Terms and conditions

TERMS AND CONDITIONS ON PROTECTION OF PERSONAL DATA

IN COMPLIANCE WITH DECREE NO. 13/2023/ND-CP

INTERPRETATION OF WORDS

1.1. “VRB”: means Vietnam – Russia Joint Venture Bank.

1.2. “Personal Data” refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual and detailed in Section 3.1 Terms and conditions on personal data protection.

1.3. “These Terms And Conditions On Personal Data Protection” (hereinafter referred to as “T&C On Protection Of Personal Data” or “T&C”) are an inseparable part and should be read and understood in accordance with the contracts, agreements, terms, conditions and other documents established between the Personal Data Subject and VRB.

1.4. “Personal Data Subject”: means the individual to whom the Personal Data reflects, including but not limited to all individual customers with information at VRB, individuals related to organizational customers at VRB include the legal representative, authorized representative, chief accountant/person in charge of accounting, person introduced to the transaction by the organization... (hereinafter referred to as related individuals in the organization) have information at VRB, customers using VRB's products and services and other relevant individuals according to VRB's regulations from time to time, VRB's employees, capital contributors/capital contribution management representatives and/or other individuals who have legal relationships with VRB.

1.5. “Processing of Personal Data”: is one or more activities affecting personal data, such as: collection, recording, analysis, confirmation, storage, correction, disclosure, combination, retrieval access, retrieve, retrieve, encrypt, decrypt, copy, share, transmit, provide, transfer, delete, destroy personal data or other related actions.

1.6. “Personal Data Processor”: Depending on each case, the Personal Data Processor may be VRB itself or an individual or organization that processes Personal Data on behalf of VRB, through a contract or agreement with VRB.

1.7. “Personal Data Controller”: is the organization or individual that decides the purposes and means of processing personal data. For the purposes of this T&C, the Personal Data Controller may be the VRB.

1.8. “Personal Data Controller and Processor”: is an organization or individual that simultaneously decides on the purpose, means and directly processes personal data. Depending on the circumstances, the Personal Data Controller and Processor may be VRB.

1.9. “Third Party”: means individuals and organizations not affiliated with VRB other than Personal Data Subject, Personal Data Processors, Personal Data Controllers and Processors who are authorized to process personal data.

PURPOSE AND SCOPE OF APPLICATION

2.1. This T&C is intended to transparently inform Personal Data Subject of all information related to the Processing of Personal Data at VRB.

2.2. Subjects of application: Including subjects mentioned in Section 1 - Interpretation of words of this T&C.

2.3. This T&C covers:

a) The types of Personal Data that VRB processes and the manner in which VRB collects Personal Data.
b) Purpose of Personal Data Processing;
c) Other organizations and individuals involved in the processing of Personal Data;
d) How Personal Data is processed;
e) Personal data processing time;
f) Transfer of Personal Data abroad;
g) Unwanted consequences and damage may occur;
h) Rights and obligations of Personal Data Subject;
i) Commitment and confirmation of the Personal Data Subject;
j) Notification, information provision and enforcement.
PERSONAL DATA

3.1. Types of Personal Data

In order for VRB to Process Personal Data for the purposes set out in Section 4.1 of this T&C as well as to comply with other relevant laws, VRB may Process Personal Data, including but not limited to Personal Data at the time of Personal Data Processing and Personal Data modified, supplemented, updated in the future:

3.1.1. “General Personal Data” includes:

a) Last name, middle name and first name, other names (if any);
b) Date of birth; date of death or missing;
c) Gender;
d) Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address;
e) Nationality;
f) Personal image; information obtained from security systems, including image recordings of Personal Data Subject on camera systems and surveillance cameras at VRB's business/transaction locations;
g) Phone number, ID card number, personal identification number (citizen identification number), passport number, driver's license number, license plate number, personal tax code number, insurance number social, health insurance card number;
h) Occupation, workplace;
i) Marital status;
j) Information about family relationships (parents, children);
k) Information about individuals' digital accounts; Personal data reflecting activities and history of activities in cyberspace;
l) Information is automatically collected when Personal Data Subject use VRB's website, mobile applications and other means of communication such as IP address, cookie(s), device code... , use personal digital signatures on VRB programs, applications and accessed information sources;
m) Data created from card or card account operation results, data about how the Personal Data Subject manages and uses the card; the behavior, actions, or preferences of Personal Data Subject expressed on digital platforms;
n) Other information associated with a specific person or helping to identify a specific person that is not covered by Section 3.1.2 of this T&C On Protection Of Personal Data (information on handwriting, signature including signature electronic; information about email, education, degrees, certificates...).

