Legal Officer (7 months contract)

PERSONAL DATA PROTECTION POLICY

AEON Delight (Vietnam) Company Limited (hereinafter referred to as “ADV”), having its registered office at 3A Floor, Intan Building, No. 97 Nguyen Van Troi Street, Phu Nhuan Ward, Ho Chi Minh City, always places importance on compliance with the provisions of law in general and, in particular, the laws on protection of Personal Data when Processing Personal Data.

Therefore, ADV establishes and notifies Data Subjects of this Personal Data Protection Policy.

Data Subjects are required to carefully read this Policy, including its amended and supplemented versions, before providing Personal Data to ADV. ADV will proactively update the contents of this Policy to reflect any changes and will obtain the consent of the Personal Data Subject again where required by law.

This Policy is prepared and used in Vietnamese. This Policy may be translated from Vietnamese into a foreign language or vice versa (if any) for reference purposes only. The Vietnamese version of this Policy shall serve as the official basis for notification, agreement, interpretation and handling of relevant matters.

1. Definitions

Capitalized terms used in this Policy shall have the following meanings:

Personal Data: means digital data or information in another form that identifies or helps identify a specific individual, including Basic Personal Data and Sensitive Personal Data. Personal Data after anonymization is no longer Personal Data.

Processing of Personal Data: means an activity that affects Personal Data, including one or more of the following activities: collection, analysis, synthesis, encryption, decryption, modification, deletion, destruction, anonymization, provision, disclosure, transfer of Personal Data and other activities that affect Personal Data.

Personal Data Subject: means the person to whom the Personal Data relates.

Personal Data Controller: means an agency, organization or individual that determines the purposes and means of processing Personal Data.

Personal Data Controller and Processor: means an agency, organization or individual that determines the purposes and means and directly processes Personal Data.

In case the Law on Personal Data Protection provides otherwise regarding the Capitalized Terms in this Section 1, such Capitalized Terms shall be interpreted in accordance with the corresponding provisions.

2. Types of Personal Data Processed

Unless otherwise provided by law, the types of Personal Data of Data Subjects that ADV collects in whole or in part include:

2.1. Basic Personal Data:

1. Full name at birth and other names (if any);

2. Date, month and year of birth;

3. Gender;

4. Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current place of residence, hometown and contact address;

5. Nationality;

6. Images of the individual;

7. Telephone number;

8. Marital status;

9. Information on family relationships (parents, children, spouse);

10. Information on the individual’s digital account;

11. Email address;

12. Identity card number, Citizen Identity Card number, passport number, personal identification number and personal tax identification number;

13. Date of issuance, month and year of issuance, and place of issuance of the identity card, Citizen Identity Card, identity card or other personal legal documents of a similar nature;

14. Information on occupation and field of work;

15. Other information associated with a specific individual or helping identify a specific individual that is not Sensitive Personal Data;

16. Other Basic Personal Data as prescribed by law from time to time.

2.2. Sensitive Personal Data:

1. Data revealing racial or ethnic origin;

2. Political, religious or belief opinions;

3. Health status;

4. Biometric data and genetic characteristics;

5. Images of identity cards, Citizen Identity Cards and identity cards;

6. Bank card information and data on the transaction history of bank accounts with ADV;

7. Data tracking behavior and activities involving the use of telecommunications services, social networks, online communication services and other services in cyberspace;

8. Personal Data reflecting activities and history of activities in cyberspace, including:

3. Purposes of Processing Personal Data

The Personal Data specified in Section 2 of this Policy may be processed for the following purposes:

3.1. Identification, verification of information, support, contact and communication with Data Subjects:

1. Contacting and checking information of Personal Data Subjects; assessing the ability to provide goods and services to Personal Data Subjects; preparing quotations; entering into orders, contracts and related documents with Personal Data Subjects;

2. Exercising rights and performing obligations arising from transactions with Personal Data Subjects for the provision of goods and services to Personal Data Subjects, such as: provision; delivery; installation; payment; issuance of invoices; returns and refunds; data reconciliation with relevant partners; and other rights and obligations in accordance with law and agreements between ADV and Personal Data Subjects from time to time;

3. Providing care, communicating with and responding to questions, requests or complaints from Personal Data Subjects; taking necessary support measures to resolve matters arising in connection with questions, requests or complaints from Personal Data Subjects;

4. Contacting and communicating with Data Subjects in cases where Data Subjects apply for positions recruited by ADV.

3.2. Serving ADV’s operational purposes and complying with legal regulations:

1. Analyzing, synthesizing, storing, reporting and conducting statistics for business and operational activities; conducting measurement and actual assessment to develop business and marketing strategies, as well as improving the quality of ADV’s goods and services in order to provide better experiences within the scope permitted by law.

2. Performing ADV’s obligations under law and at the request of competent state authorities, such as regulations on inspection, examination, audit, statistics, reporting, finance, accounting and taxation, and/or other relevant legal regulations or requests from competent state authorities.

4. Means of Processing Personal Data

ADV uses appropriate means to Process Personal Data of Personal Data Subjects, including:

1. Electronic means (digital): Software systems, applications, websites, server systems and cloud computing;

2. Physical means: Computers, telephones, hard drives, memory cards, scanning devices, audio and video recording devices;

3. Non-electronic means: Paper records, books, printed documents and handwritten documents;

4. Other necessary and appropriate means that are not contrary to law.

5. Correction of Personal Data

Personal Data Subjects may access and correct certain Personal Data of themselves displayed on ADV’s websites or applications (note: this applies only to Personal Data fields for which self-correction functionality is available);

For Personal Data that Personal Data Subjects cannot correct themselves, Personal Data Subjects have the right to request ADV to correct such Personal Data in accordance with law.

