Privacy Policy

GENERAL TERMS AND CONDITIONS ON THE PROTECTION AND PROCESSING OF PERSONAL DATA This Policy on the protection and processing of Personal Data (the "Policy") sets out the manner in which Shinhan Securities Vietnam Co., Ltd. (the "Company" or "SSV") collects, processes, and protects the Personal Data of Users on the VinaStalk platform. Article 1. Definitions The terms used in this Policy shall be construed as follows (unless otherwise defined under the provisions of law): 1.1. "Personal Data" means digital data or information in any other form that identifies or assists in identifying a specific natural person, comprising Basic Personal Data and Sensitive Personal Data. 1.2. "Basic Personal Data" means Personal Data reflecting elements of identity and background that are commonly and regularly used in transactions and social relations, comprising: a. Family name, middle name, and name as recorded at birth, and any other name (if any); b. Date of birth; date of death or disappearance; c. Gender; d. Place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence, native place, and contact address; e. Nationality; f. Personal images; g. Telephone number, personal identification number, passport number, driver's licence number, and vehicle registration plate number; h. Marital status; i. Information on family relationships (parents, children); j. Information on the individual's digital account; k. Other information attached to a specific natural person or assisting in identifying a specific natural person that does not fall within the scope of Sensitive Personal Data. 1.3. "Sensitive Personal Data" means Personal Data attached to an individual's privacy which, if infringed, will directly affect the individual's lawful rights and interests, comprising: a. Political views and religious views; beliefs; b. Information on private life, personal secrets, and family secrets; c. State of health; d. Information relating to racial origin and ethnic origin; e. Biometric data and genetic characteristics; f. Information on the individual's sex life and sexual orientation; g. Data on crimes and violations of law collected and stored by law enforcement authorities; i. Data on the individual's location determined through location-based services; j. Login name and password information for the individual's electronic identification account; images of the identity card, citizen identity card, or people's identity card; k. Login name and password for bank accounts; bank card information and transaction history data of bank accounts; financial and credit information and information on the User's activities and transaction history in finance, securities, and insurance at credit institutions, foreign bank branches, payment intermediary service providers, securities and insurance organisations, and other licensed organisations; l. Data tracking the behaviour and activities of the use of telecommunications services, social networks, online media services, and other services in cyberspace; m. Other Personal Data which the law requires to be kept confidential or to be subject to strict security measures. 1.4. "Processing of Personal Data" means any activity affecting Personal Data, comprising one or more of the following activities: collecting, analysing, consolidating, encrypting, decrypting, amending, deleting, destroying, de-identifying, providing, disclosing, and transferring Personal Data, and other activities affecting Personal Data. 1.5. "Data Subject" means the individual whom the Personal Data reflects and whose Personal Data is shared with SSV through the VinaStalk platform. 1.6. "User" means a Data Subject who uses the functions and services on the VinaStalk platform. 1.7. "Company" or "SSV" means Shinhan Securities Vietnam Co., Ltd., including its head office, branches, representative offices, and transaction offices (if any). 1.8. "Third Party" means any organisation or individual other than SSV. For the avoidance of doubt, any term not defined in this Policy shall be construed in accordance with the provisions of the laws of Vietnam. Article 2. Purposes of Issuing This Policy 2.1. To transparently notify Users of all provisions relating to the processing of Personal Data at SSV. 2.2. To protect the rights of Users in respect of their Personal Data. 2.3. To ensure compliance with the provisions of law on policies for the protection of Users' Personal Data. Article 3. SSV's Undertakings 3.1. SSV undertakes to process Personal Data in a safe and prudent manner, in full and proper compliance with the provisions of law on the protection of Users' Personal Data. 3.2. SSV shall process Users' Personal Data only in a manner consistent with the provisions of law and this Policy. 3.3. The services on the VinaStalk platform are not directed at or intended for minors. SSV does not knowingly collect the Personal Data of minors. If a User has reason to believe that a minor has provided Personal Data to SSV through VinaStalk, please contact SSV using the information set out in Article 10. SSV will investigate any such notification and will delete the Personal Data from SSV's systems where appropriate. Users under 18 years of age must obtain the permission of a parent or guardian in order to use VinaStalk. 3.4. SSV undertakes not to use, transfer, provide, or disclose Users' Personal Data to any Third Party (other than the organisations and individuals permitted to process Users' Personal Data as listed in Clause 4 of Article 5) without the permission or consent of the User, save where otherwise provided by law. 3.5. In the event that SSV's information storage servers or information systems are compromised by a cyber-attack resulting in the infringement of Users' Personal Data, SSV shall be responsible for notifying the incident to the competent authorities for timely investigation and handling, and for notifying Users thereof. 