Vietnam Privacy Policy

"Below is the Vietnam version. Please visit this Link if you are accessing from global."

OCEAN NETWORK EXPRESS (VIETNAM) CO., LTD.
PRIVACY AND PERSONAL DATA PROTECTION POLICY

1. INTRODUCTION

Pursuant to the Law No. 91/2025/QH15 on Personal Data Protection issued by the National Assembly of Vietnam on 26 June 2025 and its implementing regulations as each may be amended, supplemented or replaced from time to time (“Personal Data Protection Law”)., Ocean Network Express (Vietnam) Co., Ltd. (hereinafter "we" or "ONEVN") issues this privacy and personal data protection policy (“Policy”) to inform you of the methods of collecting, using, sharing, and protecting personal data obtained in relation to the services we provide and how we comply with the regulation in the whole process of collecting, handling, assessing, filing and protecting your personal data in our current business operations.

This Policy shall also include terms, conditions, notices regarding personal data processing, and general regulations on personal data processing.

This Policy applies to the processing of personal data of individual(s) who directly or indirectly uses ONEVN's services in Vietnam (hereinafter referred to as "User" or "Users").

By using our services, the User acknowledges that the User has read and fully understood this Policy.

2. DATA PROCESSING RESPONSIBILITY

ONEVN acts as the Personal Data Controller and/or the Personal Data Controller and Processor (depending on the specific service context) and is responsible for ensuring that the User's personal data is processed in compliance with Vietnamese laws, specifically the Personal Data Protection Law.

3. PERSONAL DATA COLLECTED BY ONEVN

The type of personal data that ONEVN collects depends on the nature of our relationship with the User and the services provided. This data may include:

3.1. Basic Personal Data of the User:
- Contact Information: Name, address, email, phone number.
- Personal Identity Information: Gender, date of birth, nationality, Passport number.
- Employment Information: Job title, company name of employment.
3.2. Sensitive Personal Data:
- Financial Information: Bank account number, credit card number, tax code (if applicable), ...
- Personal Identity Information: Identity Card/Citizen Identification Card.
- Other sensitive data as prescribed under the Personal Data Protection Law (e.g., location data, biometric data if applicable).

4. PURPOSES OF PERSONAL DATA PROCESSING

ONEVN only collects and processes the User's personal data for lawful purposes upon obtaining the User's consent for personal data processing, including but not limited to:

4.1. Service Provision: To provide services requested by the User or services arranged for the User's benefit (e.g., arranged by the User's employer or ONEVN's partners).
4.2. Business Operations: To manage the relationship with the User, including customer support, payment, and contract performance.
4.3. Legal Compliance: To comply with legal obligations such as tax reporting, accounting audits, "Know Your Customer" (KYC) checks, and anti-money laundering regulations, and to conduct audit and investigations, and to use for litigation, dispute resolution and regulatory proceeding.
4.4. Service Improvement: To analyze market trends and improve internal business processes (using aggregated and anonymized data where possible).
4.5. Marketing: To inform the User about products or services that may interest the User (based on the User's consent and right to opt-out).

5. CASES OF PERSONAL DATA PROCESSING WITHOUT USER‘S CONSENT

The receipt, sharing, and transfer of personal data as prescribed by law and/or to serve the requirements and activities of state agencies as regulated by the laws of specific sectors.
The processing and sharing of User's personal data with competent state agencies in cases of emergency regarding national defense, national security, social order and safety, major disasters, epidemics, or when there is a risk threatening national defense and security but not to the extent of declaring a state of emergency; prevention and combat of riots, economic crimes, and/or violations of the law as prescribed by law.

6. HOW WE COLLECT DATA

Directly from the User: When the User fills out forms, signs contracts, works with, or communicates with us.
Indirectly: From the User's employer, ONEVN's partners, or third parties (e.g., insurance companies, service providers) hiring ONEVN to provide services beneficial to the User.
Public Sources: From databases or public registries permitted by law.

7. DATA SHARING WITH THIRD PARTIES

ONEVN does not share the User's personal data in any situation unrelated to the relevant purpose and function. We only use and share data when necessary for the purposes stated in Section 4, with:

Service Providers: Partners supporting us in providing services (e.g., IT support service provider, cloud service providers, auditors, lawyers, consultants).
Business Partners: Banking companies or financial institutions required to perform contracts.
Competent State Agencies: Regulators, police, courts, or other government agencies when required by law.

Ocean Network Express Pte. Ltd. and its affiliates: Ocean Network Express Pte. Ltd. to which ONE VN is working as an agent to conduct any business activities and together with its affiliates to provide inter-company support. Affiliates shall include any company controlled by, controlling, or under common control with the Ocean Network Express Pte. Ltd.

