Personal Data Processing and Protection Policy

The App Store edition is free and does not require an account. Source texts, user-written interpretations and comparison drafts remain on this device in application preferences and local storage; their contents are not sent to Inti or to any other service, are not processed with AI and are not used for analytics. There is no automatic cross-device sync.

You can create a backup, copy it, or choose where to save/share it. Sharing happens only after your action and may send the chosen backup to the destination you select. Uninstalling the app or clearing its data may remove the local records; keep a backup first.

Build 11 introduces a native offline interface. Source editing, literal comparison and saved drafts do not load a website, use cookies or send text to a server. Local records are stored in the app's protected storage and are not automatically backed up or synced; use Files to export a backup to a location you choose. Privacy, support and Ministry of Industry and Trade links open only when you tap them; the destination website may receive your IP address and technical request information. The App Store edition has no advertising or behavioural analytics integrations. Earlier builds loaded the interface from Inti's Vercel-hosted server and used essential publishing-edition and language cookies; this describes those retained legacy versions, not the new offline core.

The broader web service described below has separate account, AI and payment features. Those features are not offered in this App Store edition. This publishing scope applies permanently to all App Store users, not just during review.

This Policy governs how the Company collects, processes, and protects personal data of Personal Data Subjects and their Related Persons within the framework of Contracts/Agreements with the Company, interactions through the Company's official communication channels such as telephone, messages, email, social media platforms, websites, applications, etc., or as required by law.

For the avoidance of doubt, this Policy applies to the collection, processing, and protection of individuals' personal data and does not apply to organizational data (enterprises, agencies, or organizations).

“Personal Data” means digital data or information in another form that identifies or helps identify a specific person, including Basic Personal Data and Sensitive Personal Data.

“Basic Personal Data” means personal data reflecting common identity and background characteristics frequently used in transactions and social relations.

“Sensitive Personal Data” means personal data associated with an individual's privacy which, if infringed upon, would directly affect the lawful rights and interests of agencies, organizations, or individuals.

“Personal Data Subject,” “Data Subject,” or “Subject” means the person reflected in the personal data. Under this Policy, a Personal Data Subject may be an officer, employee, worker, customer, partner, or other individual who interacts directly or indirectly with the Company and whose personal data is collected and processed by the Company.

“Related Persons of a Personal Data Subject” (abbreviated as “Related Persons”) include the Personal Data Subject's dependents, relatives as defined by law, guardians, friends, beneficiaries, authorized persons, partners, and emergency contacts; legal/authorized representatives, beneficial owners, accountants, managers, owners, employees, individuals/groups of individuals who are customers of an organization, and/or other individuals within agencies, organizations, or enterprises related to the Personal Data Subject; and other individuals related to the Personal Data Subject whose information the Personal Data Subject provides to the Company.

“Personal Data Processing” means activities affecting Personal Data, including one or more activities such as collection, analysis, aggregation, encryption, decryption, editing, deletion, destruction, de-identification, provision, public disclosure, transfer of personal data, and other activities affecting personal data.

“Personal Data Protection” means the use of personnel, means, and measures by agencies, organizations, and individuals to prevent and combat infringements of personal data.

“Personal Data Controller” means an agency, organization, or individual that determines the purposes and means of personal data processing.

“Personal Data Processor” means an agency, organization, or individual that processes personal data at the request of a Personal Data Controller or Personal Data Controller and Processor under a contract.

“Personal Data Controller and Processor” means an agency, organization, or individual that determines the purposes and means of personal data processing and directly processes personal data.

“Third Party” means an organization or individual other than the Personal Data Subject, Personal Data Controller, Personal Data Controller and Processor, or Personal Data Processor that participates in personal data processing in accordance with the law.

“Personal Data De-identification” means the process of changing or removing information to create new data that cannot identify or help identify a specific person.

“Personal Data Processing Impact Assessment” means analyzing and assessing risks that may arise during personal data processing in order to apply risk mitigation and personal data protection measures.

Comply with the Constitution, the Law on Personal Data Protection, other relevant laws, and provisions of contracts, agreements, documents, and other records established with the Personal Data Subject;

Collect and process personal data within a specific, clear scope and for specific, clear purposes, ensuring compliance with the law;

Ensure the accuracy of personal data and correct, update, or supplement it when necessary; retain it for a period appropriate to the purposes of personal data processing, unless otherwise provided by law;

Proactively prevent, detect, stop, combat, and promptly and strictly address all violations of personal data protection law;

Protect personal data in conjunction with safeguarding national interests, supporting socio-economic development, and ensuring national defense, security, and foreign affairs; ensure harmony between personal data protection and protection of the lawful rights and interests of agencies, organizations, and individuals;

The Company maintains and updates technical and security measures to ensure the accuracy, safety, and confidentiality of personal data, including protection against unauthorized access and/or destruction, loss, or damage to personal data.

