Policy 

VỀ XỬ LÝ VÀ BẢO VỆ DỮ LIỆU CÁ NHÂN CỦA ỨNG VIÊN TUYỂN DỤNG

Viettel Technology Investment One Member Company Limited (“Viettel Software”, the “Company” or “we”) places great importance on protecting the Personal Data of Candidates participating in the recruitment process at Viettel Software. Through this Personal Data Protection Policy for Recruitment Candidates (the “Policy”), we aim to help Candidates clearly understand how Viettel Software collects, uses, stores, shares and protects Candidates’ Personal Data throughout the application submission, interview, assessment and recruitment decision-making processes, in order to ensure Candidates’ lawful rights and interests in accordance with applicable personal data protection laws.

This Policy constitutes the Notice on the Processing and Protection of Personal Data for Recruitment Candidates and may be amended when necessary. The latest updated version will be provided to Candidates through job postings, email correspondence regarding applications, or other official information channels of Viettel Software. We recommend that Candidates carefully read this Policy before submitting their applications.

ARTICLE 1. DEFINITIONS

In this Policy, the following terms shall have the meanings set out below:

1. Viettel Software: means Viettel Technology Investment One Member Company Limited, Enterprise Registration Certificate No. 2801045888, with its head office at Nam Le Loi Boulevard, Dong Huong Ward, Thanh Hoa City, Thanh Hoa Province, Vietnam.

2. Candidate/Recruitment Candidate: means an individual who submits an application, curriculum vitae (CV), or participates in any stage of the recruitment process organized or jointly organized by Viettel Software, including but not limited to:

(i) An individual who proactively submits an application through Viettel Software’s recruitment website, recruitment email, or online recruitment platform operated by Viettel Software or a third party;

(ii) An individual introduced by an officer or employee of Viettel Software, including through internal referrals within the Viettel Group;

(iii) An individual introduced by a recruitment service provider (headhunter), recruitment platform, or recruitment partner cooperating with Viettel Software;

(iv) An individual who participates in interviews, tests or competency assessments but is not or has not yet been recruited.

3. Personal Data: means information in the form of symbols, letters, numbers, images, sounds or similar forms in an electronic environment that is associated with a specific Candidate or helps identify a specific Candidate.

4. Sensitive Personal Data: means Personal Data associated with the Candidate’s privacy which, when infringed, may directly affect the Candidate’s lawful rights and interests, including but not limited to health status data, biometric data, and judicial record data as prescribed by personal data protection laws.

5. Processing of Personal Data: means one or more activities performed on Personal Data, such as collection, analysis, storage, encryption, decryption, copying, provision, deletion, destruction of Personal Data, or other related activities.

6. Personal Data Controller: means an organization or individual that determines the purposes and means of Processing Personal Data.

7. Personal Data Processor: means an organization or individual that Processes Personal Data on behalf of the Personal Data Controller pursuant to a contract or agreement with the Personal Data Controller.

8. Personal Data Controller and Processor: means an organization or individual that simultaneously determines the purposes and means of Processing Personal Data and directly Processes Personal Data.

9. Talent Pool: means a database storing the profiles of Candidates who are not selected in the current recruitment process but have agreed to allow Viettel Software to continue storing their profiles for consideration for suitable recruitment opportunities in the future.

ARTICLE 2. TYPES OF PERSONAL DATA PROCESSED

Identification information: full name; date of birth; gender; nationality; Citizen Identity Card/Passport number; portrait photograph.

Contact information: telephone number; email address; permanent, temporary or contact address.

Education and employment information: educational qualifications, field of study, degrees and certificates; employment history, work experience and skills; position applied for, expected salary; referee information (full name, title and contact details of the referee voluntarily provided by the Candidate).

Sensitive Personal Data: shall only be collected and processed to the extent necessary and appropriate to the position applied for and based on the Candidate’s separate and explicit consent in accordance with Article 1.4 of this Policy, including health status information in a medical examination certificate (for positions requiring a pre-employment health examination); sensitive personal data prescribed by law contained in judicial record certificates (for positions where such documents are required under specialized laws).

Other Personal Data processed in accordance with the specific recruitment position and each particular stage of the recruitment process.

ARTICLE 3. PURPOSES OF DATA PROCESSING

The Personal Data specified in Article 2 above may be processed for the following purposes:

Receiving, screening and assessing the suitability of Candidates’ applications for recruitment positions.

