PERSONAL DATA PROTECTION POLICY

Pho Tue Software and Technology Solutions Joint Stock Company (Pho Tue SoftWare Solutions JSC)

(Issued with Decision No. 582/QD-TTDL dated December 22, 2023 of Pho Tue Software and Technology Solutions Joint Stock Company)

     Pho Tue Software and Technology Solutions Joint Stock Company (“Pho Tue SoftWare Solutions JSC”) always values ​​the privacy and protection of Customers' Personal Data. We understand that, through this Personal Data Protection Policy (“Policy”), you will be transparent about the contents related to how we process and protect your Personal Data during the process of searching, accessing, purchasing, registering to use, using Products, goods, and services of Pho Tue SoftWare Solutions JSC to ensure that Personal Data is always private and safe according to the law as well as the security standards of Pho Tue SoftWare Solutions JSC.

      This Policy is a Notice of Personal Data Processing and Protection, which may be changed as necessary and the most updated version will be posted on our official Website. Therefore, we recommend that you periodically review the Policy on our Website.

ARTICLE 1. DEFINITIONS

In this Policy, the following terms are construed as follows:

1. Pho Tue SoftWare Solutions JSC: is Pho Tue Software and Technology Solutions Joint Stock Company, Business Registration Certificate No. 0318222903; Address according to Business License at 128 Binh My Street, Binh My Commune, Cu Chi District, Ho Chi Minh City, Vietnam.
2. Customer: is (i) an individual and/or (ii) an organization providing personal data in the activities of searching, accessing, purchasing, registering to use, and using Products, goods, and services of Pho Tue SoftWare Solutions JSC.
3. Products, goods, services are any products, goods, services provided by Pho Tue SoftWare Solutions JSC and/or by Pho Tue SoftWare Solutions JSC in cooperation with partners that Customers search for, access, purchase, register to use, use.
4. Personal data: is information in the form of symbols, letters, numbers, images, sounds or similar forms in the electronic environment associated with a specific Customer or helping to identify a specific Customer. Personal data includes Basic Personal Data and Sensitive Personal Data.
5. Basic personal data includes:
6. Last name, middle name and birth name, other names (if any);
7. Date of birth; date of death or disappearance;
8. Gender;
9. Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address;
10. Nationality;
11. Personal image;
12. Telephone number, identity card number, citizen identification number, personal identification number, passport number, driver's license number, vehicle license plate number, personal tax code number, social insurance number, health insurance card number;
13. Information about family relationships (parents, children);
14. Information about personal digital accounts; email address;
15. Information about the Customer's use of telecommunications services, including: information related to the use of voice and text messaging services (including but not limited to the phone number initiating the call, the phone number receiving the call, the time of initiating and ending the call, the time of calling, the phone number sending the message, the phone number receiving the message, the time of sending and receiving the message); registered packages and billing information (information about usage fees, outstanding fees, prepaid fees, etc.); service fees, charges; mobile data usage history (sms, value-added services, data...), mobile data usage time; usage capacity, history and frequency of use of Products, goods, services; IP address; information on product, goods, services reviews/complaints/repair requests/troubleshooting;
16. Personal data reflecting activities, activity history on cyberspace, including but not limited to: data related to Websites/wapsites/social networks or Applications; technical data (including device type, operating system, browser type, browser settings, IP address, language settings, date and time of connection to the Website, Application usage statistics, Application settings, date and time of connection to the Application, other technical communication information); account name; password; security login details; usage data; cookie data; browsing history; clickstream data; channel viewing history, VOD (video on demand);
17. Other information associated with a specific Customer or helping to identify a specific Customer as required by law from time to time that is not within the scope of Sensitive Personal Data as defined in Clause 6 of this Article.
6. Sensitive personal data: is Personal data associated with the privacy of Customers that, when violated, will directly affect the legitimate rights and interests of Customers, including but not limited to the following types of data:
   1. Customer's telecommunications account information, including: payment history, account top-up, telecommunications account balance;
   2. Information related to the Customer's use of payment intermediary services, including: customer identification information according to law, account information, deposit information, deposit information, transaction information, information about organizations and individuals who are guarantors at credit institutions, bank branches, and organizations providing payment intermediary services;
   3. Information related to ethnic origin, physical attributes, and unique biological characteristics that you provide to Pho Tue SoftWare Solutions JSC or we obtain during the process of customers purchasing and using products, goods, and services;
   4. Customer location data is determined via location services;
   5. Other personal data is specified by law as specific and requires necessary security measures.
7. Processing of Personal Data: is one or more activities affecting Personal Data, such as: collecting, recording, analyzing, validating, storing, editing, publishing, combining, accessing, retrieving, withdrawing, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying Personal Data or other related actions.
8. Personal Data Controller: is the organization or individual who decides the purpose and means of Processing Personal Data.
9. Personal Data Processor: is an organization or individual that processes Personal Data on behalf of the Personal Data Controller, through a contract or agreement with the Personal Data Controller.
10. Personal Data Controller and Processor: is an organization or individual that simultaneously decides the purpose, means and directly processes Personal Data.