The Company may collect and process some or all of the following personal data:

Basic Personal Data:

• Surname, middle name, and given name at birth, and other names (if any);
• Day, month, and year of birth; day, month, and year of death or disappearance;
• Gender;
• Place of birth, place of birth registration, registered permanent residence, registered temporary residence, current residence, place of origin, and contact address;
• Nationality;
• Images of the individual;
• Phone number, personal identification number, passport number, driver's license number, and vehicle license plate number;
• Marital status;
• Information on family relationships (parents, children, wife, husband);
• Information on the individual's digital accounts;
• Other information associated with or helping identify a specific person that does not fall within Subsection 4.2 below.

Sensitive Personal Data:

• Data revealing racial or ethnic origin;
• Political, religious, and belief-related views;
• Information on private life, personal secrets, and family secrets;
• Health status;
• Biometric data and genetic characteristics;
• Data revealing an individual's sex life or sexual orientation;
• Data on crimes and legal violations collected and stored by law enforcement authorities;
• An individual's location determined through location services;
• Usernames and passwords for accessing an individual's electronic identity account; images of identity cards, citizen identity cards, and identification documents;
• Usernames and passwords for bank accounts; bank card information and bank account transaction history data; customers' financial and credit information and information on financial, securities, and insurance activities and transaction histories at credit institutions, foreign bank branches, payment intermediary service providers, securities and insurance organizations, and other authorized organizations;
• Data tracking behavior and activities when using telecommunications services, social networks, online media services, and other services in cyberspace;
• Other personal data required by law to remain confidential or be subject to strict security measures.

From contracts, agreements, vouchers, documents, and records (audio recordings, video recordings, and logs) between the Personal Data Subject and the Company.

From interactions between the Personal Data Subject and the Company, its Employees, or other individuals/organizations authorized by the Company, including but not limited to in-person meetings, verbal or written exchanges, telephone conversations, email, messages, or any other means of communication.

Through the Personal Data Subject's interactions on the Company's websites and applications, its official social media pages, other pages or communication channels, or any means or methods through which the Company may collect data when the Personal Data Subject interacts with the Company.

When the Personal Data Subject submits any form, document, or personal data to the Company for any reason.

From interactions or automated data collection technologies such as cookies, pixel tags, or any technology capable of tracking individuals' activities on devices or websites.

Through public, official information sources or receipt of necessary shared data.

From service providers, partners, advisors, and Third Parties related to the Company's business operations.

From payment service providers when the Data Subject makes payments/transfers to the Company.

From State Authorities and other Agencies, Organizations, or Individuals under agreements, authorizations, or the law.

From a Third Party to which the Data Subject has consented to collect and transfer personal data to the Company.

Providing goods and services, including but not limited to:

• Identifying and verifying information about the Personal Data Subject;
• Advising on and providing goods and services, and performing other services in accordance with the law;
• Entering into, performing, extending, or renewing contracts with the Personal Data Subject and/or their Related Persons;
• Monitoring, reminding, and assessing the Personal Data Subject's performance of obligations;
• Receiving, updating, and processing information and requests from the Personal Data Subject;
• Receiving and resolving complaints and legal claims relating to the Personal Data Subject;
• Establishing, exercising, or protecting the lawful rights of the Data Subject, the Company, or any individual;
• Contacting and notifying the Personal Data Subject;
• Using and transferring relevant information to third parties for personal data processing and performance of contracts with the Personal Data Subject;
• Considering whether to continue or discontinue providing any of the Company's goods or services to the Personal Data Subject;
• Improving the technology and interfaces of the Company's websites, social media, and applications to ensure convenience for the Personal Data Subject;
• Recommending goods and services to the Personal Data Subject;
• Performing other activities related to operating and managing the Company's provision of legal services.

Operating the Company's business, managing human resources, and managing internal risks, including but not limited to:

• Ensuring lawful business purposes and performing other related tasks consistent with the Company's lawful business operations in circumstances the Company considers necessary;
• Fulfilling reporting, financial, accounting, and tax obligations;
• Performing activities for auditing, risk management, compliance, and retention purposes;
• Checking completeness, accuracy, and legality when entering and storing information;
• Performing and complying with contracts and agreements between the Company and other organizations or individuals;
• Serving the requirements of the Company's internal operations;
• Restructuring, buying or selling, dividing, or merging enterprises in accordance with the law. The parties will transfer and process transferred assets consisting of personal data in accordance with the law and this Policy;
• Conducting human resource development and management activities, including verifying candidate eligibility, evaluating applications, reaching agreements with candidates, and other recruitment activities;
• Establishing, performing, and terminating employment relationships;
• Training, inspecting, and assessing work quality and compliance with obligations under contracts, agreements, and commitments between Employees and the Company.

