1. EXPLANATION OF TERMS

a. “ACBS”: ACB Securities Company Limited.

b. “Policy”: Is the Personal Data Protection Policy for Customers at ACBS.

c. “Legal Regulations”: All legal documents of the Socialist Republic of Vietnam, official dispatches, directives, decisions, and instructions of competent State agencies regulating ACBS’s operations and ACBS’s relationship with Customers.

d. “Personal data”: Information and data defined in Decree 13/2023/ND-CP, legal regulations, regulations of competent state agencies, and ACBS regulations.

e. “Data Subject”: An individual/organization whose personal/organizational data is reflected, including all Customers using products/services provided by ACBS

f. “Personal data processing” is one or more activities affecting personal data, such as: collecting, recording, analyzing, confirming, storing, editing, publicizing, combining, accessing, retrieving, withdrawing, encoding, decoding, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data or other actions

g. “Third Party”: Individuals and organizations that are not part of ACBS and are legally bound to ACBS through contracts, agreements, or other commitments; or other Third Parties as prescribed by law or regulations of competent state agencies.

2. PURPOSE OF POLICY ISSUANCE

a. This personal data protection policy aims to transparently inform Data Subjects of all policies related to the processing of personal data at ACBS.

b. Ensure compliance with legal regulations on personal data protection policies of Data Subjects.

c. Protect the rights of Data Subjects regarding personal data.

3. ACBS’S CONFIDENTIALITY COMMITMENT

a. ACBS commits to processing personal data safely, carefully, and in full compliance with the Law on the Protection of Personal Data of Data Subjects. ACBS only processes personal data of Data Subjects following the Law, this Policy, and the Contract(s)/agreements entered into with the Data Subjects. ACBS is committed to respecting and protecting children’s personal data by the principle of protecting children’s rights and best interests. Except in cases where the consent of the Data Subject is not required, in addition to the measures to protect Personal Data as mandated by law, before processing children’s personal data, ACBS will verify the child’s age and obtain the consent of the child’s parent or guardian as required by law. For children aged 7 years or older, consent from the child is required before processing their personal data.

b. ACBS applies technical security measures to prevent unauthorized access, reading, use, alteration, provision, destruction or other processing of personal data. ACBS also regularly reviews and updates its management and technical security measures when processing the personal data of Data Subjects.

c. Do not use, transfer, provide or disclose to any Third Party (except for organizations and individuals who process Customer Personal Data listed in Section 7 of this Personal Data Protection Policy) Customer Personal Data without the permission or consent of the Customer, except in cases where otherwise provided by law.

d. If ACBS information storage server or information system is attacked by a cyber attack resulting in the Personal Data of the Data Subject being attacked in scope, ACBS will undertake the task of reporting on the functional management mechanism of processing over time and notifying the Data Subject.

e. Absolute security of all online transaction information of Data Subjects, including transaction information and digitized accounting documents at ACBS’s data center area.

4. GENERAL PROVISIONS

a. This Personal Data Protection Policy is an integral part of the Contracts/Terms and Conditions signed between ACBS and the Data Subject. At the same time, it governs the relationship between the Data Subject and ACBS. Customers need to read and understand this Policy as the content of those Terms and Conditions/Contracts.

b. By providing personal data of a Third Party (including but not limited to information and data that the Data Subject has officially provided to ACBS through methods notified by ACBS) to ACBS, the Data Subject represents and warrants that the Data Subject has obtained authorization/approval/consent from that Third Party to process the data by the law.

c. Based on the Law and within the scope of ACBS’s services, ACBS can only provide its services and utilities when ACBS has the Data Subject’s full consent to the Personal Data Protection Policy and regulations on personal data processing at ACBS without any conditions attached. Therefore, the Data Subject’s consent in any form (according to the Contract, documents, this Personal Data Protection Policy, or any other form as notified by ACBS) is understood as the Data Subject’s full consent to allow ACBS to process the Data Subject’s personal data.

d. ACBS relies on the personal data provided by the Data Subject to maintain legal and service relationships with the Data Subject. Accordingly, at all times, the Data Subject must ensure that the personal data provided to ACBS is complete and authentic.

e. When necessary, ACBS may amend, supplement, update, or adjust the contents of the Data Subject’s Personal Data Protection Policy at any time.

f. ACBS will store Customer data for the period required in the relationship with the Data Subject or for other necessary period to meet the purpose beneficial to both parties and/or as prescribed by law.

5. COLLECTION AND PROCESSING OF PERSONAL DATA AT ACBS

For ACBS to process the Data Subject’s requests (including but not limited to requests for brokerage services, investment consulting, underwriting, financial consulting, transactions (orders to buy, sell securities or cancellation orders), requests (money transfer, securities transfer, exercising the rights of securities owners, debt payment, transfer of rights to receive proceeds from securities sales) of the Data Subject related to securities accounts, derivative accounts, other services) and/or provide general information about ACBS’s products/utilities, ACBS and the personal data processor that ACBS hires/cooperates with will need to process the Data Subject’s personal data(including but not limited to activities such as: collecting, recording, analyzing, validating, storing, editing, publishing, combining, accessing, retrieving, withdrawing, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data or other related actions).