11. Pho Tue SoftWare Solutions JSC's transaction channels: include call center channels, electronic transaction channels (applications, electronic information pages such as https://photuesoftware.com, social networks) and physical transaction channels (Branch, business location, etc. of Pho Tue SoftWare Solutions JSC) or other transaction channels depending on the time provided or authorized by Pho Tue SoftWare Solutions JSC to provide to Customers.

    ARTICLE 2. TYPES OF PERSONAL DATA PROCESSED

12. Personal data processed includes data provided by Customers to us when searching for, accessing, purchasing, registering to use, using Products, goods, services and data arising during the process of Customers using our Products, goods, services, specifically as follows:
13. Basic personal data specified in Clause 5, Article 1 of this Policy; and
14. Sensitive personal data specified in Clause 6, Article 1 of this Policy.
15. Personal data is processed in accordance with each type of Product, goods, and service.

ARTICLE 3. PURPOSE OF DATA PROCESSING

Personal data pursuant to Article 2 above may be processed for the following purposes:

1. Providing Products, goods and services to Customers under the Contract and performing the rights and obligations of Pho Tue SoftWare Solutions JSC in accordance with the law, including but not limited to:
2. Serving business management activities; operating, exploiting, optimizing the quality of networks, mobile services, television, Internet and other services provided by Pho Tue SoftWare Solutions JSC; handling network incidents; providing and improving the quality of telecommunications, television and information technology services of Pho Tue SoftWare Solutions JSC;
3. Authenticate and perform payment transactions; reconcile charges, pay charges; exchange and provide information related to telecommunications service users with other telecommunications enterprises to serve the purpose of calculating charges, invoicing and preventing acts of evading contractual obligations within the scope permitted by law; Check with Pho Tue SoftWare Solutions JSC's cooperation partners for the purpose of providing Products, goods and services to Customers;
4. Provide, activate or verify Products, goods and services requested by Customers according to the Request Form/Contract or through Pho Tue SoftWare Solutions JSC's Transaction Channel or other requests of Customers arising during the process of searching, accessing, purchasing, registering to use, using Products, goods and services;
5. Serve the purpose of contacting and notifying Customers;
6. Exercise the rights of Customers related to Personal Data according to the provisions of law, the agreement between Customers and Pho Tue SoftWare Solutions JSC;
7. Perform the contractual obligations of Customers and the obligations of Pho Tue SoftWare Solutions JSC with relevant agencies, organizations and individuals according to the provisions of law;
8. Publicize Customers' Personal Data according to the provisions of law;
9. Perform the obligations of Pho Tue SoftWare Solutions JSC on inspection, examination, statistics, reporting, finance, accounting and tax;
10. Perform data security assurance operations; ensure the security of Pho Tue SoftWare Solutions JSC's information system such as backup, reserve, monitoring, resource optimization and protection of customer personal data;
11. Detect and prevent illegal acts in cyberspace at the request of competent state agencies and legal regulations, including but not limited to: spam messages, spam emails, spam calls, messages with the purpose of fraud, emails with the purpose of fraud, calls with the purpose of fraud;
12. Detect and prevent acts of fraud, scams, attacks, intrusions, illegal appropriation, criminal acts and other illegal acts;
13. Carry out activities for the purpose of auditing, risk management, anti-money laundering, anti-terrorist financing and embargo compliance;