Enhancing security and preventing violations, including but not limited to:

• Verifying identity and ensuring the confidentiality of the Personal Data Subject's personal information;
• Correcting, updating, and securing data;
• Preventing and combating fraud, identity theft, and other unlawful activities;
• Preventing, combating, investigating, and detecting violations of Company rules and the law;
• Protecting public order and safety, cybersecurity, and the lawful rights and interests of the Personal Data Subject, the Company, and other relevant parties;
• Providing information to competent State Authorities upon request in accordance with the law.
• Any other purpose to which the Personal Data Subject consents.

Collection, analysis, and aggregation of personal data

Personal data is collected in accordance with Section 5 of this Policy and the Company's internal rules and procedures.

Personal data is analyzed and aggregated in accordance with the Company's internal rules and procedures, ensuring data confidentiality and information security and compliance with the law.

Encryption and decryption

The Company encrypts personal data as appropriate to its personal data processing activities. Personal data is encrypted using appropriate encryption standards during storage, transfer, and processing to ensure that data remains protected.

The Company decrypts personal data to process it and perform contracts, agreements, or requests from Data Subjects. Personal data decryption follows the Company's internal rules and procedures and complies with the law.

Correction of personal data

Personal Data Subjects may correct certain types of their own personal data as agreed with the Company or request that the Company correct their personal data.

The Company corrects personal data upon the Personal Data Subject's request or in accordance with the law, or requests that the Personal Data Processor or Third Party correct the Personal Data Subject's personal data.

Corrections to personal data must ensure accuracy. If personal data cannot be corrected for a legitimate reason, the Company will notify the requesting agency, organization, or individual.

Deletion, destruction, and de-identification of personal data

The Company deletes or destroys personal data in the following cases:

• The Company stores personal data in a form appropriate to its operations and takes measures to protect personal data during storage as required by law;
• The Company retains personal data for as long as necessary to fulfill the purposes of personal data processing and for mandatory retention periods required by law or periods agreed upon;
• Personal data is stored in paper form, as data information, data files, electronic information, or another form the Company considers appropriate;
• The Company may store personal data in Vietnam or abroad.
• Storage, access, retrieval, connection, coordination, confirmation, and authentication of personal data, and other activities affecting personal data, are carried out in accordance with personal data protection law, data law, other relevant laws, and agreements between the parties.
• In some cases, the Company will de-identify personal data. Personal data de-identification strictly follows the Company's internal rules and procedures and relevant laws, preventing unauthorized access, copying, appropriation, disclosure, or loss of personal data during de-identification.
• The Company does not re-identify personal data unless otherwise provided by law.

Provision of personal data

Personal Data Subjects provide personal data to the Company in accordance with the law or by agreement with the Company.

The Company provides personal data in the following cases:

• Providing it to the Personal Data Subject at their request in accordance with the law and agreements with the Data Subject, unless such provision may harm national defense, national security, public order or safety, or infringe upon another person's life, health, or property;
• Providing it to other agencies, organizations, or individuals with the Personal Data Subject's consent, unless otherwise provided by law.

Public disclosure of personal data

Personal data may be publicly disclosed only for a specific purpose. The scope of disclosure and types of personal data disclosed must be appropriate to that purpose. Public disclosure must not infringe upon the Personal Data Subject's lawful rights and interests.

Personal data may be publicly disclosed only in the following cases:

• With the Personal Data Subject's consent;
• As required by law;
• Where personal data processing does not require the Personal Data Subject's consent under the law;
• To fulfill contractual obligations.
• Publicly disclosed personal data must accurately reflect the personal data from its original source and facilitate access, exploitation, and use by agencies, organizations, and individuals.
• Forms of public disclosure include publishing data on websites, electronic portals, mass media, and other forms provided by law.
• When publicly disclosing personal data, the Company will strictly control and monitor disclosure to ensure compliance with the purpose, scope, and law; and, within its capabilities and circumstances, prevent unauthorized access, use, disclosure, copying, alteration, deletion, destruction, or other unlawful processing of the disclosed personal data.