8. TRANSFERRING DATA ABROAD

If ONEVN needs to transfer the User's data out of the territory of Vietnam (e.g., to cloud servers or international partners), we ensure that such transfer complies with Vietnamese regulations on cross-border data transfer, ensuring the User's data receives an equivalent level of protection.

9. DATA STORAGE AND SECURITY

Storage: We only store the User's personal data for the time necessary to fulfill the collection purposes, or as required by law. (e.g., accounting laws require 10-year retention).
Security: ONEVN applies strict technical and organizational measures (including encryption, access control, and cybersecurity protocols) to protect the User's personal data against unauthorized access, loss, or misuse. However, security related risks will always exist, and no technical system or security measure is absolutely safe or capable of resisting all "hackers" (those who intrude illegally to exploit information) therefore, in the event that the User's personal information is hacked beyond ONEVN's control, the User agrees to exempt ONEVN from all related liability. ONEVN will coordinate with functional authorities to investigate and handle violations according to legal regulations.
To the extent permitted by applicable law, the User agrees to indemnify ONEVN against all legal proceedings involving third parties arising from or related to claims regarding the User's violation, including all legal liabilities and/or costs arising from claims, losses, or damages.
It is noted that the main purpose for collection and processing of personal data of User by ONEVN is to provide relevant services to User. As a result, when the User exercises its rights (as prescribed in Article 10 of this Policy), the User would need to consider the consequences of this action.
The User's execution of one or simultaneous actions of withdrawing consent, requesting restriction, objecting to personal data processing, and/or deleting personal data may lead to one or simultaneous consequences that ONEVN will have to bear, including but not limited to:
- (i) Violation of Personal Data Protection Law if User rights are implemented.
- (ii) Incurring economic damages arising from legal violations.
In this case, ONEVN is allowed to assess the feasibility and potential implications related to legal consequences or damages as mentioned above, after which ONEVN has the right to consider and decide to unilaterally terminate the fulfillment of the User's requests.

10. USERS’ RIGHTS AND OBLIGATIONS

According to the Personal Data Protection Law, the User has the following rights regarding their personal data:

Right to be informed: To be informed about how the User's personal data is processed.
Right to consent: To agree or disagree to allow the processing of their personal data.
Right to access: To view, correct, or request a copy of the User's personal data.
Right to withdraw consent: To withdraw permission for us to process their personal data (unless restricted by law or contract).
Right to request deleting personal data: To request the deletion of the User's personal data (unless the law requires retention).
Right to restrict/object: To restrict or object to personal data processing.
Right to complain: To complain or initiate lawsuits according to legal regulations.
Right to claim damages: To claim compensation when there is a violation of regulations on the protection of the User's personal data.
Right to self-protection: To self-protect or request competent agencies and organizations to implement methods to protect civil rights.

The User shall have certain obligations under Personal Data Protection Law, such as the obligation to provide complete and accurate Personal Data when consenting to ONEVN’s collection and processing of Personal Data, the obligation to protect their own Personal Data, the obligation to respect and protect others’ Personal Data, and the obligation to comply with the Personal Data Protection Law and prevent violations of personal data protection regulations.

11. GENERAL TERMS

ONEVN reserves the right to amend or supplement any or all content of this Policy subject to the latest update of Personal Data Protection Law as deemed necessary by publicly posting the amended or supplemented Policy content on the website and/or other official channels of ONEVN (at ONEVN's discretion from time to time).

We encourage the User to regularly review and check the amended or supplemented contents of this Policy. In certain cases, we may also proactively notify Users of significant changes to this Policy, where required by law, so that Users can fully exercise their rights under applicable laws and this Policy.

If the User does not agree with any amended or supplemented content of this Policy, the User is able to contact us for more discussion or clarification to come to the common conclusion.

The User agrees to exempt ONEVN from all liability in the event that they do not see any impact on the updated or revised version.

The User's continued use of the service and continued exchange of information with ONEVN on ONEVN's official channels after this content or subsequent amendments are posted means that the User acknowledges and agrees to ONEVN utilizing personal data under the terms mentioned in this Policy, and ONEVN will process data in accordance with the law.

12. CONTACT US

If the User wishes to exercise their rights or has any questions regarding this Policy, please contact our Legal Department:

Receiving Department: Legal Department - ONEVN
Address: 14th Floor, Deutsches Haus, No. 33 Le Duan, Ben Nghe Ward, Ho Chi Minh City.
Email: [email protected].

13. POLICY CHANGES

ONEVN reserves the right to amend and supplement this Policy to reflect changes in business operations or legal requirements. The latest version will always be posted on our website in accordance with current regulations at that time.