14. In case of emergency regarding national defense, national security, social order and safety, major disasters, dangerous epidemics; when there is a threat to national security and defense but not to the extent of declaring a state of emergency; preventing and combating riots, terrorism, preventing and combating crimes and violations of the law according to the provisions of law;
15. Serving the activities of state agencies according to the provisions of specialized laws.
16. Support Customers when purchasing and using Products, goods and services provided by Pho Tue SoftWare Solutions JSC according to the contract and legal regulations, including:
17. Updating and processing information when Customers purchase and use Products, goods and services;
18. Customer care, receiving and resolving Customer inquiries and complaints regarding Products, goods and services of Pho Tue SoftWare Solutions JSC;
19. Using and transferring to partners Personal data, information on problems, incidents, error reports reflected by Customers to identify and fix problems with Products, goods and services; repairing Customer equipment; performing other activities related to Customer care and support.
20. Improve the quality of Products, goods and services that Pho Tue SoftWare Solutions JSC provides to Customers:
21. Provide information that Customers have requested or that Pho Tue SoftWare Solutions JSC believes Customers may find useful, including information about Products, goods and services of Pho Tue SoftWare Solutions JSC in accordance with the law;
22. Improve technology, interface of the Website, wapsite, social network, Application to ensure convenience for Customers;
23. Manage Customer accounts and Loyalty Customer programs;
24. Store information, market research, analysis, statistics and other internal management activities to improve Customer experience;
25. Report, statistics, analyze internal data to research, build, develop, manage, measure, provide and improve Products, goods, services as well as operate the business activities of Pho Tue SoftWare Solutions JSC;
26. Build marketing campaigns for Products, goods, services and determine how Pho Tue SoftWare Solutions JSC can personalize those products, goods and services;
27. Develop and provide new Products, goods and services that are personalized according to the needs and actual conditions of Customers with effective measurement methods;
28. Introduce and provide promotional programs for Products, goods, services, incentives, promotions of Pho Tue SoftWare Solutions JSC and of Pho Tue SoftWare Solutions JSC in cooperation with partners;
29. Evaluate the ability to purchase and use Products, goods and services of Pho Tue SoftWare Solutions JSC through the telecommunications rating of Customers to best support in providing products, goods and services to Customers.
30. Providing marketing, advertising, and product introduction services that are suitable for the needs of Customers or that Pho Tue SoftWare Solutions JSC believes that Customers are interested in, according to the following content, form, and frequency:
31. Content: Introducing information about products, goods, services, and promotions provided by Pho Tue SoftWare Solutions JSCC and Pho Tue SoftWare Solutions JSC's partners;
32. Method: Through advertising messages (SMS, USSD, MMS...), IVR calls, notifications on Pho Tue SoftWare Solutions JSC's Transaction Channel or other methods as prescribed by law;
33. Form: Sending directly to Customers via devices, electronic means or other forms on cyberspace as prescribed by law;
34. Frequency: According to the legal regulations on advertising.
35. Providing market research, public opinion polling, and brokerage services;
36. Organizing trade introductions and promotions.

ARTICLE 4. DATA PROCESSING METHOD

1. How it is collected

   Personal data is collected directly from you in the following cases:

1. From Pho Tue SoftWare Solutions JSC Websites: We may collect Personal Data when you visit any Pho Tue SoftWare Solutions JSC website (collectively, the “Website”) or use any features or resources available on or through the Website. When you visit the Website, Pho Tue SoftWare Solutions JSC collects information about your device and browser (such as device type, operating system, browser type, browser settings, IP address, language settings, date and time of connection to the Website, and other technical communications);
2. From Applications: We may collect Personal Data when you download or use Pho Tue SoftWare Solutions JSC’s mobile applications (collectively, the “Applications”). These Applications may record certain information (including statistics when using the Application, device type, operating system, Application settings, IP address, language settings, date and time of connection to the Application and other technical communication information);
3. From Products, goods, services: We may collect Personal Data when you search, access, purchase, register to use, use any Products, goods, services through any form (SMS, USSD, IVR, website, wapsite, application...); Pho Tue SoftWare Solutions JSC's transaction channels, cyberspace; and/or other methods as prescribed by law;
4. From exchanges and communications with Customers: We may collect Personal Data through interactions between Us and You (in person, by mail, telephone, online, switchboard system, electronic communication or any other means) including Customer surveys;
5. From social networks: Pho Tue SoftWare Solutions JSC's social networks and/or social networks in which we cooperate with partners;
6. From recording and filming devices placed at stores, business locations or places where part or all of Pho Tue SoftWare Solutions JSC's business activities are carried out where You meet, appear or interact with us. The placement of recording and filming devices is intended to contribute to protecting social order and safety, protecting the legitimate rights and interests of Customers and Pho Tue SoftWare Solutions JSC in accordance with the law;
7. From interactions or automated data collection technologies: We may collect information including IP address, referring URL, operating system, browser, and any other information automatically recorded from the connection:
8. Cookies, flash cookies, plug-ins, pixel tags, beacons, third-party social media connectors, or other tracking technologies;
9. Any technology capable of tracking individual activity across devices or Websites;
10. Other data information provided by a device.
11. Other means: We may collect Personal Data when you interact with Pho Tue SoftWare Solutions JSC through any other means.
12. We may also collect Personal Data indirectly from you through public, official information sources; or through receiving necessary data sharing from subsidiaries and partners that they collect during the cooperation process with Pho Tue SoftWare Solutions JSC to provide Products, goods and services to you and are permitted to be shared by you.

1. How to store

   Personal data is stored in Vietnam at Pho Tue SoftWare Solutions JSC's Customer database system or anywhere we or our branches, subsidiaries, affiliates, partners or service providers have facilities and create backups for data centers in other regions.

   During your access to Pho Tue SoftWare Solutions JSC's Electronic Information Page, website, Application, social network, we may also temporarily store information via cookies, clickstream or similar website browsing data storage tools to store data that the web server in the domain can retrieve.

3. How to transfer/share data

We will use necessary security measures to ensure the transfer/sharing of your Personal Data to (i) other telecommunications businesses; (ii) individuals/organizations participating in the Personal Data Processing process specified in Article 8 of this Policy); or (iii) competent state agencies, ensuring information security, no data disclosure, and requiring the parties receiving Personal Data to have data security measures.

4. How to analyze

The analysis of Personal Data is carried out according to the internal procedures of Pho Tue SoftWare Solutions JSC. We always have a strict monitoring mechanism for each data analysis process, which requires checking the compliance with the legal requirements on data security, ensuring information security for the information technology system before conducting the analysis. We also have strict rules to ensure that personal information is anonymized or de-identified at the appropriate stage in the processing process.

5. How to encrypt

Personal data collected is encrypted using appropriate encryption standards where necessary during storage or transfer, to ensure that the data is protected, authenticated, intact and cannot be altered after it has been sent.

6. How to delete data

When you stop using Pho Tue SoftWare Solutions JSC's Products, goods and services and have a valid request, we will proceed to delete Personal Data with all Personal Data that you have provided and/or we have collected during your use of Products, goods and services, except where otherwise provided by law and in some cases where it cannot be done as follows:

1. The law does not allow deletion of data or requires mandatory storage of data;

2. Personal data is processed by competent state agencies for the purpose of serving the activities of state agencies in accordance with the law;

3. Personal data has been made public in accordance with the law;

4. Personal data is processed to serve legal requirements, scientific research, statistics in accordance with the law;

5. In case of emergency regarding national defense, national security, social order and safety, major disasters, dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; preventing and combating riots, terrorism, preventing and combating crimes and violations of the law;

6. Responding to emergency situations that threaten the life, health or safety of Customers or other individuals.

ARTICLE 5. DATA SECURITY PRINCIPLES OF Pho Tue SoftWare Solutions JSC

1. Your personal data is kept confidential in accordance with this Policy and the law.
2. We are responsible for ensuring network information security in accordance with the law, ensuring national defense, national security, state secrets, maintaining political stability, social order and safety, and promoting socio-economic development.
3. When handling network information security incidents, we always ensure your legitimate rights and interests.
4. Network information security activities are carried out regularly, continuously, promptly and effectively.