Transfer of personal data

The Company transfers personal data only for processing for the purposes stated in this Policy and/or with the Personal Data Subject's consent and/or as provided by law. The Company takes necessary measures to ensure that personal data transfers are safe and secure.

The Company shares personal data among internal departments for processing consistent with the established purposes and takes measures to prevent and combat unauthorized sharing of personal data with third parties by internal personnel.

When transferring or sharing personal data, the Company requires, and any individual or organization receiving the data agrees, to undertake to comply with confidentiality and personal data protection obligations.

In certain cases necessary to fulfill the personal data processing purposes in this Policy, the Subject's personal data may be stored or processed on systems or by Personal Data Processors or Third Parties located outside Vietnam. Transfers of data outside Vietnam are carried out in accordance with personal data protection law and applicable security standards, with a commitment to full compliance with Vietnamese law to safeguard personal data.

Other personal data processing activities:

Personal data storage:

• The Company stores personal data in a form appropriate to its operations and takes measures to protect personal data during storage as required by law;
• The Company retains personal data for as long as necessary to fulfill the purposes of personal data processing and for mandatory retention periods required by law or periods agreed upon;
• Personal data is stored in paper form, as data information, data files, electronic information, or another form the Company considers appropriate;
• The Company may store personal data in Vietnam or abroad.
• Storage, access, retrieval, connection, coordination, confirmation, and authentication of personal data, and other activities affecting personal data, are carried out in accordance with personal data protection law, data law, other relevant laws, and agreements between the parties.

Protection of personal data of children, persons lacking or having limited civil act capacity, and persons with difficulties in cognition or control of behavior

Personal data of children, persons lacking or having limited civil act capacity, or persons with difficulties in cognition or control of behavior is processed through their legal representatives, except where processing does not require the Personal Data Subject's consent under Clause 1, Article 19 of the Law on Personal Data Protection. Processing the personal data of children aged 07 (seven) or older for publication or disclosure of information about their private lives or personal secrets requires consent from both the child and their legal representative.

Processing of personal data of children, persons lacking or having limited civil act capacity, and persons with difficulties in cognition or control of behavior ceases in the following cases:

• The person who consented to the above personal data processing exercises the right to request withdrawal of consent to the processing of personal data of the child, person lacking or having limited civil act capacity, or person with difficulties in cognition or control of behavior, unless otherwise provided by law;
• At the request of a competent authority where sufficient grounds demonstrate that personal data processing may infringe upon the lawful rights and interests of children, persons lacking or having limited civil act capacity, or persons with difficulties in cognition or control of behavior, unless otherwise provided by law.
• For children: the legal representative must provide documents verifying the child's age and proving their status as the child's legal representative before participating in personal data processing.
• For persons lacking or having limited civil act capacity, or persons with difficulties in cognition or control of behavior: the legal representative must provide documents proving the person's condition and valid legal representative status before participating in personal data processing.
• Personal data protection for personal location data and biometric data
• Personal location data is data determined through positioning technology to establish location and help identify a specific person.
• Biometric data is data on a person's physical attributes and unique, stable biological characteristics used to identify that person.
• The Company does not track location through radio-frequency identification tags or other technologies unless the Personal Data Subject consents, a competent authority requests it in accordance with the law, or the law otherwise provides;
• When collecting and processing biometric data, the Company applies physical security measures to biometric data storage and transmission equipment; restricts access to biometric data; maintains monitoring systems to prevent and detect infringements of biometric data; and complies with relevant laws and international standards.
• If a personal data breach involving location or biometric data occurs, the Company will notify the Personal Data Subject in accordance with Government regulations.
• Protection of personal data obtained from audio and video recording in public places and at public activities

The Company may record audio and video and process personal data obtained from such recording in public places and at public activities without the Personal Data Subject's consent in the following cases:

• To perform national defense duties, protect national security, ensure public order and safety, and protect the lawful rights and interests of agencies, organizations, and individuals;
• Audio, images, and other identifying information obtained from public activities, including conferences, seminars, sporting competitions, artistic performances, and other public activities, without harming the Personal Data Subject's honor, dignity, or reputation;
• Other cases provided by law.
• The Company is responsible for notifying or otherwise informing Personal Data Subjects that they are being recorded by audio or video, unless otherwise provided by law.
• Personal data obtained may be processed and used only in accordance with the processing purposes, and may not be used for unlawful purposes or to infringe upon the Personal Data Subject's lawful rights and interests. The Company is responsible for protecting personal data in accordance with the law.
• Personal data obtained from audio and video recording in public places and at public activities may be retained only for the period necessary to serve the collection purposes, unless otherwise provided by law. Upon expiry of the retention period, personal data must be deleted or destroyed as required.