3.1.2. “Sensitive Personal Data”:

a) Political views, religious views;
b) Information related to racial origin and ethnic origin;
c) Information about health status and private life is recorded in medical records, excluding information about blood type;
d) Information about inherited or acquired genetic characteristics of individuals;
e) Information about the individual's physical attributes and biological characteristics;
f) Data on crimes and criminal acts collected and stored by law enforcement agencies;
g) Personal Data Subject information of credit institutions, foreign bank branches, payment intermediary service providers, and other authorized organizations, including: Data Subject identification information Whether the Individual is prescribed by law, account information (including separate accounts or co-owned accounts with any other party), deposit information, information about deposited assets, information about transactions, information about organizations and individuals who are guarantors at credit institutions, bank branches, and intermediary payment service providers;
h) Financial information (income, credit history, tax information,...);
i) Data on the individual's location determined through location services;
j) Other information related to the operation, provision and evaluation of VRB's activities, products and services in accordance with the provisions of law;
k) Biometric data (fingerprint, face, iris, voice and other biometric factors);
l) Other personal data specified by law are special and require necessary security measures.

3.2. How Personal Data is Collected

a) VRB or its data processors or Third Parties authorized to process data for VRB may collect personal data in Section 3.1 of this T&C On Protection Of Personal Data when they Personal Data requested, or in process VRB provides Personal Data Subject with any of VRB's products and services and from a variety of sources, including but not limited to:

(i) Through the relationship between the Personal Data Subject and VRB, including but not limited to information that the Personal Data Subject provides through registration channels as prescribed by VRB from time to time and/ or transaction support documents, when the Personal Data Subject registers, logs in, authenticates the transaction, interacts through available interaction channels of VRB or a Third Party to use products and services of VRB or to carry out transaction agreements, including but not limited to participating in surveys, care, contact, complaints, contests and promotions for Data Subjects Individuals, using biometric features in personal identification and during VRB's credit appraisal of Personal Data Subject;

(ii) Through oral and written communications of the Personal Data Subject with VRB and/or individuals/organizations authorized by VRB;

(iii) From service providers, partners, and consulting units of VRB, including but not limited to: parties conducting surveys, advertising communications in digital space, marketing, fraud prevention, Data collection; parties supporting infrastructure and technological and information facilities, agent banks, VRB's payment intermediaries, parties involved in processing transactions, and organizations supporting identification and verification of identification information. know, broker; commercial partners are product and service providers and other Third Parties related to VRB's business activities;

(iv) From organizations/individuals who have a relationship with the Personal Data Subject, including but not limited to: dependents, legally related persons, spouses, children, parents, sibling, guardian, blood relative, foster, supporter, friend, acquaintance, payee, beneficiary, insured, authorized person, partner, customer, emergency contact, employer, joint account holder, credit grantor, security provider, joint partners, joint managers and joint shareholders or other relevant individuals of the Personal Data Subject whose information VRB must collect to fulfill requests and provide products and services to the Personal Data Subject;

(v) From any credit report provider, credit information provider, credit scorer and government or state agencies in accordance with the provisions of law;

(vi) From the State Bank of Vietnam or other competent agencies in Vietnam or abroad;

(vii) From audio and video files stored from audio recorder/camera systems, surveillance cameras at business/transaction locations, VRB's switchboard system and/or Third Party systems;

(viii) From analysis of how the Personal Data Subject uses and manages the Personal Data Subject's account(s)/facilities at banks and/or from Third Parties, from transactions made by Personal Data Subject and from payment accounts made from/to the Personal Data Subject's account(s)/utilities, activities, Personal Data Subject's behavior includes but is not limited to: information about the application and device used, IP address, software, operating system, location, browser type, referral website address Referrals or visits from available interactive channels, mobile applications, search and lookup activities, information usage, time and number of activations, visits, videos viewed, activity view and interact with advertising content, feedback, versions, advertising formats and related information (if any);