ARTICLE 6. POSSIBLE UNWANTED CONSEQUENCES AND DAMAGES

1. We use various information security technologies such as: international standards PCI DSS, SSL, firewalls, encryption... to protect and prevent your Personal Data from being accessed, used or shared unintentionally. However, no data can be completely secure. Therefore, we cannot guarantee the absolute security of your Personal Data in some cases such as:
2. Hardware and software errors during data processing that cause loss of Customer data;
3. Security vulnerabilities beyond our control, the system is hacked and data is leaked.
4. We recommend that you keep confidential information related to your account login password, OTP code and do not share this content with anyone else.
5. You need to be aware that at any time you disclose and make public your Personal Data, that data may be collected and used by others for purposes beyond your and our control.
6. We recommend that you keep your personal devices (phones, tablets, personal computers, etc.) safe during use; you should log out of your account when not in use.
7. In the event that the data storage server is attacked, leading to the loss, disclosure, or leakage of Customer Personal Data, Pho Tue SoftWare CO., LTD will be responsible for reporting the incident to the authorities for timely investigation and notification to you in accordance with the law.
8. Cyberspace is not a safe environment and we cannot absolutely guarantee that your Personal Data shared via cyberspace will always be secure. When you transmit Personal Data over the Internet, you should only use secure systems to access a website, application or device. You are responsible for keeping your access credentials for each website, application or device secure and confidential.

ARTICLE 7. TIME OF STARTING AND ENDING PERSONAL DATA PROCESSING

1. Personal Data is processed from the moment we receive the Personal Data provided by you and we have an appropriate legal basis for processing the data in accordance with the law.
2. To the extent permitted by law, Personal Data will be processed until the purposes for which the data is processed have been fulfilled.
3. We may be required to retain your Personal Data even after the contract between you and Pho Tue SoftWare Solutions JSC has terminated in order to fulfill our legal obligations in accordance with the law and/or the request of a competent state agency.

ARTICLE 8. ORGANIZATIONS AND INDIVIDUALS PARTICIPATING IN THE PROCESS OF PERSONAL DATA PROCESSING

1. Depending on the case, we may be the Personal Data Controller or the Personal Data Controller and Processor.
2. To the extent permitted by law, you understand that we may share Personal Data for the purposes mentioned in Article 3 with the following organizations and individuals:
3. Member enterprises, affiliated companies of Pho Tue SoftWare Solutions JSC;
4. Organizations and individuals providing services and/or cooperating with Pho Tue SoftWare Solutions JSC, including but not limited to: agents, consulting units, auditors, lawyers, notaries and business cooperation partners, providing information technology solutions, software, applications, operational services, management, incident handling, infrastructure development;
5. Any individual or organization that is a representative, authorized party of the Customer, acting on behalf of the Customer;
6. Payment service providers based on the authorization or consent of the Customer.
7. Data sharing will be carried out in accordance with the order, manner and current legal regulations. The parties receiving Personal Data are obliged to keep your Personal Data confidential in accordance with this Policy; regulations, procedures, standards on Personal Data Protection of Pho Tue SoftWare Solutions JSC and current legal regulations.
8. We may share your information with competent state agencies when carrying out the purpose of Processing Personal Data stated in Article 3 of this Policy in accordance with the law.

