PERSONAL DATA PROTECTION POLICY FOR CUSTOMERS

Viettel Technology Investment Company Limited (“Viettel Software”) always places great importance on privacy and the protection of Customers’ Personal Data. Through this Personal Data Protection Policy (“Policy”), we aim to provide Customers with transparent information about how we process and protect their Personal Data when Customers access, learn about, or use products, goods and services, participate in interactive activities, marketing activities, surveys, or other activities related to Viettel Software, in order to ensure that Personal Data remains private and secure in accordance with applicable laws and Viettel Software’s security standards.

This Policy constitutes the Notice on the Processing and Protection of Personal Data and may be amended when necessary. The latest updated version will be published on our official website. Therefore, we recommend that Customers periodically review this Policy on our website.

I. DEFINITIONS

In this Policy, the following terms shall have the meanings set forth below:

1. Viettel Software: means Viettel Technology Investment Company Limited, Enterprise Registration Certificate No. 2801045888, with its head office at Nam Le Loi Boulevard, Dong Huong Ward, Thanh Hoa City, Thanh Hoa Province, Vietnam.

2. Customer/You: means an individual or organization whose Personal Data is processed by Viettel Software under this Policy, including but not limited to:

(i) Individuals who register for, access, download, or use documents, products, goods, or services of Viettel Software;

(ii) Representatives of organizations, legal entities, or units that are interested in, use, or are currently using products, goods, or services provided or jointly provided by Viettel Software;

(iii) Individuals whose Personal Data is collected by Viettel Software through other lawful sources, such as partners, coordinating entities, event organizers, conference platforms, or digital interaction systems;

(iv) Other subjects involved in the process of Viettel Software providing, marketing, supporting, or processing services and products.

3. Products, Goods and Services: means any products, goods, or services provided by Viettel Software and/or jointly provided by Viettel Software and its partners that Customers search for, access, purchase, register to use, or use.

4. Personal Data: means information in the form of symbols, letters, numbers, images, sounds, or similar forms in an electronic environment that is associated with a specific Customer or helps identify a specific Customer.

5. Processing of Personal Data: means one or more activities that affect Personal Data, such as collection, analysis, storage, encryption, decryption, copying, provision, deletion, destruction of Personal Data, or other related activities.

6. Personal Data Controller: means an organization or individual that determines the purposes and means of Processing Personal Data.

7. Personal Data Processor: means an organization or individual that processes Personal Data on behalf of the Personal Data Controller under a contract or agreement with the Personal Data Controller.

8. Personal Data Controller and Processor: means an organization or individual that simultaneously determines the purposes and means of, and directly carries out, the Processing of Personal Data.

II. TYPES OF PERSONAL DATA PROCESSED

Personal Data processed includes data provided by Customers to us when Customers access, learn about, or use products, goods, or services, participate in interactive activities, marketing activities, surveys, or other activities related to Viettel Software, specifically:

(i) Full name;

(ii) Telephone number;

(iii) Email address;

(iv) Position and Company;

(v) Purpose of receiving the materials.

Personal Data shall be processed in accordance with each corresponding type of Product, Good or Service.

ARTICLE 3. PURPOSES OF DATA PROCESSING

The Personal Data specified in Article 2 above may be processed for the following purposes:

Collecting, receiving, updating, storing, and managing Customer and prospective Customer information and records for the purpose of customer relationship management and development.

Classifying, screening, and assessing the suitability of Customers/Prospective Customers for the Company’s products, services, solutions, and business direction.

Using contact information to communicate with and exchange information with Customers, provide information and consultation, introduce products, services, and solutions, and discuss Customers’ needs and requirements.

Analyzing the information provided to identify Customers’ needs, interests, and potential use of products, services, and solutions, thereby supporting the development and improvement of approaches for reaching Customers and providing appropriate products and services.

Storing, updating, classifying, and managing Prospective Customer information to support customer care, customer outreach, and customer relationship development activities within the scope permitted by applicable laws and this Policy.