Personal data is kept secure in accordance with the Company's rules and the law.

Within its capabilities and/or as required by law, the Company implements technical measures to protect personal data, including but not limited to firewalls, access controls, data encryption and decryption mechanisms, system logging, security monitoring, data backup and recovery, personal data de-identification, and other security measures.

The Company may apply data analysis, risk assessment, and automated authentication measures. If anomalies, suspected fraud, impersonation, or legal violations are detected, the Company may temporarily restrict or suspend performance of contracts or agreements or provision of products or services to the relevant Data Subject for verification. The Company will notify the Data Subject of such action to the extent permitted by law and enable the Subject to provide additional information and documents to clarify the matter and restore services. Related actions and decisions are based on an objective, reasonable assessment of the information and evidence collected.

The Company cannot absolutely guarantee that personal data shared over cyberspace will always remain secure. When transmitting personal data over cyberspace, Personal Data Subjects should use only secure systems to access websites, applications, or devices. Personal Data Subjects are responsible for keeping their access credentials for each website, application, or device safe and confidential.

Personal Data Subjects and organizations and individuals involved in personal data processing are responsible for complying with other personal data security and protection principles and measures under the Company's rules and the law.

When the Company processes personal data: within its capabilities and/or as required by law, the Company has implemented necessary data security measures. However, force majeure events or unexpected incidents may prevent absolute personal data security in certain circumstances (excluding the Company's liability), such as:

• Hardware or software failures or virus infection of systems during data processing resulting in loss of the Personal Data Subject's data;
• Security vulnerabilities beyond the Company's control or hacker attacks on systems resulting in data disclosure or leakage;
• Incidents or risks involving data loss caused by Internet service provider connection failures;
• Intruders breaking into the Company;
• Fire, natural disasters, war, riots, strikes, etc.;
• Force majeure, objective impediments beyond the Company's control, or other cases provided by law. The Company is responsible for notifying competent authorities of such incidents and informing Personal Data Subjects as required by law.
• When the Company handles a Personal Data Subject's request: the Subject's provision of inaccurate data, withdrawal of consent, requests for data deletion or restriction of processing, objection to personal data processing, and/or exercise of other related rights may affect the ability to provide or continue performing contracts and agreements with the Personal Data Subject. In such cases, the Company has full discretion to consider and decide to suspend or terminate performance of contracts or agreements with the Personal Data Subject; the Company is not liable for any resulting losses, and its lawful rights and interests are fully reserved.

Rights of Personal Data Subjects: Personal Data Subjects have the following rights:

• To be informed about personal data processing activities;
• To consent or refuse consent, and request withdrawal of consent to personal data processing;
• To view, correct, or request correction of personal data;
• To request provision, deletion, or restriction of processing of personal data, and submit objections to personal data processing;
• To lodge complaints, report violations, initiate legal proceedings, and claim compensation for damage in accordance with the law;
• To request competent authorities or agencies, organizations, or individuals involved in personal data processing to implement measures and solutions to protect their personal data in accordance with the law;
• Other rights provided by law.
• Personal Data Subjects exercise the above rights by submitting requests to the Company in accordance with the sequence and procedures set out in the Procedure for Handling Personal Data Subject Requests issued together with this Policy. Any costs arising from fulfilling a Subject's request, including but not limited to printing, copying, postage, and express delivery fees for sending data, are borne by the requester and must be paid no later than receipt of the data or by a deadline set by the Company. For security purposes, the Company may require the Subject to provide evidence to verify their identity before processing the request. The Company will fulfill lawful, valid, procedurally compliant requests from Personal Data Subjects within its capabilities and within a period consistent with the law. When exercising their rights, Personal Data Subjects understand and agree that the Company will continue measures to protect personal data from damage, loss, or unauthorized/unlawful access and consider the Subject's legitimate interests and the Company's capabilities and systems at the relevant time. The Company may refuse a Data Subject's request if: the Data Subject fails to follow the form, sequence, or procedures instructed by the Company; or fails to provide sufficient identity verification documents; or the Company identifies signs of a personal data protection violation; or there is a dispute or indication of a dispute relating to personal data processing; or the Data Subject does not accept the possible consequences of the Company fulfilling the request; or the law does not permit fulfillment of the request.

Obligations of Personal Data Subjects

Protect their own personal data.

Respect and protect others' personal data.

Provide complete and accurate personal data as required by law, under a contract, or when consenting to processing of their personal data.

Comply with personal data protection law and participate in preventing and combating infringements of personal data.