Types of personal data that may be collected and processed are information listed below, and may vary depending on the time and the Customer’s relationship with ACBS.

a. The Data Subject’s information has been sent to ACBS (including and not limited to information, data on contracts/documents/agreements/data on securities transactions, money transactions, other relevant information as prescribed by law, regulations of competent state agencies, regulations/notifications of ACBS).

b. The Data Subject’s information that ACBS collects through any technical means for ACBS, ensuring that the information provided to state agencies is by the provisions of law, regulations of competent state agencies, and regulations/notifications of ACBS.

c. Information about securities transactions at ACBS or through ACBS’s online trading system (device type, operating system used by the Data Subject, browser type, browser settings, IP address, language settings, date/time of connection to the website, ACBS’s trading applications, and other technical communications).

d. User activity history on digital platforms and official transaction channels of ACBS.

e. ACBS’s conversations with Data Subjects through ACBS’s communication channels and/or conducted by ACBS.

f. Other information related to, affecting (directly/indirectly) or arising from/relating to the establishment of product and service provision relationships or labor relationships, or other legal relationships between ACBS and the Data Subject.

g. ACBS processes the Customer’s Personal Data from the time the Customer and ACBS sign this Contract.

h. The Customer’s personal data will be processed for the period necessary to achieve the Processing Purposes and to comply with relevant legal requirements (e.g., for tax and audit purposes), or to fulfill obligations that ACBS has notified the Customer of.

i. Some types of Personal Data may be stored longer even after the Customer’s employment with the Company has ended to fulfill ACBS’s legal obligations as required by law and/or as required by competent state agencies.

6. HOW PERSONAL DATA IS COLLECTED

ACBS, the Personal Data Processor that ACBS hires and/or has a contractual/cooperative relationship with, may collect Customer’s personal data from the following sources:

a. The Data Subject’s information has been sent to ACBS (including and not limited to information, data on contracts/documents/agreements/data on securities transactions, money transactions, other relevant information as prescribed by law, regulations of competent state agencies, regulations/notifications of ACBS).

b. The Data Subject’s information that ACBS collects through any technical means for ACBS, ensuring that the information provided to state agencies is by the provisions of law, regulations of competent state agencies,and regulations/notifications of ACBS.

c. Through the receipt of personal data from other Third Parties. ACBS is committed by the relevant Third Party, confirming that it has the consent of the Data Subject to: (i) the provision of personal data to ACBS; and (ii) the processing of data for ACBS by this Policy. If the Data Subject does not agree, please do not provide personal data to the Third Party.

d. From other sources permitted by law and competent authorities.

e. ACBS may collect and process data on images of individuals and information obtained from security systems, such as recordings in areas with CCTV cameras installed at ACBS to protect national security, social order and safety, and the legitimate rights and interests of organizations and individuals by the law without the consent of the Customer.

7. PURPOSE OF PROCESSING PERSONAL DATA

ACBS may collect, process and share the Data Subject’s personal data for ACBS’s business, operational and management purposes, such as:

a. Verify the identity of the Data Subject, identify/identify the Data Subject to provide ACBS’s facilities/products/services.

b. Monitor products and services provided by or through ACBS.

c. Communicate with Data Subjects, including providing Data Subjects with updates on changes to products, services, and facilities (provided by ACBS or through ACBS), including any modifications, additions, extensions, suspensions and replacements of or to such products, services and facilities; and soliciting Data Subjects’ opinions through surveys.

d. Maintain quality, develop and provide securities facilities, products or services, including but not limited to:
– Activities related to securities transactions and services according to Law.
– Research, planning, and statistical analysis to develop or improve ACBS products, services, security, service quality, advertising strategies, or other strategies.

e. Manage ACBS’s infrastructure and business operations and comply with internal policies and procedures as well as Legal Regulations.

f. Resolve, investigate or respond to any complaint or dispute of or relating to the Data Subject

g. Comply with all applicable legal documents, laws, regulations, rules, orders, directives, orders, instructions and/or requests from any local or foreign competent authorities, including regulatory, governmental, tax and law enforcement or other competent authorities.

h. Information disclosure; Financial reporting, regulatory reporting, auditing purposes and record keeping.

i. In connection with the performance of ACBS’s duties and obligations when working with legal consultants, financial consultants, or in compliance with contracts between ACBS and other Third Parties.

j. Manage benefits or rights related to ACBS’s relationship with the Data Subject or arising from the Data Subject’s participation in ACBS’s marketing events, campaigns or promotions or conjunction with Third Parties.

k. Carry out transactions of assignment, transfer of rights and obligations under Contracts/agreements between Data Subjects and/or Third Parties with ACBS.

l. Protect or enforce ACBS’s rights, including rights relating to the implementation of debt collection measures.

m. Carry out other activities related to the business, operation, management, and performance of ACBS and compliance with contractual agreements, including but not limited to activities such as accounting, auditing, risk control, internal control, data processing for statistical analysis, credit, and anti-money laundering;

n. Serve, care for, and improve the experience of Data Subjects during the use of services at ACBS.