Serving business and customer care activities, including supporting the development, implementation, management, and monitoring of business activities, provision of products, services, and solutions, and customer care.

ARTICLE 4. METHODS OF DATA PROCESSING

1. Methods of Collection

Personal Data is collected directly by Viettel Software from users during their participation in campaigns involving access to, downloading, and use of in-depth materials, specifically as follows:

(i) Through registration forms on the Viettel Software Website and/or campaign Landing Page: Users provide information such as full name, email address, organization, position, areas of interest, and other optional information in order to download in-depth materials prepared by Viettel Software;

(ii) Through interactions with the customer care or technical support team (if any): Including communications via email, telephone, or feedback forms concerning the quality of the materials, requests for further consultation, or related support;

(iii) In certain cases, Viettel Software may receive data from authorized partners (for example, communications partners, digital seminar platforms, online conference platforms, etc.), provided that the user has consented to the sharing of information and such sharing complies with applicable laws.

2. Methods of Storage

Personal Data is stored in Vietnam in Viettel Software’s Customer database system or in any location where we or our branches, parent companies, member companies within the Group, partners, or service providers have facilities and create backup copies for a data center in another region.

3. Methods of Data Transfer/Sharing

We will apply necessary security measures to ensure the secure transfer/sharing of Customers’ Personal Data to (i) individuals/organizations participating in the Processing of Personal Data as specified in Article 8 of this Policy; or (ii) competent state authorities, ensuring information security and preventing data leakage or unauthorized disclosure, and requiring the receiving parties to implement appropriate data security measures.

4. Methods of Analysis

Personal Data analysis is carried out in accordance with Viettel Software’s internal procedures. We maintain strict monitoring mechanisms for each data analysis process, including requirements to verify compliance with legal requirements concerning data confidentiality and information security for information technology systems before analysis is conducted. We also have strict rules to ensure that personal information is anonymized or de-identified at the appropriate stage during the processing process.

5. Methods of Encryption

Collected Personal Data is encrypted in accordance with appropriate encryption standards when necessary during storage or data transfer, in order to ensure that the data is protected, authenticated, maintained in integrity, and cannot be altered after transmission.

6. Methods of Data Deletion

When You terminate your use of and are no longer interested in Viettel Software’s Products, Goods, or Services and submit a valid request, we will delete the Personal Data, including all Personal Data that You have provided and/or that we have collected during Your use of the Products, Goods, or Services, except where otherwise provided by law and in the following cases where deletion cannot be carried out:

(i) The law does not permit deletion of the data or requires the data to be retained;

(ii) Personal Data is processed by competent state authorities for purposes serving the operations of such state authorities in accordance with the law;

(iii) Personal Data has been made public in accordance with the law;

(iv) Personal Data is processed for legal requirements, scientific research, or statistical purposes in accordance with the law;

(v) In cases of emergencies involving national defense, national security, social order and safety, major disasters, or dangerous epidemics; where there is a threat to national security or defense but not yet to the extent of declaring a state of emergency; for the prevention and combating of riots, terrorism, crime, and violations of law;

(vi) Responding to an emergency situation threatening the life, health, or safety of the Customer or another individual.

ARTICLE 5. VIETTEL SOFTWARE’S DATA SECURITY PRINCIPLES

Your Personal Data shall be kept confidential in accordance with this Policy and applicable laws.

We are responsible for ensuring cybersecurity in accordance with applicable laws, safeguarding national defense and national security, state secrets, political stability, social order and safety, and promoting socio-economic development.

The handling of cybersecurity incidents shall always ensure Your lawful rights and interests.

Cybersecurity activities shall be carried out regularly, continuously, promptly, and effectively.

ARTICLE 6. POTENTIAL UNWANTED CONSEQUENCES AND DAMAGES

We apply measures to protect Your Personal Data in accordance with Viettel Software’s policies and regulations from time to time in order to protect and prevent Your Personal Data from being accessed, used, or shared unintentionally. However, no data can be completely secure. Therefore, we cannot guarantee absolute security of Your Personal Data in certain cases, including:

(i) Hardware or software errors during data processing resulting in the loss of Customer data;

(ii) Security vulnerabilities beyond our control or systems being attacked by hackers, resulting in data leakage or unauthorized disclosure.