6. Deletion and Destruction of Personal Data

Personal Data shall be deleted and destroyed in accordance with law;

Unless otherwise provided by law, ADV will proactively delete and destroy Personal Data when necessary to ensure appropriate and secure data management.

7. Other Activities in the Processing of Personal Data

Unless otherwise provided by law, ADV will store, access, retrieve, connect, coordinate, confirm, authenticate and conduct other activities affecting Personal Data in accordance with the agreed purposes;

The storage, access, retrieval, connection, coordination, confirmation, authentication and other activities affecting Personal Data shall be carried out in accordance with law and in forms appropriate to ADV’s activities.

8. Provision and Transfer of Personal Data

Depending on each case, ADV may provide and transfer Personal Data within the territory of Vietnam or overseas as follows:

1. Provide Personal Data of the Personal Data Subject to the Personal Data Subject and/or other agencies, organizations or individuals when the Personal Data Subject makes a request in accordance with law and within ADV’s ability to provide;

2. Transfer or provide Personal Data for further processing:

   • in cases of division, separation, merger, consolidation or termination of ADV’s operations;

   • to an entity or organization established as a result of the termination of ADV’s operations;

   • when conducting other activities in accordance with the laws on investment and business;

3. Transfer or provide Personal Data to Personal Data Processors or third parties for processing Personal Data in accordance with regulations;

4. Transfer or provide Personal Data at the request of competent state authorities;

5. Transfer or provide Personal Data to related parties, affiliated parties of ADV, parties directly or indirectly related to ADV, and member companies within the AEON Group;

6. Transfer or provide Personal Data to: (i) partners providing products, goods, services, infrastructure and information technology solutions and cloud computing; (ii) agents; (iii) business cooperation partners; (iv) consultants, advisors, auditors and lawyers.

Parties to whom ADV provides Personal Data or who receive transferred Personal Data are responsible for processing and protecting Personal Data in accordance with law and agreements and contracts with ADV.

9. Disclosure of Personal Data

ADV may disclose Personal Data by means appropriate and compliant with law in cases where necessary to ensure the safety of property, health, life, rights and legitimate interests of Personal Data Subjects.

10. Personal Data Controller and Personal Data Controller and Processor

Depending on each case, AEON Delight Vietnam Company Limited may act as a Personal Data Controller or a Personal Data Controller and Processor.

11. Rights and Obligations of Personal Data Subjects

11.1. Rights of Personal Data Subjects:

1. To be informed of Personal Data processing activities.

2. To consent or not consent, and to request withdrawal of consent to the processing of Personal Data.

3. To access, correct or request correction of Personal Data.

4. To request the provision, deletion or restriction of processing of Personal Data; and to object to the processing of Personal Data.

5. To complain, denounce, initiate legal proceedings and request compensation for damages in accordance with law.

6. To request competent authorities or agencies, organizations or individuals involved in the processing of Personal Data to implement measures and solutions to protect their Personal Data in accordance with law.

7. Other rights as prescribed by law.

11.2. Obligations of Personal Data Subjects:

1. To protect their own Personal Data.

2. To respect and protect the Personal Data of others.

3. To provide their Personal Data fully and accurately in accordance with law, contracts or upon consenting to the Processing of their Personal Data.

4. To comply with laws on Personal Data protection and participate in preventing and combating activities that infringe upon Personal Data.

5. Other obligations as prescribed by law.

11.3. When exercising their rights and obligations, Personal Data Subjects must fully comply with the following principles:

1. To comply with law and their obligations as Personal Data Subjects. The exercise of rights and performance of obligations by Personal Data Subjects must be for the purpose of protecting their legitimate rights and interests;

2. Not to cause difficulties or obstruct the exercise of the legal rights and obligations of Personal Data Controllers, Personal Data Controllers and Processors, and Personal Data Processors;

3. Not to infringe upon the legitimate rights and interests of the State, agencies, organizations or other individuals.

12. Confidentiality of Personal Data

The Company applies appropriate administrative, technical and organizational measures to protect information of Data Subjects against unauthorized access, collection, use, disclosure, modification, copying, transmission, storage or processing, as well as risks of loss, damage, destruction or other risks that may affect the confidentiality, integrity and availability of the information.

Such measures include establishing authorization and access control mechanisms to ensure that only authorized or designated individuals, departments or organizations may access Data Subject Information to the extent necessary to perform their work; applying appropriate technical measures such as data encryption (where necessary), etc.; and reviewing, updating and upgrading security measures to minimize risks, etc.

However, ADV cannot completely and absolutely eliminate all risks during the processing, storage and transmission of Personal Data in electronic environments or through other means. Upon detecting an incident relating to the Personal Data of a Data Subject, ADV will take measures to handle the incident in accordance with law and its internal procedures in order to limit consequences, remedy the incident and notify the Data Subject and competent authorities as required by law.

The Data Subject agrees that, to the extent ADV has applied reasonable measures to prevent such risks, ADV shall not be liable for compensation for damages caused by the acts of any third party that adversely affect the Data Subject and are beyond ADV’s reasonable control.

13. Contact Information

In case a Personal Data Subject: (i) has any questions or inquiries regarding Personal Data Processing activities relating to such Personal Data Subject; or (ii) requests the exercise of the rights of a Personal Data Subject, the Personal Data Subject may contact:

– AEON Delight Vietnam Company Limited

– Head office address: 3A Floor, Intan Building, No. 97 Nguyen Van Troi Street, Phu Nhuan Ward, Ho Chi Minh City.

– Email: adv.marketting@aeondelight.biz

14. Effective Date of the Notice

This Notice shall take effect from ___ day of ___ month ___ year 2026.