AEON Delight (Vietnam) Company Limited (hereinafter referred to as “ADV”), having its registered office at 3A Floor, Intan Building, No. 97 Nguyen Van Troi Street, Phu Nhuan Ward, Ho Chi Minh City, always places importance on compliance with the provisions of law in general and, in particular, the laws on protection of Personal Data when Processing Personal Data.
Therefore, ADV establishes and notifies Data Subjects of this Personal Data Protection Policy.
Data Subjects are required to carefully read this Policy, including its amended and supplemented versions, before providing Personal Data to ADV. ADV will proactively update the contents of this Policy to reflect any changes and will obtain the consent of the Personal Data Subject again where required by law.
This Policy is prepared and used in Vietnamese. This Policy may be translated from Vietnamese into a foreign language or vice versa (if any) for reference purposes only. The Vietnamese version of this Policy shall serve as the official basis for notification, agreement, interpretation and handling of relevant matters.
1. Definitions
Capitalized terms used in this Policy shall have the following meanings:
(a) Personal Data: means digital data or information in another form that identifies or helps identify a specific individual, including Basic Personal Data and Sensitive Personal Data. Personal Data after anonymization is no longer Personal Data.
(b) Processing of Personal Data: means an activity that affects Personal Data, including one or more of the following activities: collection, analysis, synthesis, encryption, decryption, modification, deletion, destruction, anonymization, provision, disclosure, transfer of Personal Data and other activities that affect Personal Data.
(c) Personal Data Subject: means the person to whom the Personal Data relates.
(d) Personal Data Controller: means an agency, organization or individual that determines the purposes and means of processing Personal Data.
(e) Personal Data Controller and Processor: means an agency, organization or individual that determines the purposes and means and directly processes Personal Data.
In case the Law on Personal Data Protection provides otherwise regarding the Capitalized Terms in this Section 1, such Capitalized Terms shall be interpreted in accordance with the corresponding provisions.
2. Types of Personal Data Processed
Unless otherwise provided by law, the types of Personal Data of Data Subjects that ADV collects in whole or in part include:
2.1. Basic Personal Data:
(a) Full name at birth and other names (if any);
(b) Date, month and year of birth;
(c) Gender;
(d) Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current place of residence, hometown and contact address;
(e) Nationality;
(f) Images of the individual;
(g) Telephone number;
(h) Marital status;
(i) Information on family relationships (parents, children, spouse);
(j) Information on the individual’s digital account;
(k) Email address;
(l) Identity card number, Citizen Identity Card number, passport number, personal identification number and personal tax identification number;
(m) Date of issuance, month and year of issuance, and place of issuance of the identity card, Citizen Identity Card, identity card or other personal legal documents of a similar nature;
(n) Information on occupation and field of work;
(o) Other information associated with a specific individual or helping identify a specific individual that is not Sensitive Personal Data;
(p) Other Basic Personal Data as prescribed by law from time to time.
2.2. Sensitive Personal Data:
(a) Data revealing racial or ethnic origin;
(b) Political, religious or belief opinions;
(c) Health status;
(d) Biometric data and genetic characteristics;
(e) Images of identity cards, Citizen Identity Cards and identity cards;
(f) Bank card information and data on the transaction history of bank accounts with ADV;
(g) Data tracking behavior and activities involving the use of telecommunications services, social networks, online communication services and other services in cyberspace;
(h) Personal Data reflecting activities and history of activities in cyberspace, including:
(i) data relating to ADV’s websites or applications;
(ii) technical data (such as device type, operating system, browser type, browser settings, IP address, language settings, date and time of connection to ADV’s websites or applications, source of access, frequency statistics, duration of use of ADV’s websites or applications, and other technical communication information);
(iii) account data, username, password, login, access and logout information and history, login status, access session history, authentication methods, as well as activities related to security and account management on ADV’s websites or applications;
(iv) data on the use of ADV’s websites or applications;
(v) cookies and technologies equivalent to cookies (small data files stored on a user’s device when accessing a website or application);
(vi) clickstream data and page scrolling data on ADV’s websites or applications;
(vii) channel viewing history and VOD (video-on-demand) history, together with related data such as viewing duration, frequency, content viewed, interactions with content and other Personal Data reflecting activities and history of activities in cyberspace;
(i) Images of passports and driver’s licenses;
(j) Biometric data and genetic characteristics;
(k) Other Personal Data that is required by law to be kept confidential or to be subject to strict security measures;
(l) Other Sensitive Personal Data as prescribed by law from time to time.