You should be aware that whenever You disclose or make Your Personal Data public, such data may be collected and used by others for purposes beyond Your and our control.

We recommend that You protect Your personal devices (mobile phones, tablets, personal computers, etc.) during use; You should log out of Your account when You no longer need to use it.

In the event that a data storage server is attacked, resulting in the loss, disclosure, or leakage of Customers’ Personal Data, Viettel Software shall be responsible for notifying the competent authorities so that the incident can be investigated and handled promptly, and for notifying You in accordance with applicable laws.

Cyberspace is not a secure environment, and we cannot absolutely guarantee that Your Personal Data shared through cyberspace will always remain confidential. When transmitting Personal Data through cyberspace, You should only use secure systems to access websites, applications, or devices. You are responsible for keeping Your access credentials for each website, application, or device secure and confidential.

ARTICLE 7. TIME OF COMMENCEMENT AND TERMINATION OF PERSONAL DATA PROCESSING

Personal Data shall be processed from the time we receive Personal Data provided by You and have an appropriate legal basis for processing such data in accordance with applicable laws.

To the extent permitted by law, Personal Data shall be processed until the purposes of data processing have been fulfilled.

We may be required to retain Your Personal Data even after the contract between You and Viettel Software has been terminated in order to fulfill our legal obligations in accordance with applicable laws and/or at the request of competent state authorities.

In addition to the cases mentioned above, Viettel Software shall retain Your Personal Data for a period of 03 years from the date of receipt, for the purpose of performing and complying with obligations under applicable laws.

ARTICLE 8. ORGANIZATIONS AND INDIVIDUALS INVOLVED IN THE PROCESSING OF PERSONAL DATA

Depending on the circumstances, we may act as the Personal Data Controller or the Personal Data Controller and Processor.

To the extent permitted by law, You acknowledge that we may share Personal Data for the purposes specified in Article 3 with the following organizations and individuals:

(i) Member companies and affiliated companies of Viettel Software;

(ii) Organizations and individuals providing services to and/or cooperating with Viettel Software, including but not limited to agents, consultants, auditors, lawyers, notaries, and business partners cooperating with Viettel Software or providing information technology solutions, software, applications, operational services, management services, incident handling, or infrastructure development services;

(iii) Any individual or organization acting as Your representative or authorized party and acting on Your behalf;

(iv) Payment service providers based on Your authorization or consent.

Data sharing shall be carried out in accordance with the applicable procedures, methods, and laws. Recipients of Personal Data are obliged to keep Your Personal Data confidential in accordance with this Policy, Viettel Software’s regulations, procedures, and standards on Personal Data Protection, and applicable laws.

We may share Your information with competent state authorities when carrying out the Personal Data Processing purposes specified in Article 3 of this Policy in accordance with applicable laws.

ARTICLE 9. CUSTOMER RIGHTS

You have the right to be informed about the Processing of Your Personal Data, except where otherwise provided by law.

You have the right to decide whether to provide consent in relation to the Processing of Your Personal Data, except where otherwise provided by law.

You have the right to access, view, amend, or request amendment of Your Personal Data, except where otherwise provided by law.

We will amend Personal Data at Your request or in accordance with specialized legal regulations. Where this cannot be done, we will notify You in accordance with the agreement between You and us and applicable laws.

You have the right to delete or request deletion of Your Personal Data in accordance with Clause 6, Article 4 of this Policy.

You have the right to request restriction of the Processing of Your Personal Data in accordance with applicable laws.

We will implement the restriction of data processing upon receiving Your request, subject to technically feasible conditions, except where otherwise provided by law or agreed upon by the parties.

You have the right to request that we provide You with Your Personal Data, except where otherwise provided by law.