3.6. SSV shall maintain absolute confidentiality of all of the User's online transaction information, including transaction information and digitised accounting documents held within SSV's data centre. Article 4. General Provisions 4.1. Depending on SSV's role in each situation, namely as (i) the Personal Data Controller; (ii) the Personal Data Processor; or (iii) the Personal Data Controller-cum-Processor, SSV shall exercise the corresponding rights and responsibilities and apply the corresponding principles for processing Personal Data in accordance with the provisions of applicable law. 4.2. SSV relies on the Personal Data provided by the User to maintain its legal relationship and service relationship with the User. Accordingly, the User must ensure at all times that the Personal Data provided by the User to SSV is complete and accurate. 4.3. Where necessary, SSV may amend, supplement, update, or adjust the contents of this Policy in respect of the User at any time. 4.4. The User understands and agrees that the Personal Data (including Basic Personal Data and Sensitive Personal Data) provided to SSV is not limited to Personal Data to be provided in the future but also includes Personal Data already provided to SSV. The User's continued use of SSV's services and products, or continued maintenance of transactions and agreements already established with SSV, after the time of acceptance of this Policy constitutes the User's express, voluntary, and affirmative consent permitting SSV to process the Personal Data (including Basic Personal Data and Sensitive Personal Data) throughout the process of receiving and processing such Personal Data, from the time SSV receives the information until a request to cease processing is made by the User or until otherwise required under the provisions of law. Article 5. Contents of the Processing of Personal Data 5.1. Purposes for Which SSV Processes Personal Data SSV may collect, process, and share the User's Personal Data for SSV's business, operational, and management purposes, including: a. Verifying the identity of the User and recognising/identifying the User for the purpose of providing SSV's facilities, products, and services on the VinaStalk platform. b. Monitoring the User's activities on the VinaStalk platform to ensure compliance with the provisions of law. c. Communicating with the User, including providing the User with updated information on changes to products, services, and facilities (provided by SSV or through SSV), including any amendment, supplement, expansion, suspension, and replacement of, or in respect of, such products, services, and facilities; and collecting the User's opinions through surveys. d. Maintaining the quality of, developing, and providing the facilities on the VinaStalk platform, including but not limited to activities relating to securities transactions and securities services in accordance with the provisions of law. e. Conducting research, planning, and statistical analysis for the purposes of developing or improving products, services, security, service quality, advertising strategies, or other strategies on the VinaStalk platform. f. Managing SSV's infrastructure and business operations and complying with internal policies and procedures as well as the provisions of law. g. Resolving, investigating, or responding to any complaint or dispute of, or relating to, the User. h. Complying with all applicable legal normative documents, laws, regulations, rules, official letters, directives, orders, guidelines, and/or requirements of any local or foreign competent authority, including regulatory, governmental, tax, and law enforcement authorities or other competent authorities. i. Disclosure of information; financial reporting, regulatory reporting, audit purposes, and record retention. j. In connection with the performance of SSV's duties and obligations when working with legal advisers and financial advisers; or compliance with contracts between SSV and other Third Parties. k. Managing benefits or entitlements relating to SSV's relationship with the User or arising from the User's participation in events, campaigns, or marketing promotions of SSV, whether alone or in conjunction with Third Parties. l. Protecting or enforcing SSV's rights, including rights relating to the implementation of debt recovery measures. m. Carrying out other activities relating to SSV's business, operation, management, and activities and complying with contractual arrangements, including but not limited to activities such as accounting, auditing, risk control, internal control, data processing for statistical analysis, credit, and anti-money laundering. n. Serving, caring for, and enhancing the User's experience in the course of using VinaStalk. 5.2. Types of Personal Data That May Be Collected and Processed The types of information listed below may vary from time to time and depending on the User's relationship with SSV on the VinaStalk platform: a. Information used by the User to create an account, log in, and use the services. b. The User's activity history and conversations between the User and SSV. c. Other information that relates to, affects (directly or indirectly), or arises from or in connection with the establishment of a relationship for the provision of products or services or any other legal relationship between SSV and the User. d. Personal Data provided by the User as input to VinaStalk (the "Content"), including prompts and other materials uploaded by the User. The community features allow the User to interact with other users, such as by posting, commenting, or sending messages, and SSV also treats such interactions as Content. e. Log data: SSV collects information that the User's browser or device automatically sends when the User uses VinaStalk. Log data includes