Contacting and communicating with Candidates regarding the recruitment process, and arranging interviews, tests and competency assessments.

Verifying information provided by Candidates to the extent necessary and in compliance with applicable laws, including contacting referees provided by Candidates when necessary.

Making recruitment decisions and notifying Candidates of recruitment results.

Carrying out necessary procedures for entering into employment/probationary contracts with successful Candidates.

Storing the profiles of unsuccessful Candidates in the Talent Pool for consideration for suitable future recruitment opportunities, only with the Candidate’s consent.

ARTICLE 4. METHODS OF DATA PROCESSING

1. Methods of collection

Personal Data is collected directly from users during their participation in campaigns to access, download and use specialized materials, specifically as follows:

(i) Directly provided by the Candidate when submitting an application through the recruitment website, email, application form, or when participating in interviews, tests or assessments;

(ii) From online recruitment platforms (e.g., VietnamWorks, LinkedIn, TopCV, etc.) where the Candidate has posted their profile and agreed to share it with recruiters;

(iii) From recruitment service providers (headhunters), or officers and employees of Viettel Software who make referrals, including internal referrals within the Viettel Group, provided that such sharing has been agreed to by the Candidate and complies with applicable laws;

(iv) From referees whose contact information has been voluntarily provided by the Candidate.

2. Methods of storage

Personal Data is stored in Vietnam in Viettel Software’s Candidate database systems, or in any location where we, our branches, parent companies, member companies within the Group, partners or service providers have facilities and create backup copies for a data center in another region.

3. Methods of transfer/sharing of data

We will implement necessary security measures to ensure the secure transfer/sharing of Candidates’ Personal Data to (i) individuals/organizations participating in the Processing of Personal Data as specified in Article 8 of this Policy; or (ii) competent state authorities, ensuring information security and preventing data disclosure or leakage, and requiring recipients of Personal Data to implement appropriate data security measures.

4. Methods of analysis

Personal Data is analyzed in accordance with Viettel Software’s internal procedures. We maintain strict monitoring mechanisms for each data analysis process, including requirements to verify compliance with legal requirements on data protection and information security for information technology systems before analysis is conducted. We also maintain strict rules to ensure that Personal Data is anonymized or de-identified at appropriate stages during processing.

5. Methods of encryption

Collected Personal Data is encrypted in accordance with appropriate encryption standards where necessary during data storage or transfer, in order to ensure that the data is protected, authenticated, maintained in integrity and cannot be altered after transmission.

6. Methods of data deletion

When a Candidate ceases to use and is no longer interested in Viettel Software’s Products, Goods or Services and submits a valid request, we will delete the Candidate’s Personal Data, including all Personal Data provided by the Candidate and/or collected by us during the Candidate’s use of the Products, Goods or Services, except where otherwise provided by law and in certain cases where deletion cannot be carried out, including:

(i) The law does not permit the deletion of data or requires the data to be retained;

(ii) The Personal Data is processed by a competent state authority for purposes serving the authority’s operations in accordance with applicable laws;

(iii) The Personal Data has been made public in accordance with applicable laws;

(iv) The Personal Data is processed to serve legal requirements, scientific research or statistical purposes in accordance with applicable laws;

(v) In cases of emergencies involving national defense, national security, social order and safety, major disasters or dangerous epidemics; where there is a threat to national security or defense that has not reached the level requiring a state of emergency; for the prevention and control of riots, terrorism, crimes and violations of law;

(vi) Responding to emergency situations threatening the life, health or safety of the Candidate or another individual.

ARTICLE 5. VIETTEL SOFTWARE’S DATA SECURITY PRINCIPLES

Candidates’ Personal Data shall be kept confidential in accordance with this Policy and applicable laws.

We are responsible for ensuring cybersecurity in accordance with applicable laws, protecting national defense and national security, state secrets, political stability, social order and safety, and promoting socio-economic development.

The handling of cybersecurity incidents shall always ensure Candidates’ lawful rights and interests.

Cybersecurity activities shall be carried out regularly, continuously, promptly and effectively.