Viettel Software shall provide Your Personal Data upon receiving Your request, except where otherwise provided by law.

You have the right to request withdrawal of Your consent for the processing purposes for which You have consented to Viettel Software’s processing, except where otherwise provided by law. Upon receiving such request, Viettel Software will notify You of the consequences and potential damages that may arise from withdrawing Your consent.

Where Your withdrawal of consent affects the performance of the contract between Viettel Software and You, Viettel Software’s legal obligations, the life, property, rights, or lawful interests of You or other organizations or individuals, or national security and social order and safety protection duties, we have the right to restrict, suspend, terminate, or partially or fully cancel the contract for the provision of products, goods, or services between Viettel Software and the Customer. We shall not be liable for any legal liability or compensation for any loss incurred by You in such case.

You have the right to object to Viettel Software’s Processing of Your Personal Data in order to prevent or restrict disclosure of Your Personal Data or for other reasons as provided by law.

We will process Your objection request after receiving it, except where otherwise provided by law.

Where Your objection affects the performance of the contract between Viettel Software and You, Viettel Software’s legal obligations, the life, property, rights, or lawful interests of You or other organizations or individuals, or national security and social order and safety protection duties, we have the right to restrict, suspend, terminate, or partially or fully cancel the contract for the provision of Products, Goods, or Services between Viettel Software and the Customer. We shall not be liable for any loss incurred by You in such case.

You have the right to file complaints, denunciations, or lawsuits in accordance with applicable laws.

You have the right to request compensation for actual damages in accordance with applicable laws if Viettel Software violates regulations on the protection of Your Personal Data, except where otherwise agreed by the parties or provided by law.

You have the right to protect Yourself in accordance with relevant laws, including but not limited to the Civil Code, or request competent authorities or organizations to implement measures to protect civil rights, such as requiring the cessation of infringing acts, requiring an apology, requiring a public correction, or requiring compensation for damages.

Other rights under this Policy and applicable laws.

ARTICLE 10. CUSTOMER OBLIGATIONS

Comply with applicable laws and Viettel Software’s regulations relating to the Processing of Your Personal Data.

Provide complete, truthful, and accurate Personal Data and other information when accessing, registering for, downloading, or using in-depth materials, learning about or using products, goods, or services, participating in interactive activities, marketing activities, surveys, or other activities related to Viettel Software, and whenever such information changes. We will protect Your Personal Data based on the information You have provided. Therefore, if any information is inaccurate, we shall not be responsible where such information affects or limits Your rights or benefits. If You fail to notify us and any risks or losses arise, You shall be responsible for errors or acts of misuse or fraud when using Products, Goods, or Services caused by Your fault or by Your failure to provide changes to information correctly, completely, accurately, and promptly, including financial losses and expenses arising from inaccurate or inconsistent information.

Cooperate with us, competent state authorities, or third parties in the event of issues affecting the confidentiality of Your Personal Data.

Protect Your own Personal Data; request relevant organizations and individuals to protect Your Personal Data; proactively apply measures to protect Your Personal Data while using Viettel Software’s Products, Goods, or Services; and promptly notify us upon detecting errors or mistakes concerning Personal Data or suspecting that Personal Data is being infringed upon.

Respect and protect the Personal Data of others.

Take responsibility for the information and data that You create or provide in cyberspace; and take responsibility where Personal Data is leaked or infringed due to Your own fault.

Regularly update regulations and policies concerning the protection and Processing of Personal Data of Viettel Software from time to time, as notified to You through Viettel Software’s Transaction Channels.

Comply with regulations on Personal Data protection and participate in preventing and combating violations of regulations on Personal Data protection.

Other obligations as prescribed by law.

ARTICLE 11. GENERAL PROVISIONS

This Policy takes effect from 08/09/2025 and may be amended from time to time and notified to You before being applied. Such changes shall take effect in accordance with applicable laws.

This Policy constitutes the Notice on the Processing of Personal Data in accordance with applicable laws.