the Internet Protocol address, browser type and settings, the date and time of the User's request, and how the User interacts with VinaStalk. f. Device information: SSV collects information about the device the User uses to access VinaStalk, such as the device name, operating system, device identifier, and the browser the User is using. The information collected depends on the type of device the User uses and its settings. g. Location information: For security reasons and to improve the User's product experience — such as by protecting the User's account through the detection of unusual login activity or by providing more accurate responses — SSV may determine the general area from which the User's device accesses SSV's Services based on information such as the device's IP address. h. Cookies and similar technologies: SSV uses cookies and similar technologies to operate and manage VinaStalk and to improve the User's experience. SSV stores certain information described in this Policy using cookies, for example to help maintain the User's preferences across sessions where the User is not logged in, or to support authentication and customer support. i. Information SSV receives from other sources: SSV receives information from other sources, such as SSV's trusted security and safety partners, in order to protect safety and prevent fraud, abuse, and other threats to SSV's Services, and from marketing vendors that provide SSV with information about prospective customers of SSV's business services. j. SSV also collects information from other sources, such as information publicly available on the Internet, in order to develop the models that support VinaStalk's Services. 5.3. Manner and Means by Which SSV Collects Personal Data SSV may collect Personal Data on the VinaStalk platform from one or more of the sources listed below, including but not limited to: a. When the User shares information to register for or log in to a VinaStalk account. b. When the User uses any function or feature on the VinaStalk platform or communicates or contacts SSV. c. From the mobile application, where the User downloads or uses the application or declares Personal Data therein. d. From interactions or automated data collection technologies: SSV may collect the User's Personal Data automatically recorded from the User's connection or from relevant parties, such as cookies, plug-ins, Third-Party social network connection sequences, or any technology capable of tracking and capturing Personal Data on such devices or electronic information pages (for example: Google, Facebook, TikTok, Instagram, etc.). e. From other sources in respect of which the User has consented to the sharing or provision of Personal Data, or sources from which collection is required or permitted by law. f. Means of collection in certain special cases: SSV may make audio or video recordings by electronic means when communicating with or supporting customers. In addition to the Personal Data protection measures prescribed by law, prior to processing the Personal Data of a child, SSV shall verify the child's age and obtain the consent of (i) the child and/or (ii) the child's parent or guardian in accordance with the provisions of law. In addition to complying with other relevant provisions of law, in respect of the processing of Personal Data relating to a person declared missing or a deceased person, SSV must obtain the consent of one of the relevant persons in accordance with applicable law. 5.4. Transfer and Disclosure of Personal Data a. SSV shall not sell, exchange, lease, or transfer the User's personal information in any form without the User's consent. However, in order to carry out the purposes and Personal Data processing activities set out in this Policy, the User understands and agrees that SSV may disclose Personal Data to one or more of the following parties: Employees and departments within SSV, for the purposes set out in this Policy; SSV's member units, including but not limited to subsidiaries, member companies, joint venture companies, and affiliated companies as determined by SSV from time to time; Claude Sonnet, Google Analytics. b. SSV treats Personal Data as private and confidential. Other than the parties referred to above, SSV does not disclose Personal Data to any other party, except in the following cases: Where the User has given consent; Where SSV is required or permitted to disclose under the provisions of law, or pursuant to a decision of a competent State authority; Where SSV transfers rights and obligations under the agreement(s) between the relevant parties and SSV, or acts in accordance with the provisions of law. 5.5. Transfer of Personal Data Abroad SSV may transfer the User's Personal Data to partners and service providers located abroad for processing consistent with the Processing Purposes consented to by the User under Clause 5.1 of this Article. In certain other cases, SSV's partners and service providers headquartered in Vietnam may use equipment and data processing systems located outside the territory of Vietnam to process Personal Data on SSV's behalf. All such cases are regarded as transfers of the User's Personal Data abroad. Please note that certain countries may have a level or practice of Personal Data protection that is lower or higher than that of Vietnam. In every case involving the transfer of Personal Data abroad, SSV will endeavour to put in place appropriate measures to ensure the protection of the User's Personal Data, including entering into agreements and undertakings on data security, selecting Third-Party service providers appropriate to a clearly defined mandate, and engaging such partners only where they have appropriate protective measures in place. Article 6. Rights and Obligations of the User 6.1. The User has the following rights in respect of the processing