider and ITS;

– Preventing acts of account theft, impersonation, or malicious attacks against the Provider’s user accounts;

– Organizing trade promotion, market research, public opinion surveys, and brokerage activities;

– Researching and developing new services and offering appropriate products and services to the Provider;

– Using the Provider’s information for marketing services and product advertising purposes;

– Verifying identity and ensuring the confidentiality and security of the Provider’s information;

– Collecting, storing, and using the Provider’s personal data to provide services such as record keeping and fulfilling legal and tax compliance obligations. ITS will retain such data for the period prescribed by law;

– Performing other actions as required by law from time to time.

ITS will not: (a) Process, store, use, or disclose Personal Data except as necessary to fulfill contractual obligations or as required by law; (b) Sell Personal Data to any third party; (c) Retain, use, or disclose such Personal Data outside the direct business relationship between ITS and the Provider, unless it is pursuant to the data subject’s instructions or legal requirements.

For clarity, the Provider’s instructions regarding Personal Data processing must align with the terms of the Contract and comply with all Data Protection Laws. The Provider is responsible for the accuracy, quality, and legality of the Personal Data and the means by which such Personal Data was obtained.

If the Provider is not the data subject, the Provider acknowledges and agrees that: (i) The Provider has obtained the data subject’s explicit consent (as required under the Data Protection Law) for all data collection, sharing, and usage as agreed in the Contract; and (ii) The Provider has informed the data subject and obtained explicit consent (as required under the Data Protection Law) for the possibility that their Personal Data may be processed outside their original country.

If the Provider is both the controller and processor of Personal Data, the Provider warrants that its instructions and actions with respect to the Personal Data — including the designation of ITS as a sub-processor — have been duly authorized by the relevant data controller.

ITS shall not be obligated to comply with or follow any instructions from the Provider that violate the Data Protection Law.

3. Types of Personal Data Protected: The Personal Data protected under this Commitment includes information in the form of symbols, letters, numbers, images, sounds, or similar forms in electronic environments that are associated with or help identify a specific individual. This may include both basic personal data and sensitive personal data, such as: name; address, phone number; date of birth, email address, information about occupation, health status, income, or any other information that, under the law at any given time, is defined as personal data.

4. Methods of Personal Data Protection: ITS shall collect, analyze, assess, use, store, transfer, process, and provide Personal Data to relevant parties or competent state authorities, and carry out other activities for the purposes stated in Clause 2 of this Article.

5. Parties involved in the protection of Personal Data: The Provider agrees that, for the purposes set out in Clause 2 of this Article, ITS may disclose Personal Data to its subsidiaries and/or affiliates to the extent necessary to apply and implement the purposes or any part thereof, subject to the subsidiaries and/or affiliates undertaking to properly perform equivalent obligations as stipulated in this Commitment.

6. Personal Data Protection Period: Personal Data protection shall commence from the time ITS receives the personal information/data as well as the consent of the Provider to the processing of such personal information/data. ITS shall maintain the processing of Personal Data for the duration of the Contract and in accordance with the provisions of law.

7. ITS Commitment: ITS commits to use all necessary and reasonable efforts to secure and protect Personal Data specified in this Commitment in accordance with the requirements and standards on information security and personal data protection under Vietnamese law and as prescribed in this Commitment. During the processing of Personal Data, there may be interruptions, delays, disconnections or any incidents due to causes beyond the reasonable control of ITS, including but not limited to interruptions due to upgrades, repairs, transmission errors, technical interruptions caused by ITS provider/contractors. In such cases, ITS will use its best efforts to promptly notify the Provider of the incident and the Provider agrees to indemnify ITS from liability in such cases.

In case of detecting a violation of the personal data protection regulations, ITS will notify the Provider as soon as possible after noticing a violation of the personal data protection regulations. In addition, the Personal Data Controller, the Personal Data Controller and Processor will notify the Ministry of Public Security (Department of Cyber ​​Security and High-Tech Crime Prevention) no later than 72 hours after the violation occurs.