3. Purposes of Processing Personal Data
The Personal Data specified in Section 2 of this Policy may be processed for the following purposes:
3.1. Identification, verification of information, support, contact and communication with Data Subjects:
(a) Contacting and checking information of Personal Data Subjects; assessing the ability to provide goods and services to Personal Data Subjects; preparing quotations; entering into orders, contracts and related documents with Personal Data Subjects;
(b) Exercising rights and performing obligations arising from transactions with Personal Data Subjects for the provision of goods and services to Personal Data Subjects, such as: provision; delivery; installation; payment; issuance of invoices; returns and refunds; data reconciliation with relevant partners; and other rights and obligations in accordance with law and agreements between ADV and Personal Data Subjects from time to time;
(c) Providing care, communicating with and responding to questions, requests or complaints from Personal Data Subjects; taking necessary support measures to resolve matters arising in connection with questions, requests or complaints from Personal Data Subjects;
(d) Contacting and communicating with Data Subjects in cases where Data Subjects apply for positions recruited by ADV. The processing of candidates’ personal data during the recruitment process shall be carried out in accordance with this Personal Data Protection Policy and Appendix 01 – Consent to the Provision and Processing of Personal Data for Recruitment Activities at ADV.
3.2. Serving ADV’s operational purposes and complying with legal regulations:
(a) Analyzing, synthesizing, storing, reporting and conducting statistics for business and operational activities; conducting measurement and actual assessment to develop business and marketing strategies, as well as improving the quality of ADV’s goods and services in order to provide better experiences within the scope permitted by law.
(b) Performing ADV’s obligations under law and at the request of competent state authorities, such as regulations on inspection, examination, audit, statistics, reporting, finance, accounting and taxation, and/or other relevant legal regulations or requests from competent state authorities.
4. Means of Processing Personal Data
ADV uses appropriate means to Process Personal Data of Personal Data Subjects, including:
(a) Electronic means (digital): Software systems, applications, websites, server systems and cloud computing;
(b) Physical means: Computers, telephones, hard drives, memory cards, scanning devices, audio and video recording devices;
(c) Non-electronic means: Paper records, books, printed documents and handwritten documents;
(d) Other necessary and appropriate means that are not contrary to law.
5. Correction of Personal Data
(a) Personal Data Subjects may access and correct certain Personal Data of themselves displayed on ADV’s websites or applications (note: this applies only to Personal Data fields for which self-correction functionality is available);
(b) For Personal Data that Personal Data Subjects cannot correct themselves, Personal Data Subjects have the right to request ADV to correct such Personal Data in accordance with law.
6. Deletion and Destruction of Personal Data
(a) Personal Data shall be deleted and destroyed in accordance with law;
(b) Unless otherwise provided by law, ADV will proactively delete and destroy Personal Data when necessary to ensure appropriate and secure data management.
7. Other Activities in the Processing of Personal Data
(a) Unless otherwise provided by law, ADV will store, access, retrieve, connect, coordinate, confirm, authenticate and conduct other activities affecting Personal Data in accordance with the agreed purposes;
(b) The storage, access, retrieval, connection, coordination, confirmation, authentication and other activities affecting Personal Data shall be carried out in accordance with law and in forms appropriate to ADV’s activities.