(ix) Through files created by the website visited by the Personal Data Subject (cookie(s)) or similar monitoring devices/tools;

(x) From other information sources (including public and widely disseminated data sources such as websites, social networks, electronic newspapers, print newspapers, and Third Party data sources) with unlimited access to subjects and content and in accordance with legal regulations.

b) In case the customer is an organization and in the process of using VRB's products and services, the organization providing personal data is officers, employees, workers... of that organization to VRB. The legal representative of the organization is responsible for ensuring that providing personal data to VRB for processing must be approved by all Personal Data Subject of that organization.
c) Personal Data may be collected at VRB's network of business units, by individuals within VRB's network and communication systems, including but not limited to websites, banking services Electronic stores, switchboards, conversations via landline and mobile phones, emails, text messages, chat rooms or other means of information exchange by Personal Data Subject.
PROCESSING OF PERSONAL DATA

4.1. Purpose of processing Personal Data

Processing of Personal Data may be carried out by VRB or a Personal Data Processor or Third Party for one or more of the following purposes:

4.1.1. Evaluate and provide products and services of VRB/VRB partners to Personal Data Subject, including but not limited to:

a) Identify, verify and maintain accurate Personal Data Subject identification (KYC) information; Search, verify and conduct inspection activities on prevention of money laundering, terrorist financing, financing of proliferation of weapons of mass destruction (including but not limited to providing information to organizations domestic and foreign credit for the purpose of processing transactions for Personal Data Subject), transaction information, financial, credit and other checks with Personal Data Subject as required;
b) Evaluate, determine, appraise and approve the provision of products and services through registered channels, requests of Personal Data Subject and/or related persons of Personal Data Subject;
c) Evaluate, build and evaluate the level of reliability in using products and services of Personal Data Subject;
d) Consider providing or continuing to provide any products and services of VRB and/or products and services of partners that VRB chooses to cooperate with the Personal Data Subject.

4.1.2. Implement the requests of Personal Data Subject, carry out obligations in contracts, agreements, terms, conditions and other documents between VRB and Personal Data Subject, take care of customers, includes but is not limited to:

a) Fulfill obligations under contracts and agreements on providing products and services to Personal Data Subject;
b) Monitor, urge and evaluate the performance of Data Subject's obligations to VRB;
c) Care, support, and resolve problems, complaints, and lawsuits of Personal Data Subject;
d) Maintain VRB's overall relationship with the Personal Data Subject, including but not limited to: sending notifications, advertising, direct and indirect marketing activities; Introduce and guide registration and use of VRB products and services and/or partner products and services; Care, survey, and evaluate the needs of Personal Data Subject through contact forms such as: voice channels, email, BSMS, OTT message services, etc. or promote financial services and products related to Personal Data Subject and market research conducted by VRB or its domestic and foreign partners; Implement promotional programs, exchange gifts, award prizes, and give gifts.

4.1.3. Understand the needs of using products and services of Personal Data Subject and improve the quality of providing products and services of VRB/VRB's partners, including but not limited to:

a) Better understand the investment needs, risk appetite, current and future financial status of the Personal Data Subject;
b) Improve, enhance, personalize, build, develop or improve the quality of VRB's products and services including VRB's online services and develop new and strategic products and services VRB's advertising and marketing or other strategies;
c) Conduct market research, surveys and data analysis related to any VRB products and services provided to Personal Data Subject; enable interaction between Personal Data Subject, between Personal Data Subject and VRB or with affiliated partners;
d) Data analysis, testing and research, monitoring and analyzing trends and activities of Personal Data Subject on VRB's and/or VRB's partners' platforms displaying features the ability to personalize a Personal Data Subject's experience such as identifying preferences, favorite applications and information of interest; Allows providing and introducing products and services of VRB or VRB's partners based on the needs and habits of Personal Data Subject during interaction and/or use VRB’s products and services; improve customer online experience and measure the effectiveness of marketing activities;
e) Monitor, ensure transaction safety, support and warn customers promptly in emergency situations;
f) Carry out other activities related to VRB's provision, operation and management of VRB's products and services and/or to develop, enhance and strengthen the provision of VRB products and services. VRB's products and services to Personal Data Subject in general; and other purposes that VRB considers appropriate from time to time.