ARTICLE 6. POTENTIAL UNWANTED CONSEQUENCES AND DAMAGES

We use measures to protect Candidates’ Personal Data in accordance with Viettel Software’s policies and regulations from time to time in order to protect and prevent Candidates’ Personal Data from being accessed, used or shared unintentionally. However, no data can be completely secure. Therefore, we cannot guarantee absolute security of Candidates’ Personal Data in certain circumstances, including:

(i) Hardware or software errors during data processing that result in the loss of Candidates’ data;

(ii) Security vulnerabilities beyond our control, or systems being attacked by hackers resulting in data disclosure or leakage.

Candidates should be aware that whenever they disclose or make their Personal Data public, such data may be collected and used by others for purposes beyond the Candidate’s and our control.

We recommend that Candidates protect their personal devices (mobile phones, tablets, personal computers, etc.) while using our services; Candidates should log out of their accounts when they no longer need to use them.

In the event that a data storage server is attacked, resulting in the loss, disclosure or leakage of Candidates’ Personal Data, Viettel Software shall be responsible for reporting the incident to the competent authorities for timely investigation and handling, and notifying Candidates in accordance with applicable laws.

Cyberspace is not a completely secure environment, and we cannot absolutely guarantee that Candidates’ Personal Data shared through cyberspace will always remain confidential. When transmitting Personal Data through cyberspace, Candidates should only use secure systems to access websites, applications or devices. Candidates are responsible for keeping their access credentials for each website, application or device secure and confidential.

ARTICLE 7. TIME OF COMMENCEMENT AND TERMINATION OF PERSONAL DATA PROCESSING

Personal Data shall be processed from the time we receive Personal Data provided by the Candidate and have an appropriate legal basis for processing such data in accordance with applicable laws.

To the extent permitted by law, Personal Data shall be processed until the purposes of data processing have been fulfilled.

We may be required to retain Candidates’ Personal Data even after the contract between the Candidate and Viettel Software has terminated in order to fulfill our legal obligations under applicable laws and/or at the request of competent state authorities.

In addition to the cases mentioned above, Viettel Software shall retain Candidates’ Personal Data for 05 years from the date of receipt for the purpose of performing and complying with legal obligations.

ARTICLE 8. ORGANIZATIONS AND INDIVIDUALS PARTICIPATING IN THE PROCESSING OF PERSONAL DATA

Depending on the circumstances, we may act as the Personal Data Controller or the Personal Data Controller and Processor.

To the extent permitted by law, Candidates acknowledge that we may share Personal Data for the purposes specified in Article 3 with the following organizations and individuals:

(i) The parent company, member companies of the parent company, member enterprises and affiliated companies of Viettel Software;

(ii) Organizations and individuals providing services to and/or cooperating with Viettel Software, including but not limited to agents, consultants, auditors, lawyers, notaries, insurers, hospitals, business partners, and partners providing information technology solutions, software, applications, operational services, management services, incident handling and infrastructure development;

(iii) Any individual or organization that is a representative or authorized person of the Candidate and acts on behalf of the Candidate;

(iv) Payment service providers based on the Candidate’s authorization or consent.

Data sharing shall be carried out in accordance with the applicable procedures, methods and laws. Recipients of Personal Data are obliged to maintain the confidentiality of Candidates’ Personal Data in accordance with this Policy, Viettel Software’s Personal Data Protection regulations, procedures and standards, and applicable laws.

We may share Candidates’ information with competent state authorities when carrying out the purposes of Personal Data Processing specified in Article 3 of this Policy in accordance with applicable laws.

ARTICLE 9. RIGHTS OF CANDIDATES

Candidates have the right to be informed about the Processing of their Personal Data, except where otherwise provided by law.

Candidates have the right to decide whether to provide consent relating to the Processing of their Personal Data, except where otherwise provided by law.

Candidates have the right to access, view, correct or request correction of their Personal Data, except where otherwise provided by law.

We will correct Personal Data at the Candidate’s request or in accordance with specialized laws. If correction cannot be carried out, we will notify the Candidate in accordance with the agreement between us and the Candidate and applicable laws.

Candidates have the right to delete or request deletion of their Personal Data in accordance with Clause 6 of Article 4 of this Policy.

Candidates have the right to request restriction of the Processing of their Personal Data in accordance with applicable laws.

We will implement restrictions on data processing upon receiving a Candidate’s request, subject to technically feasible conditions, except where otherwise provided by law or agreed by the parties.