8. Provision and Transfer of Personal Data
Depending on each case, ADV may provide and transfer Personal Data within the territory of Vietnam or overseas as follows:
(a) Provide Personal Data of the Personal Data Subject to the Personal Data Subject and/or other agencies, organizations or individuals when the Personal Data Subject makes a request in accordance with law and within ADV’s ability to provide;
(b) Transfer or provide Personal Data for further processing:
(i) in cases of division, separation, merger, consolidation or termination of ADV’s operations;
(ii) to an entity or organization established as a result of the termination of ADV’s operations;
(iii) when conducting other activities in accordance with the laws on investment and business;
(c) Transfer or provide Personal Data to Personal Data Processors or third parties for processing Personal Data in accordance with regulations;
(d) Transfer or provide Personal Data at the request of competent state authorities;
(e) Transfer or provide Personal Data to related parties, affiliated parties of ADV, parties directly or indirectly related to ADV, and member companies within the AEON Group;
(f) Transfer or provide Personal Data to: (i) partners providing products, goods, services, infrastructure and information technology solutions and cloud computing; (ii) agents; (iii) business cooperation partners; (iv) consultants, advisors, auditors and lawyers.
Parties to whom ADV provides Personal Data or who receive transferred Personal Data are responsible for processing and protecting Personal Data in accordance with law and agreements and contracts with ADV.
9. Disclosure of Personal Data
ADV may disclose Personal Data by means appropriate and compliant with law in cases where necessary to ensure the safety of property, health, life, rights and legitimate interests of Personal Data Subjects.
10. Personal Data Controller and Personal Data Controller and Processor
Depending on each case, AEON Delight Vietnam Company Limited may act as a Personal Data Controller or a Personal Data Controller and Processor.
11. Rights and Obligations of Personal Data Subjects
11.1. Rights of Personal Data Subjects:
(a) To be informed of Personal Data processing activities.
(b) To consent or not consent, and to request withdrawal of consent to the processing of Personal Data.
(c) To access, correct or request correction of Personal Data.
(d) To request the provision, deletion or restriction of processing of Personal Data; and to object to the processing of Personal Data.
(e) To complain, denounce, initiate legal proceedings and request compensation for damages in accordance with law.
(f) To request competent authorities or agencies, organizations or individuals involved in the processing of Personal Data to implement measures and solutions to protect their Personal Data in accordance with law.
(g) Other rights as prescribed by law.
11.2. Obligations of Personal Data Subjects:
(a) To protect their own Personal Data.
(b) To respect and protect the Personal Data of others.
(c) To provide their Personal Data fully and accurately in accordance with law, contracts or upon consenting to the Processing of their Personal Data.
(d) To comply with laws on Personal Data protection and participate in preventing and combating activities that infringe upon Personal Data.
(e) Other obligations as prescribed by law.
11.3. When exercising their rights and obligations, Personal Data Subjects must fully comply with the following principles:
(a) To comply with law and their obligations as Personal Data Subjects. The exercise of rights and performance of obligations by Personal Data Subjects must be for the purpose of protecting their legitimate rights and interests;
(b) Not to cause difficulties or obstruct the exercise of the legal rights and obligations of Personal Data Controllers, Personal Data Controllers and Processors, and Personal Data Processors;
(c) Not to infringe upon the legitimate rights and interests of the State, agencies, organizations or other individuals.
12. Confidentiality of Personal Data
The Company applies appropriate administrative, technical and organizational measures to protect information of Data Subjects against unauthorized access, collection, use, disclosure, modification, copying, transmission, storage or processing, as well as risks of loss, damage, destruction or other risks that may affect the confidentiality, integrity and availability of the information.
Such measures include establishing authorization and access control mechanisms to ensure that only authorized or designated individuals, departments or organizations may access Data Subject Information to the extent necessary to perform their work; applying appropriate technical measures such as data encryption (where necessary), etc.; and reviewing, updating and upgrading security measures to minimize risks, etc.
However, ADV cannot completely and absolutely eliminate all risks during the processing, storage and transmission of Personal Data in electronic environments or through other means. Upon detecting an incident relating to the Personal Data of a Data Subject, ADV will take measures to handle the incident in accordance with law and its internal procedures in order to limit consequences, remedy the incident and notify the Data Subject and competent authorities as required by law.
The Data Subject agrees that, to the extent ADV has applied reasonable measures to prevent such risks, ADV shall not be liable for compensation for damages caused by the acts of any third party that adversely affect the Data Subject and are beyond ADV’s reasonable control.