ARTICLE 9. CUSTOMER RIGHTS

1. You are informed about the processing of your Personal Data, unless otherwise provided by law.
2. You are entitled to decide on your consent regarding the processing of your Personal Data, unless otherwise provided by law.
3. You have the right to access, view, edit or request editing of your Personal Data, unless otherwise provided by law.
4. We will edit Personal Data when requested by you or in accordance with specialized law. In case we cannot do so, we will notify you according to the agreement between us and you, and the law.
5. You have the right to delete or request deletion of your Personal Data in accordance with the provisions of Clause 6, Article 4 of this Policy.
6. You have the right to request restriction of the processing of your Personal Data in accordance with the law.
7. We will restrict data processing upon your request in accordance with the technical conditions permitted, unless otherwise provided by law or by agreement of the parties.
8. You have the right to request us to provide you with your Personal Data, unless otherwise provided by law.
9. Pho Tue SoftWare Solutions JSC will provide your Personal Data upon your request, unless otherwise provided by law.
10. You have the right to request the withdrawal of consent for the processing purposes for which you have agreed to allow Pho Tue SoftWare Solutions JSC to process, unless otherwise provided by law. Upon receiving the request, Pho Tue SoftWare Solutions JSC will notify you of the consequences and damages that may occur when withdrawing consent.
11. In case your withdrawal of consent affects the performance of the contract between Pho Tue SoftWare Solutions JSC and you, the legal obligations of Pho Tue SoftWare Solutions JSC, the life, property and rights, legitimate interests of you, other organizations, individuals, the task of protecting national security, social order and safety, we have the right to restrict, suspend, terminate, cancel part or all of the contract to provide products, goods, services between Pho Tue SoftWare Solutions JSC and the Customer.
12. You have the right to object to Pho Tue SoftWare Solutions JSC processing your Personal Data to prevent or limit the disclosure of Personal Data or other reasons as prescribed by law.
13. We will implement your objection request after receiving the request, unless otherwise provided by law.
14. In case your objection affects the performance of the contract between Pho Tue SoftWare Solutions JSC and you, the legal obligations of Pho Tue SoftWare Solutions JSC, the life, property and rights, legitimate interests of you, other organizations, individuals, the task of protecting national security, social order and safety, we have the right to limit, suspend, terminate, cancel part or all of the contract to provide Products, goods, services between Pho Tue SoftWare Solutions JSC and the Customer.
15. You have the right to complain, denounce or file a lawsuit according to the provisions of law.
16. You have the right to request compensation for actual damages according to the provisions of law if Pho Tue SoftWare Solutions JSC violates the regulations on protecting your Personal Data, unless the parties have another agreement or the law provides otherwise.
17. You have the right to self-defense in accordance with relevant laws, including but not limited to the Civil Code, or request competent agencies and organizations to implement civil rights protection methods such as forcing the termination of the infringing act, forcing an apology, public correction, and forcing compensation for damages.
18. Other rights under this Policy and according to the law.
19. You can exercise the rights in clauses 1, 2, 3, 4, 5, 6, 7, 8, 9 and 10 of this Article by accessing the Website https://photuesoftware.com/ or calling the hotline 0865.920.041 or sending an email to supports@photuesoftware.com or other methods according to the law and regulations of Pho Tue SoftWare Solutions JSC at each time. Pho Tue SoftWare Solutions JSCC may verify the necessary information from the Customer to fulfill the Customer's requests.

ARTICLE 10. CUSTOMER OBLIGATIONS

1. Comply with the laws and regulations of Pho Tue SoftWare Solutions JSC related to the processing of your Personal Data.
2. Provide complete, honest and accurate Personal Data and other information as required by Pho Tue SoftWare Solutions JSC when searching, accessing, purchasing, registering to use and using Products, goods and services and when there is a change in this information. We will proceed to secure your Personal Data based on the information you have provided. Therefore, if there is any incorrect information, we will not be responsible in case that information affects or limits your rights. In case of no notification, if there is any risk or loss, you are responsible for any errors or acts of abuse or fraud when using Products, goods and services due to your fault or failure to provide correct, complete, accurate and timely information changes; including financial losses and costs arising from incorrect or inconsistent information provided.
3. Cooperate with us, competent state agencies or third parties in case of issues affecting the security of your Personal Data.
4. Self-protect your Personal Data; request other relevant organizations and individuals to protect your Personal Data; proactively apply measures to protect your Personal Data during the use of Pho Tue SoftWare Solutions JSC's Products, goods and services; promptly notify us when detecting errors or mistakes in Personal Data or suspecting that Personal Data is being violated.
5. Respect and protect the Personal Data of others.
6. Be responsible for the information and data that you create and provide on the Internet; be responsible in case Personal Data is leaked or violated due to your fault.
7. Regularly update regulations and policies related to the protection and processing of Personal Data of Pho Tue SoftWare Solutions JSC in each period notified to you via Pho Tue SoftWare Solutions JSC's Transaction Channel.
8. Implement legal regulations on personal data protection and participate in preventing and combating violations of regulations on personal data protection.
9. Other obligations according to legal regulations.

ARTICLE 11. GENERAL PROVISIONS

1. This Policy is effective from 01/01/2024 and may be amended from time to time and notified to you through Pho Tue SoftWare Solutions JSC's Transaction Channels before being applied. These changes will be effective according to the law.
2. This Policy is a Notice of Personal Data Processing according to current law.