8. SHARING OF PERSONAL DATA

ACBS may share Data Subject’s personal data with Third Parties.
Sharing of personal data of Data Subjects to Third Parties always ensures the principle: Third Parties only use personal data necessary for performing functions and tasks assigned, hired by ACBS and/or following the Law, regulations of competent state agencies, and ACBS regulations.

9. RIGHTS AND OBLIGATIONS OF DATA SUBJECTS

a. Data Subjects may request detailed information by the provisions of this Policy or correct their personal data held by ACBS following ACBS’s regulations and instructions. By the Law, ACBS may charge a fee for processing the Data Subject’s request for information. This fee depends on the nature and complexity of the Data Subject’s request for information.

b. The exercise of certain rights of the Data Subject may result in ACBS being unable to perform the actions necessary to achieve the Purpose of Processing, being unable to enter into a contract with the Customer, or being unable to perform its obligations to the Customer under a contract or agreement with the Customer. ACBS will not be liable to the Customer for any losses arising from the exercise of these rights to the Customer. Customers should note that, due to the nature of ACBS’s operations, the law stipulates that ACBS must store Customer information in certain cases, in which case ACBS cannot respond to the relevant Customer’s request to delete data if the deletion of data results in a violation of the law.

c. Please contact ACBS (see “Contact Information” in Section 10 below) for details on how the Data Subject can request access, correct, or exercise his or her rights regarding the processing of the Data Subject’s personal data and the costs involved.

d. Data Subjects protect their own personal data; respect and protect the personal data of others.

e. Provide complete and accurate personal data to ACBS in accordance with this Personal Data Protection Policy.

f. Promptly update ACBS if there are any changes or adjustments to the personal data that the Customer has provided.

g. Comply with legal regulations on personal data protection and participate in preventing and combating violations of regulations on personal data protection.

10. CONTACT INFORMATION

In case the Data Subject has any questions regarding the Personal Data Protection Policy, the Data Subject should contact ACBS:

– At any ACBS Branch/Transaction Office or

– Call ACBS hotline number: 1900.555.533

ACBS will screen and verify the identity, authority to execute the Customer’s request, or necessary information related to the Customer’s request. ACBS may request the Customer to provide supporting information or documents to authenticate the request. After verification, ACBS will proceed to process the Customer’s requests within the time limit prescribed by law.

11. OTHER PROVISIONS

11.1. Transfer of personal data abroad

– ACBS may transfer Customer’s personal data to partners and service providers abroad for processing following the Processing Purpose agreed by the Customer in Section 7 of this Personal Data Protection Policy. In some other cases, ACBS’s partners and service providers based in Vietnam may use data processing equipment and systems located outside of Vietnam to process personal data on behalf of ACBS. These cases are considered as transferring the Customer’s personal data abroad.

– It should be noted that some countries may have lower or higher levels or practices regarding personal data protection than Vietnam. In all cases where personal data is transferred abroad, ACBS will endeavor to take appropriate measures to ensure the protection of Customer Personal Data, including entering into data security agreements and commitments, selecting appropriate third-party service providers with clear mandates, and only working with these partners with appropriate protection measures.

11.2. Measures to protect personal data

ACBS will implement appropriate measures to protect Personal Data, including organizational, human, and technical management measures as required by law to detect and prevent leaks or violations of Personal Data, including but not limited to:

– Develop and promulgate regulations on Personal Data protection, clearly stating what needs to be done according to legal regulations.

– Designate a department and personnel responsible for protecting Personal Data.

– Record and store system logs of Personal Data processing.

– Check the network security of the system and means, equipment serving the processing of Personal Data before processing, delete irrecoverably or destroy devices containing Personal Data

– Design security systems, access control, intrusion prevention, authentication, data encryption, data backup.

– Other measures as prescribed by law.

11.3. Potential unintended consequences and damages

– Please note that although ACBS always strives to ensure that Customers’ personal data is best protected in accordance with the law, ACBS cannot completely and absolutely eliminate all risks to personal data during processing.

– The transmission of information via the Internet or ACBS’s internal information system may still have certain risks arising from force majeure or incidents, cyber security crimes such as cyber attacks, cyber terrorism, illegal cyber espionage, disruption of data processing or personal data leakage. In this case, ACBS will immediately take necessary actions to prevent, remedy, and minimize unexpected damages that may occur to Personal Data, and coordinate with competent state agencies to promptly investigate and handle violations and notify Customers following the law.

– Customers need to be aware that at any time they disclose and make public their personal data, that data may be collected and used by others for purposes beyond the control of the Customer and ACBS.

– Customers need to clearly understand that to the extent that reasonable measures have been taken to prevent risks to Personal Data, ACBS will not be liable for damages caused by the actions of any Third Party that adversely affect the Customer’s personal data that are not caused by ACBS.