13. Contact Information
In case a Personal Data Subject: (i) has any questions or inquiries regarding Personal Data Processing activities relating to such Personal Data Subject; or (ii) requests the exercise of the rights of a Personal Data Subject, the Personal Data Subject may contact:
AEON Delight Vietnam Company Limited
Head office address: 3A Floor, Intan Building, No. 97 Nguyen Van Troi Street, Phu Nhuan Ward, Ho Chi Minh City.
14. Effective Date of the Notice
This Notice shall take effect from ___ day of ___ month ___ year 2026.
Appendix 01
CONSENT TO THE PROVISION AND PROCESSING OF PERSONAL DATA FOR RECRUITMENT ACTIVITIES AT ADV.
By this document, the Data Subject (hereinafter referred to as "Candidate") agrees to the following contents:
1. The Candidate consents to provide Aeon Delight (Vietnam) Co., Ltd (ADV) – the Personal Data Controller or the Personal Data Controller and Processor (as the case may be) - with the following personal data of the Candidate:
(a) Basic personal data (full name, gender, date of birth, place of birth, place of birth registration, permanent address, temporary address, current residence, hometown, contact address, nationality, ID card, personal image, phone number, personal identification number, passport number, marital status, family information, etc.).
(b) Data associated with personal privacy called sensitive personal data (such as health status, ethnic origin, religious views, bank account numbers, etc.).
(c) Other data such as: educational background, expertise, skills, information in application letters, CVs, work experience, professional reference information, interview results - competency assessment, etc., provided by the Candidate to ADV or information ADV obtains from complying with legal regulations or fulfilling agreements.
2. The Candidate consents to ADV processing all of the Candidate’s data specified in Section 1 for the following purposes:
(a) Collecting information of the Candidate for recruitment according to ADV's needs; analyzing and evaluating Candidate profiles; Interviewing and evaluating Candidate interview results; performing reports related to recruitment work;
(b) Using as input information when the Candidate is recruited to work at ADV;
(c) Storing records for current recruitment and/or suitable positions in the future;
(d) Other purposes serving ADV's recruitment work (if any).
3. The Candidate understands that processing personal data is an activity that affects the Candidate’s personal data, including one or more of the following activities: collecting, analyzing, synthesizing, encoding, decoding, editing, deleting, destroying, de-identifying, providing, publicizing, transferring personal data, and other activities that affect personal data. And the Candidate also understands that if the Candidate do not provide or restrict the provision of the Candidate’s personal data, ADV will not be able to perform part or all of the purposes as in Section 2 and therefore will have no basis to evaluate and process the Candidate’s application for recruitment for the positions that ADV is posting.
4. The Candidate understands and agrees that the provision of the Candidate’s personal data to ADV can take place at any time during the process of recruiting the Candidate to work at ADV.
5. The Candidate allows ADV to process the Candidate’s personal data during the recruitment process and even if the Candidate is not recruited to serve the purposes stated in Section 2.
6. The Candidate agrees that ADV will not have to send the Candidate a notification every time the Candidate’s personal data is processed for the purposes stated in Section 2. Any processing for purposes other than those specified in Section 2 shall only be carried out after ADV has provided further notice and obtained the Candidate’s consent.
7. The Candidate agrees to let ADV share/transfer the Candidate’s personal data to third parties who are member companies of the Aeon Group inside or outside the territory of Vietnam or functional agencies/partners/suppliers/customers of ADV to perform recruitment management activities stated in Section 1.
The Candidate understands that:
(a) The Candidate has the right to withdraw their consent at any time;
(b) The withdrawal of consent does not affect the lawfulness of the data processing prior to the withdrawal;
(c) The Candidate has the right to request to view, edit, restrict processing, or delete personal data in accordance with the law.
The Candidate undertakes to comply with the above provisions and shall bear full responsibility for any issues arising therefrom.
By signing/confirming this document, the Candidate voluntarily, and with full civil capacity, has understood the entire content of the document and agrees to allow ADV to collect and process the Candidate’s personal data according to the contents mentioned above.