4.1.4. Operate VRB's business operations and internal risk management, including but not limited to:

a) To ensure VRB's legitimate business purposes in cases that VRB considers necessary, including but not limited to exchanging information with VRB, partners, and service providers for VRB ;
b) To input data, to check the completeness and accuracy of the data that the Personal Data Subject provides to VRB and/or the information VRB enters on the system;
c) To comply with agreements and contracts between VRB and other Third Parties;
d) To fulfill reporting, financial, accounting and tax obligations;
e) To carry out activities for audit, risk management and compliance purposes;
f) To serve the internal operational requirements of VRB or its member units (including serving the purposes of credit and risk management, planning and system/network development grid, audit and operations);
g) To provide agencies and organizations providing credit assessment, credit information, and credit scoring services.

4.1.5. Comply with the provisions of law and international treaties to which Vietnam is a member, including but not limited to:

a) To provide to competent state agencies according to the provisions of law;
b) To carry out obligations and comply with legal regulations (including but not limited to legal documents, laws, decrees, directives, official dispatches, etc.), egulations/regulations international rules/treaties that VRB must comply with and/or requirements of competent State agencies;
c) To create data, reports and statistics based on requests from the State Bank of Vietnam or competent authorities according to the provisions of law.

4.1.6. Crime prevention, control and prevention, including but not limited to:

a) To assess risks, analyze trends, make statistics, and plan, including analyzing and processing data on statistics, transactions, credit and preventing money laundering, terrorist financing, financing weapons of mass destruction; to create and maintain a credit scoring system, evaluate and maintain data on the credit history of Personal Data Subject;
b) To detect, prevent and investigate crimes, attacks or violations including fraud, money laundering, terrorism, financing of weapons of mass destruction, bribery, corruption or tax evasion.

4.1.7. Ensure the legitimate rights and interests of VRB and the social community, including but not limited to:

a) To protect or enforce the legal rights and interests of VRB, including the right to collect fees, recover and settle debts owed by Personal Data Subject to VRB;
b) To fulfill responsibilities to the community and society.

4.1.8. Facilitate mergers, acquisitions and divestments of VRB, including but not limited to: To carry out transactions such as transfer, disposition, merger or purchase, sale or exchange of operations , property of VRB. By accepting this T&C On Protection Of Personal Data, Personal Data Subject agree that VRB is authorized to Process Personal Data (including the Personal Data at the time of collection and the Personal Data as updated) for all of the above purposes. In case of processing Personal Data for purposes other than those mentioned above, VRB will only do so in accordance with the agreement with the Personal Data Subject or upon obtaining the consent of the Personal Data Subject.

4.2. Organizations and individuals involved in the Processing of Personal Data

In order to carry out the purposes and activities of Personal Data Processing in this T&C On Protection Of Personal Data, VRB may provide and share Personal Data to the following parties, including but not limited to:

4.2.1. Employees and member units of VRB: Any employee, branch, or transaction office of VRB.

4.2.2. Third Parties support verification of Personal Data Subject information:

a) Units with the function of providing credit information and credit rating services; credit scoring units; credit rating agencies; insurance company; insurance brokers; and other credit service providers;
b) Vietnam National Credit Information Center (CIC) or any agency or organization established by the State Bank of Vietnam or any other agency with agreement or authority over VRB.

4.2.3. Competent authority

a) Competent agencies request information according to the provisions of law;
b) Any court, arbitrator, litigation or judgment enforcement agency that has authority/requests the enforcement of responsibilities from VRB;
c) Any person, authority or regulatory body or third party to whom VRB is authorized or required to disclose under the regulations of any country or under any contract or undertaking between the third party and VRB.