Follow procedures under the law and the Company's rules and guidance concerning processing of the Personal Data Subject's personal data.

Cooperate with the Company, competent State Authorities, or third parties if issues arise affecting the confidentiality of the Personal Data Subject's data.

Proactively notify the Company if they suspect their personal data is being infringed upon.

Regularly review and stay updated on the Rules and Policies publicly posted by the Company.

Apply the Procedure attached to the Policy: Procedure for Handling Personal Data Subject Requests.

In accordance with the law, Personal Data Subjects clearly understand that the Company may process personal data without their consent, including where they request withdrawal of consent, object to processing, request restriction of processing, or request deletion of personal data, in the following cases:

• To protect the life, health, honor, dignity, lawful rights, and interests of the Personal Data Subject or another person in an urgent situation; to take necessary action to protect one's own or another person's legitimate rights or interests, or the interests of the State, agencies, or organizations, against infringements of those interests. The Personal Data Controller, Personal Data Processor, Personal Data Controller and Processor, and Third Party are responsible for substantiating this case.
• To address an emergency; a threat to national security not yet warranting declaration of a state of emergency; and to prevent and combat riots, terrorism, crime, and legal violations.
• To serve the activities of State Authorities and state administration as prescribed by law.
• To perform the Personal Data Subject's contracts and agreements with the Company in accordance with the law.
• Other cases provided by law.
• The Company maintains mechanisms to monitor and protect personal data in the above cases.

A “Cookie” is a small file placed on a Personal Data Subject's device when they access a website. It records information about their device and browser and, in some cases, their preferences and browsing habits.

The Company may use Cookies and similar tracking technologies for security, fraud prevention, maintenance and operation of product and service features, performance measurement, experience improvement, and optimization of product and service provision to Personal Data Subjects.

The Company may use information from Cookies and tracking technologies to recognize Personal Data Subjects when they return to the Company's websites, provide personalized products and services on those websites, compile analytics to better understand website activity, and improve the Company's websites.

Personal Data Subjects manage Cookies through browser or device settings or corresponding management tools. However, disabling certain types of Cookies may affect the ability to use some service features on the Company's platforms and websites.

The Company's websites, applications, or social media pages may contain links to websites, applications, social media pages, or services provided by third parties, or integrate features, products, or services provided by third parties.

When Personal Data Subjects access or use these services, collection, processing, and protection of their personal data are governed by the respective third party's privacy policy and terms of use, outside the scope of this Policy. Personal Data Subjects are advised to review and carefully read the privacy policies of third-party platforms or services before providing any personal information or using those services.

Where transferring data to a third party is necessary to provide services requested by a Personal Data Subject or as required by law, the Company will transfer data only to the necessary extent and in accordance with personal data protection law.

If Personal Data Subjects have any questions about this Policy, requests to exercise their rights, or complaints concerning personal data processing, please contact the Company through the methods below:

• Send a written communication to the Company at: 38/16 Trần Thánh Tông, Tân Sơn Ward, Ho Chi Minh City, Vietnam.
• Other addresses or methods provided by the Company.
• Send an email to: support@yup.edu.vn.
• Phone: 0903848083.
• Procedures and forms for exercising Personal Data Subject rights follow the Procedure for Handling Personal Data Subject Requests.
• Where it is necessary to notify Personal Data Subjects, the Company may choose a method such as telephone, email, text messages, electronic messages through applications, or written communications, etc., using the most recent information provided by the Data Subject.

This Personal Data Processing and Protection Policy takes effect on the date stated in its issuance Decision.

Personal Data Subjects understand and agree that the Company may update or amend this Policy and rules concerning data processing from time to time. Updates and amendments to the Personal Data Processing and Protection Policy are published publicly.

All rights and obligations of the Parties under this Personal Data Processing and Protection Policy are cumulative with the rights and obligations of the Company and Data Subject under contracts, agreements, or any documents concluded between the Company and Personal Data Subject.

If any conflict concerning personal data processing or protection arises between this Policy and other contracts, agreements, or terms signed before, on, or after this Policy's effective date, this Policy prevails.

Matters not covered by this Policy will be governed by the law, guidance from competent State Authorities, and/or amendments and supplements to this Policy publicly posted by the Company from time to time.

If a dispute arises during implementation of this Policy, the Company will proactively seek resolution through negotiation and mediation with the Personal Data Subject. If negotiation and mediation fail, the dispute will be submitted to the competent People's Court for resolution in accordance with the law.

Personal Data Subjects are required to read and confirm that they understand this Policy before entering into a contract/agreement with the Company and/or when the Policy is updated.