of Personal Data at SSV: To be informed of the processing of Personal Data; To consent or withhold consent; To request the withdrawal of consent to the processing of Personal Data; To access, correct, or request the correction of Personal Data; To request the provision, deletion, or restriction of the processing of Personal Data; and to submit an objection to the processing of Personal Data; To lodge complaints and denunciations, to initiate legal proceedings, and to claim compensation for damage in accordance with the provisions of law; Other related rights in accordance with the provisions of law. The specific content of the above rights shall be subject to the provisions of applicable law. 6.3. SSV shall, using reasonable efforts, give effect to the User's lawful and valid request within the statutory period from receipt of a complete and valid request and the relevant processing fee (if any) from the User, subject to SSV's right to invoke any exemption and/or exception provided by law. 6.4. For security purposes, the User may be required to submit the request in writing or to use another method to prove and authenticate the User's identity. SSV may require the User to verify their identity before processing the User's request. 6.5. The User is responsible for protecting their own Personal Data and for requiring other relevant organisations and individuals to protect their Personal Data. At the same time, the User shall respect and protect the Personal Data of others. 6.6. The User shall provide SSV with complete and accurate Personal Data when entering into a contract or using the services provided by SSV. 6.7. The User shall implement and comply with the provisions of law on the protection of Personal Data and shall participate in preventing and combating acts in violation of the regulations on the protection of Personal Data. 6.8. The User shall keep up to date with the information posted on the VinaStalk site and comply with any changes (if any) relating to this Policy. 6.9. The User shall immediately notify SSV upon detecting or suspecting that Personal Data has been leaked in a manner that may give rise to risks in the course of using the products and services, or upon becoming aware of any violation relating to the protection of Personal Data under this Policy. 6.10. The User understands and agrees that SSV has the right to refuse to give effect to the User's requests in certain cases, including but not limited to: (i) where the User has not followed the order and procedures instructed by SSV; (ii) where SSV assesses that there are indications of fraud or of a violation relating to the protection of Personal Data; or (iii) where the provisions of law do not permit the User's request to be given effect. 6.11. The User confirms that, by accepting this Policy, the User has been notified by SSV of, has clearly understood, and has consented to all matters required to be notified prior to SSV's processing of Personal Data, as set out in detail in this Policy. The User agrees that SSV is not required to give further notice prior to processing Personal Data. Article 7. Potential Adverse Consequences and Damage The User should note that, although SSV always endeavours to ensure that the User's Personal Data is protected to the highest standard required by law, SSV cannot completely and absolutely eliminate all risks to Personal Data during processing. 7.1. The transmission of information over the Internet or through SSV's internal information systems may still entail certain risks arising from force majeure events or from cyber-security incidents and crimes, such as cyber-attacks, cyber-terrorism, and unauthorised cyber-espionage, which may disrupt data processing or result in the leakage of Personal Data. In such cases, SSV will immediately take the necessary actions to prevent, remedy, and minimise the potential adverse damage to Personal Data, and will coordinate with the competent State authorities for the timely investigation and handling of the violation and notify the User in accordance with the provisions of law. 7.2. The User should be clearly aware that, at any time the User discloses and makes public their Personal Data, such data may be collected and used by others for purposes beyond the control of the User and of SSV. 7.3. The User should be clearly aware that, to the extent that reasonable measures have been applied to prevent risks to Personal Data, SSV shall not be liable to compensate for damage caused by the acts of any Third Party adversely affecting the User's Personal Data where such acts do not originate from SSV. Article 8. Storage of Personal Data 8.1. Personal Data stored by SSV shall be kept confidential. SSV will implement reasonable measures to protect Personal Data while it is stored at SSV. 8.2. SSV stores Personal Data for the period necessary to fulfil the purposes set out in the documents executed between the relevant parties and SSV and in this Policy, unless a longer storage period is required or permitted by the relevant party or parties and by applicable law. Article 9. Amendment and Supplementation of the Policy 9.1. SSV may amend and supplement the contents of this Policy from time to time and shall ensure that such amendments and supplements are consistent with the relevant provisions of law. 9.2. To the extent permitted by applicable law, the continued use of VinaStalk by the User or the relevant parties shall constitute the agreement of the User or the relevant parties to the amended and supplemented contents of this Policy, without any conditions attached. Article 10. Contact Information for Personal Data Processing For any queries relating to SSV's processing of the User's Personal Data, please use the contact details below: Support Department: Shinhan Securities Vietnam Telephone: 028 6299 8000 Email: support@shinhan.com