4.2.4. Service provider for VRB and cooperating party to provide services with VRB

a) Any contractors, agents, service providers, consultants or parties cooperating with VRB (including employees, directors, leaders); Organizations that are sellers, suppliers, partners, and agents include, but are not limited to, companies that provide support services for VRB's business activities such as: organizations providing administrative, correspondence, telemarketing, direct sales, call centers, business processes, travel, visas, knowledge management, human resource management, data processing, information technology, computers, billing, debt collection, credit reference and other background checks, market research, data modeling, redemption, record keeping and management, data entry data, pre-screening and verification, legal, website or social media, telecommunications, messaging or email, networking, telephony, infrastructure and technology support , workforce management, risk reporting, credit decisioning, information security, software and licensing maintenance, data centers, conversations and conferences, consulting services, services payment intermediary, switching and/or other services related to, or in support of, the operation of VRB's business;
b) Organizations participating in processing transactions for Personal Data Subject (regardless of whether they are organizations established and operating in Vietnam or not);
c) Business partners and related partners who cooperate with VRB to develop, provide or are related to the development and supply of products, services, and implementation of incentive and promotional programs of VRB/VRB partners.

4.2.5. Individual/organization authorized by the Personal Data Subject

a) Other organizations and individuals who receive data according to the consent/authorization of the Personal Data Subject or according to relevant legal regulations (payee, beneficiary, designated person involved) relating to accounts, intermediary banks, confirming banks, agent banks...);
b) Any person authorized or permitted by the Personal Data Subject to provide transaction information on behalf of the Personal Data Subject.

4.2.6. Financial institutions, intermediaries, card organizations, switching organizations

Any credit institutions, foreign bank branches and agents, financial institutions, merchants, intermediaries, international card associations/organizations, other card switching organizations related to any any products and services provided by VRB to Personal Data Subject.

4.2.7. Other Third Parties

a) Other relevant parties that VRB deems necessary to meet and protect the legitimate rights and interests of Personal Data Subject;
b) Parties in the transaction of buying or selling VRB's debt and assets;
c) Any individual who intends to pay any outstanding amounts in any Personal Data Subject's account(s) with VRB;
d) Parents, spouses, children, legal heirs of the Personal Data Subject in case the Personal Data Subject has died or been declared missing;
e) Other Third Parties performed with the consent of the Personal Data Subject;
f) Third Parties have been approved by the Personal Data Subject when using VRB products and services.

4.3. How Personal Data is Processed

Depending on the purpose of Processing Personal Data, VRB or the Personal Data Processor or Third Party may apply appropriate processing methods including but not limited to Data Processing methods. Individuals automatically, manually or by other methods in accordance with the provisions of law and VRB from time to time.

4.4. Personal Data Processing Time

Depending on each specific activity, Personal Data may be processed by VRB after it is provided, collected and terminated upon completion of data processing in accordance with the purpose of performance or until the Data is The individual has been deleted according to regulations.

TRANSFER OF PERSONAL DATA ABROAD

In order to carry out the purposes of Processing Personal Data in this T&C On Protection Of Personal Data and other contracts, agreements and documents established with Personal Data Subject, VRB may be required to provide/transfer Data Personal Data for VRB's relevant Third Parties and these Third Parties may be based in Vietnam or outside Vietnam. When providing/transferring Personal Data abroad (including but not limited to activities using cyberspace, devices, electronic means or other forms to transfer Personal Data abroad territory of Vietnam), VRB will require the Third Party to collect and store Personal Data in accordance with the purpose of data processing and take measures to protect the Personal Data provided/transferred. VRB commits to fully comply with regulations and compliance requirements of Vietnamese law to protect the safety of Personal Data.

UNWANTED CONSEQUENCES AND DAMAGES MAY OCCUR

Processing of Personal Data always carries the risk of data leakage or inappropriate data processing, including but not limited to force majeure events, system problems, and technical infrastructure of VRB, or arising due to the fault of the Personal Data Processor. VRB recognizes the importance and responsibility of protecting Personal Data, commits to applying appropriate protection measures in accordance with current laws and regularly reviews and updates technical measures to ensure safety in Personal Data Processing, make maximum efforts to prevent risks and limit unwanted consequences and damages that may occur, protect legitimate rights and interests of the Personal Data Subject and of the VRB.