This Personal Data Processing and Protection Policy is drawn up in Vietnamese. In the event of any discrepancy between this Vietnamese version and any translation (if translated into a foreign language), the Vietnamese version shall prevail./.

Purpose

This Procedure sets out the sequence, procedures, and deadlines for handling Personal Data Subject requests to ensure that Công ty TNHH Doanh nghiệp xã hội Inti Foundation (the “Company”) fully complies with the Law on Personal Data Protection and related laws.

This Procedure is an integral part of the Company's Personal Data Processing and Protection Policy and the contractual terms and agreements for use of products and services that bind the relationship between the Company and Personal Data Subjects (customers, partners, and related individuals).

Scope of application

Personal Data Subjects have the right to request that the Company implement the following rights concerning their personal data under current law, including:

The right to request withdrawal of consent to personal data processing; request restriction of personal data processing; and object to personal data processing:

• Personal Data Subjects may withdraw their consent at any time, except where personal data may be processed without their consent or the law provides otherwise.
• Personal Data Subjects have the right to request that the Company restrict processing of certain personal data, carry out only certain personal data processing activities, or limit the duration or purposes of processing their personal data in accordance with the previously consented purposes, unless otherwise provided by law.
• Personal Data Subjects have the right to object to the Company's processing of their personal data in order to prevent or limit disclosure of personal data or use of their personal data for advertising or marketing, unless otherwise provided by law.

The right to view, correct, or request correction of personal data; and request provision of personal data:

• Personal Data Subjects have the right to access, view, correct, or request that the Company correct personal data it is processing, unless otherwise provided by law.
• Personal Data Subjects have the right to request that the Company provide their personal data that it is processing, unless doing so may harm national defense, national security, public order or safety, or infringe upon another person's life, health, or property, or the law provides otherwise.
• The right to request deletion of personal data: Personal Data Subjects have the right to delete or request that the Company delete their personal data that it is processing, unless otherwise provided by law.
• The right to request personal data protection measures and solutions
• The Company applies technical and manual measures, access restrictions, and other measures and solutions to protect personal data.
• Upon receiving a request from a Personal Data Subject for enhanced personal data protection, the Company considers feasibility and appropriateness and responds with the outcome.

Procedures and process for handling Personal Data Subject requests

Receipt of Personal Data Subject requests: The Company receives requests through the following channels:

• Online by email: support@yup.edu.vn. Phone number: 0903848083.
• In person at the Company's registered office: 38/16 Trần Thánh Tông, Tân Sơn Ward, Ho Chi Minh City, Vietnam.
• Request form: Personal Data Subject Rights Exercise Request Form — Form No. 02/PYC issued together with this Procedure.

Request acknowledgment

The department receiving the Personal Data Subject Rights Exercise Request Form checks that all information required by the Form is included and requests and guides the Personal Data Subject to follow the correct procedure and form.

The receiving department forwards the request to the Company's Personal Data Protection Department/Personnel within 12 hours of receipt.

The Personal Data Protection Department/Personnel will acknowledge the request, verify necessary information, and respond to the Personal Data Subject within the time specified in Section 3.3 of this Procedure.

Response to requests

Request typeResponse deadlineProcessing deadline

Request to withdraw consent to personal data processing; request to restrict personal data processing; objection to personal data processing

02 working days

15 days (20 days in certain cases involving a Personal Data Processor/Third Party). May be extended a maximum of 01 time for no more than 15 days.

Request to view, correct, or request correction of personal data; request for provision of personal data

02 working days

10 days (15 days in certain cases involving a Personal Data Processor/Third Party). May be extended a maximum of 01 time for no more than 10 days.

Request for deletion of personal data

02 working days

20 days (30 days in certain cases involving a Personal Data Processor/Third Party). May be extended a maximum of 01 time for no more than 20 days.

Request for personal data protection measures and solutions

02 working days

15 days. May be extended a maximum of 01 time for no more than 15 days.

If an extension is necessary, depending on the nature and complexity of the request, the Company will notify the Personal Data Subject by text message, email, or written communication of an appropriate extension, clearly state the reasons, and bear responsibility for demonstrating that the extension is necessary and reasonable.

Notification and completion: The Company will send a written Notice by email or post to the Personal Data Subject's address (if specifically requested), including:

• Processing outcome (completed/refused).
• Reasons (if the request is refused in part or in full, with instructions for making a complaint).
• Provision of data (if the request is for data provision).

Points to note when exercising Personal Data Subject rights

When exercising their request rights, Personal Data Subjects must follow the procedures and forms specified in this Procedure.