Candidates have the right to request that we provide them with their Personal Data, except where otherwise provided by law.

Viettel Software shall provide Candidates’ Personal Data upon receiving the Candidate’s request, except where otherwise provided by law.

Candidates have the right to withdraw their consent to the processing purposes for which they have agreed to allow Viettel Software to process their Personal Data, except where otherwise provided by law. Upon receiving such a request, Viettel Software shall notify the Candidate of the potential consequences and damages that may arise from withdrawing consent.

Where the Candidate’s withdrawal of consent affects the performance of the contract between Viettel Software and the Candidate, Viettel Software’s legal obligations, the life, property or lawful rights and interests of the Candidate or another organization or individual, or the tasks of protecting national security and maintaining social order and safety, we may restrict, suspend, terminate or cancel part or all of the contract for the provision of Products, Goods or Services between Viettel Software and the Candidate. We shall not be legally liable or responsible for compensating any losses incurred by the Candidate in such circumstances.

10. Candidates have the right to object to Viettel Software’s Processing of their Personal Data in order to prevent or restrict disclosure of their Personal Data or for other reasons in accordance with applicable laws.

We shall process the Candidate’s objection after receiving the request, except where otherwise provided by law.

Where the Candidate’s objection affects the performance of the contract between Viettel Software and the Candidate, Viettel Software’s legal obligations, the life, property or lawful rights and interests of the Candidate or another organization or individual, or the tasks of protecting national security and maintaining social order and safety, we may restrict, suspend, terminate or cancel part or all of the contract for the provision of Products, Goods or Services between Viettel Software and the Candidate. We shall not be responsible for any losses incurred by the Candidate in such circumstances.

Candidates have the right to lodge complaints, denunciations or initiate legal proceedings in accordance with applicable laws.

Candidates have the right to request compensation for actual damages in accordance with applicable laws if Viettel Software violates regulations on the protection of their Personal Data, except where otherwise agreed by the parties or provided by law.

Candidates have the right to protect themselves in accordance with applicable laws, including but not limited to the Civil Code, or request competent authorities or organizations to implement measures to protect civil rights, such as requiring the termination of infringing acts, requiring an apology, public correction, or compensation for damages.

Other rights under this Policy and applicable laws.

ARTICLE 10. OBLIGATIONS OF CANDIDATES

Comply with applicable laws and Viettel Software’s regulations relating to the Processing of Candidates’ Personal Data.

Provide complete, truthful and accurate Personal Data and other information when accessing, registering, downloading or using specialized materials, learning about or using Products, Goods or Services, participating in interactive activities, marketing activities, surveys or other activities related to Viettel Software, and when there are changes to such information. We shall protect Candidates’ Personal Data based on the information provided by the Candidate. Therefore, if any information is inaccurate, we shall not be responsible where such information affects or limits the Candidate’s rights or benefits. If the Candidate fails to notify us and any risks or losses arise, the Candidate shall be responsible for errors or acts of misuse or fraud arising from the Candidate’s fault or from failing to provide complete, accurate and timely updates to changes in information, including financial losses and costs arising from inaccurate or inconsistent information.

Cooperate with us, competent state authorities or third parties in the event of issues affecting the confidentiality of Candidates’ Personal Data.

Protect their own Personal Data; request relevant organizations and individuals to protect their Personal Data; proactively apply measures to protect their Personal Data while using Viettel Software’s Products, Goods or Services; and promptly notify us upon detecting errors or inaccuracies in Personal Data or suspecting that Personal Data has been compromised.

Respect and protect the Personal Data of others.

Take responsibility for information and data created or provided by the Candidate in cyberspace; take responsibility where Personal Data is leaked or compromised due to the Candidate’s fault.

Regularly update the regulations and policies relating to the protection and Processing of Personal Data of Viettel Software from time to time as notified to Candidates through Viettel Software’s transaction channels.

Comply with personal data protection laws and participate in preventing and combating violations of regulations on personal data protection.

Other obligations as prescribed by law.

ARTICLE 11. GENERAL PROVISIONS

This Policy takes effect from September 8, 2025 and may be amended from time to time. Any amendments shall be notified to Candidates before being applied. Such changes shall take effect in accordance with applicable laws.

This Policy constitutes the Notice on the Processing of Personal Data in accordance with applicable laws.