RIGHTS AND OBLIGATIONS OF PERSONAL DATA SUBJECT

7.1. Rights of Personal Data Subject

7.1.1. VRB respects and endeavors to protect the following rights of Personal Data Subject: (1) Right to know; (2) Right to consent; (3) Right of access (including viewing, editing or requesting correction of Personal Data); (4) Right to withdraw consent; (5) Right to data deletion; (6) Right to restrict data processing; (7) Right to provide data; (8) Right to object to data processing; (9) Right to complain, denounce and sue; (10) Right to claim damages; (11) Right to self-defense.

7.1.2. In exercising their rights, Personal Data Subject understand and agree that:

a) VRB maintains measures to protect against unauthorized or unlawful access and/or destruction, loss, or damage of Personal Data and considers the legitimate interests of Personal Data Subject, capabilities and systems of VRB from time to time. With reasonable efforts, VRB will comply with lawful and valid requests from Personal Data Subject within the capacity and time in accordance with the law;
b) Personal Data Subject's requests must be made according to the processes, procedures and costs specified by VRB; received at VRB's transaction locations or other methods prescribed by VRB from time to time; carried out within trading hours and working days according to VRB regulations;
c) With respect to the right to Withdraw consent, restriction and objection to Processing of Personal Data, Erasure of Personal Data, the Personal Data Subject understands and agrees that:

(i) Data Subjects agree that termination and/or restriction of Personal Data Processing by a Personal Data Processor other than VRB shall be solely dependent on the actions taken. necessary and appropriate by that Personal Data Processor. Personal Data Subject agree to release VRB from all disputes or liabilities related to the Personal Data Processor's failure to perform or incomplete and timely implementation of valid requests of The Personal Data Subject causes the Personal Data Subject to suffer or be at risk of suffering damage (if any), except in cases where VRB does not promptly, accurately and fully transmit the valid request content to that Personal Data Processor.

(ii) Withdrawal of Consent, request for restriction and/or objection to Processing of Personal Data does not affect the lawfulness of the Processing of Personal Data by VRB and/or the Data Processor. What the Individual has done before VRB and/or the Data Processor completes the termination and/or restriction of Processing of Personal Data.

d) For security purposes, the Personal Data Subject may need to make his or her request in writing or use other methods to prove and authenticate the identity of the Personal Data Subject. VRB may require Personal Data Subject to verify and authenticate identity before processing Personal Data Subject's request;
e) For requests to view and edit Personal Data, the Personal Data Subject understands and agrees that in some cases due to technical reasons, the system's ability to respond, and the infrastructure of VRB requires verification of Personal Data before making corrections as required by law, or for other reasons that may prejudice and limit the scope of the types of Personal Data, how the Personal Data Subject can access, view and edit.

7.2. Obligations of Personal Data Subject

a) Protect your Personal Data; require other relevant organizations and individuals to protect their Personal Data;
b) Respect and protect the Personal Data of others;
c) Provide complete and accurate personal data when agreeing to process Personal Data;
d) Participate in propaganda and dissemination of Personal Data protection skills;
e) Implement legal regulations on Personal Data protection and participate in preventing and combating violations of regulations on Personal Data protection;
f) Immediately notify VRB if you discover or suspect that your Personal Data has been exposed, which may lead to risks during service use, or any violation of Personal Data protection according to this T&C that are identifiable to the Personal Data Subject.
g) Regularly check VRB's official website to update and follow any changes (if any) related to the Personal Data protection policy in this T&C. If the Personal Data Subject does not agree with the modifications and additions made by VRB, the Personal Data Subject is responsible for notifying VRB to agree to terminate the use of related services.
h) Other obligations as prescribed by law.
COMMITMENT AND ACKNOWLEDGMENT OF THE PERSONAL DATA SUBJECT

8.1. By signing and clearly writing full name, or pointing in the T&C or signing and clearly writing full name, pointing in the Contract/agreement/form to use VRB's products and services with reference to this T&C, or (ii) send a confirmation email, or (iii) send SMS according to VRB's recommended syntax, or (iv) call/answer the recorded phone with VRB, or (v) confirm Receiving consent on the electronic banking application, or through other confirmation methods prescribed by VRB from time to time, the Personal Data Subject confirms that he has read and understood the entire content and agrees to the terms and conditions. terms and conditions in this T&C. Personal Data Subject agree that VRB only notifies Personal Data Subject before VRB Processes Personal Data and does not need to notify again at subsequent Data Processing times.