Personal Data Subjects understand and agree that: (i) the Company will fulfill a request within a period consistent with statutory requirements only when the request is lawful, complete, and valid and the Personal Data Subject pays any processing costs incurred; and (ii) fulfillment is subject to the Company's right to invoke any exemption and/or exception provided by law.

The Company may refuse to fulfill Personal Data Subject requests in certain cases, including but not limited to: (i) the Personal Data Subject fails to follow the sequence or procedures instructed by the Company, including requests with missing information or invalid content; or (ii) the Personal Data Subject fails to provide, or provides insufficient, identity verification documents; or (iii) the Company assesses that there are signs of fraud or personal data protection violations; or (iv) the law does not permit fulfillment of the request.

For security purposes, Personal Data Subjects may need to submit their requests in writing or use another method to prove and authenticate their identity. The Company may require identity verification before processing a Personal Data Subject's request.

The Company will respond to Personal Data Subject requests within the statutory period after receiving all required request information.

The Personal Data Subject's provision of inaccurate data, withdrawal of consent, requests for data deletion or restriction of processing, objection to personal data processing, and/or exercise of other related rights may affect the ability to provide or continue performing contracts and agreements with the Personal Data Subject. In such cases, the Company has full discretion to consider and decide to suspend or terminate performance of contracts or agreements with the Personal Data Subject; the Company is not liable for any resulting losses, and its lawful rights and interests are fully reserved.

Personal Data Subjects may request that the Company implement multiple rights granted to them by law simultaneously.

5. Complaints, reports of violations, and legal proceedings: If Personal Data Subjects have grounds to believe that processing of their personal data violates personal data protection law, they have the right to lodge complaints, report violations, or initiate legal proceedings with competent State Authorities, or request compensation for damage as provided by law./.

Form No. 02/PYC (Issued together with the Procedure for Handling Personal Data Subject Requests

SOCIALIST REPUBLIC OF VIETNAM Independence – Freedom – Happiness

PERSONAL DATA SUBJECT RIGHTS EXERCISE REQUEST FORM

To: CÔNG TY TNHH DOANH NGHIỆP XÃ HỘI INTI FOUNDATION

PERSONAL DATA SUBJECT INFORMATION

1. Information on the person requesting exercise of Personal Data Subject rights:

• ☐ I am the Personal Data Subject
• ☐ I am the Personal Data Subject's representative/guardian

Requester's full name: Date of birth:

Citizen ID/Identity Card/Passport number: Date of issue:

Place of issue:

Phone number: Email:

Permanent address:

Contact address:

Representative/guardian documents:

Relationship between the Personal Data Subject and the Company:

☐ Customer ☐ Partner ☐ Employee ☐ Applicant ☐ Other:

• 2. Personal Data Subject information

Full name: Date of birth:

Citizen ID/Identity Card/Passport number: Date of issue:

Place of issue:

Phone number: Email:

Permanent address:

Contact address:

B. REQUEST TO EXERCISE PERSONAL DATA SUBJECT RIGHTS

Request to exercise the following Personal Data Subject rights:

Right requested

(Tick the relevant right)

Specific request details

(Describe the request in detail)

☐ Right to withdraw consent to personal data processing

Specify the consent to be withdrawn:

• ☐ Right to view, correct, or request correction of personal data

Specify the scope, content, and purpose:

• ☐ Request for provision of personal data

Specify the scope, purpose, format, and quantity:

• ☐ Request for deletion of personal data

Specify the scope and purpose:

• ☐ Request for restriction of personal data processing

Specify the scope and purpose:

• ☐ Right to object to personal data processing

Specify the scope and purpose:

• ☐ Right to request personal data protection measures and solutions

Specify the reason:

Attached documents:

Undertaking:

• The requester and Personal Data Subject confirm that the information and documents provided in this Request Form are accurate; undertake to follow the Company's instructions on the sequence, procedures, and forms for exercising Personal Data Subject Rights; cooperate and provide all information and documents for identity verification if requested by the Company; pay any costs arising from fulfilling the Personal Data Subject's request in accordance with the Company's notices, requests, and fee schedule; and consent to the Company beginning to process the rights exercise request in accordance with the law, the Company's internal rules and procedures, and the Personal Data Processing and Protection Policy.
• The requester and Personal Data Subject agree to accept all possible consequences and damage specified in the Company's Personal Data Processing and Protection Policy and Procedure for Handling Personal Data Subject Requests, publicly posted at: https://inti.foundation/
• …………, day … month … year ……

Requester

(Sign and print full name)