8.2. Agree to allow VRB to carry out one or more Personal Data Processing activities at the same time with the Personal Data(s) stated in Section 3.1 of this T&C, to serve the purposes stated in Section 4.1.

8.3. Agree for VRB to provide Personal Data to organizations and individuals specified in Section 4.2 in the following cases: (i) Personal Data Subject has voluntarily provided information about Personal Data ; (ii) VRB provides Personal Data to Personal Data Processors in accordance with relevant laws; (iii) VRB provides Personal Data to hire the Personal Data Processor to perform one or more activities for the purposes specified in Section 4.1 of this T&C; (iii) VRB provides Personal Data to the Personal Data Controller for transactions between the Personal Data Subject and the Personal Data Controller; (iv) the Personal Data of the Personal Data Subject has been made public on public media and is accessible to anyone.

8.4. Agree that VRB has the right to Process Personal Data without the consent of the Personal Data Subject in the following cases:

(i) Respond to an emergency to protect the life, health or safety of a Personal Data Subject or another individual;

(ii) Personal Data has been made public in accordance with the law;

(iii) In case of emergency regarding national defense, national security, social order and safety, major disasters, dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; preventing and combating riots, terrorism, preventing and combating crime and law violations;

(iv) To perform the Personal Data Subject's contractual obligations with relevant agencies, organizations and individuals according to the provisions of law;

(v) To serve the activities of state agencies as prescribed by specialized laws (such as requirements on storage periods according to legal regulations, regulations on safety and security of information systems). information in banking activities...);

(vi) Personal Data is processed by a competent state agency for the purpose of serving the activities of the state agency in accordance with the law;

(vii) Personal Data is processed to serve legal requirements, scientific research, and statistics in accordance with the law.

8.5. Agree that VRB has the right to refuse a Personal Data Subject's request in some cases:

(i) Personal Data Subject do not follow the correct order and procedures guided by VRB; or,

(ii) When VRB cannot determine the identity of the Personal Data Subject or cannot verify the accuracy and completeness of the Personal Data and/or the Personal Data Subject does not provide or provide Incomplete provision of papers and documents to verify the identity, accuracy and completeness of Personal Data; or,

(iii) In case VRB assesses there are signs of falsification, fraud, or violation of Personal Data protection; or,

(iv) The Personal Data Subject does not accept the provisions in point c, Section 7.1.2 of this T&C; or,

(v) The law does not allow the fulfillment of a Personal Data Subject's request.

8.6. Agree to authorize VRB to carry out necessary procedures (if any) on behalf of the Personal Data Subject in case of Processing Personal Data through the Data Processor. Personal Data, Third Party, including but not limited to signing documents, sending a notice confirming the Personal Data Subject's consent to the Data Processing to the Personal Data Processor.

8.7. Has been explained clearly and in detail by VRB and the Personal Data Subject is fully aware that the Processing of Personal Data by VRB and/or the Personal Data Processor prior to the effective date of this T&C (if any) is in accordance with the law and there is no dispute.

8.8. When providing Personal Data of a third party (including but not limited to information of relevant individuals in the organization, dependents, other legally related persons, spouses , child and/or parent and/or guardian, friend, beneficiary, attorney, partner, emergency contact or other individual of the Personal Data Subject) to VRB, the Personal Data Subject represents, warrants and is responsible that the Personal Data Subject has provided complete and accurate information and has obtained the legal consent/approval of the third party that allows VRB to process the Personal Data for the purposes set out in this T&C and in accordance with relevant laws, including but not limited to: Personal Data relating to Children aged 7 years or older must have the consent of the child and the consent of their father, mother or guardian according to regulations, unless otherwise prescribed by law; Personal Data related to a person declared missing or dead must be approved by the spouse, adult child or parent of that person, unless otherwise provided by law. Personal Data Subject agrees that VRB is not responsible for verifying the legality and validity of this consent/acceptance and the presentation of evidence proving the authenticity and accuracy of the Data. Whether the Individual has declared when requested by VRB is the responsibility of the Personal Data Subject. VRB is exempted from liability and required to compensate for damages and related costs when the Personal Data Subject fails to comply with the provisions in this Section.

8.9. Understand that any Personal Data is not only associated with each specific product or service but can be used for the purpose of providing many products and services to Personal Data Subject, including future products and services.

8.10. It has been fully and clearly explained and understood by VRB that although VRB has applied the necessary safety measures, however, the Personal Data Processing process may still occur events, actions beyond VRB's reasonable control and may lead to unwanted consequences and damages for Personal Data Subject. The Personal Data Subject is clearly aware of the potential risks and consequences and responsibilities of the relevant Parties when incidents or violations occur as stipulated in this T&C.

8.11. Agree that, in cases where, in the reasonable judgment of VRB, there may be potential legal consequences and/or damages arising from the implementation of a request to withdraw Consent, a request for restriction and/or object to the Processing of Personal Data of the Data Subject, VRB has the right to consider and unilaterally decide to discontinue terminate the provision of one, some or all of the Services and/or the Transaction Agreement, concurrently or immediately after the completion of the termination and/or restriction of Processing of Personal Data.

8.12. Be responsible for paying all costs incurred during the Processing of Personal Data, including but not limited to fees listed by VRB for providing Personal Data, editing exported Personal Data arising from the Personal Data Subject's fault, costs in case the Personal Data Subject withdraws consent, requests restriction and or objects to the Processing of Personal Data; unless otherwise provided by law or VRB's regulations. Method and time of payment of fees according to VRB's regulations and legal regulations from time to time.

8.13. Commitment of the Legal Representative of the organization

(i) The legal representative of the organization commits to have legally collected the consent of the relevant Personal Data Subject in the organization registered to use the service at VRB (after (hereinafter referred to as the relevant Personal Data Subject in the organization), consent to the organization providing relevant Personal Data Subject information in the organization for VRB to store and process for the purpose of performing the contract, agreement signed between VRB and the organization.

(ii) The legal representative of the organization undertakes to store evidence that the relevant Personal Data Subject in the organization agree to authorize the organization to provide personal data to VRB and present proof of personal data. This proof is for VRB in case VRB or a competent authority requests it.

NOTICE AND PROVISION OF INFORMATION

9.1. A Personal Data Subject's notice to VRB shall only be deemed to have been received by VRB if such notice is sent in writing to VRB during business hours and business days and is confirmed as received by VRB. Written notices sent to VRB outside of business hours are considered received by VRB at any time of the next business day.

9.2. Except as otherwise expressly provided in this T&C, all VRB notices and information to Personal Data Subject under this T&C may be sent by one of the following methods: (i) postal mail, (ii) hand delivery, (iii) fax, (iv) phone, phone message to the phone number registered by the Personal Data Subject; (v) email to the registered Personal Data Subject's mailbox; (vi) publicly posted on VRB's website (http://www.vrbank.com.vn) or any other form of notice decided by VRB not contrary to the law. The parties agree that notification by text message, email, fax or other forms of electronic notification under the Electronic Transactions Law is a form of written notification.

9.3. In case Personal Data Subject have any questions regarding the Personal Data protection policy in this T&C, please contact VRB at the nearest Branch/Transaction Office or call the VRB Customer Care Center at hotline 18006656.

EFFECTIVENESS

10.1. This T&C constitutes a unified, indivisible agreement and has the same legal value as the Transaction Agreements/Terms of Conditions that VRB enters into with the Personal Data Subject.

10.2. By agreeing to this T&C, the Personal Data Subject acknowledges that he/she has read, understood and fully agrees with the entire content of this T&C. In case of disagreeing with this T&C or only agreeing with part of this T&C, the Personal Data Subject has the right to send a document to VRB to clearly state the parts of disagreement, when VRB then has the right to consider continuing to provide products/services or refuse to provide products/services or terminate transaction contracts/agreements, depending on VRB's policies and legal regulations from time to time.

10.3. This T&C are made in Vietnamese and English. In case there is a difference between Vietnamese content and English content, the Vietnamese content has priority.

Terms and conditions