1. General Terms

This regulation regulates and governs the processing of your personal data by Guotai Junan Securities (Vietnam) Corp. (“GTJAVN”) and is an integral part of the contracts, agreements, proposals, registrations, etc. that governs and establishes the relationship between the Client and GTJAVN.

• This provision applies only to individual Clients of GTJAVN.
• This regulation also regulates and governs GTJAVN’s processing of personal data of:
  • Your related person is required by law to collect (“Related persons”);
  • Other third parties as prescribed by GTJAVN from time to time: dependents, spouses, children, parents, authorized persons, emergency contact persons, and other individuals (“Third Party”);

By providing personal data of NLQ and/or a Third Party to GTJAVN, you represent and warrant that: (i) You have obtained the consent of the Related persons and/or such Third Party for the processing of personal data in accordance with the terms and conditions set forth in these Regulations, (ii) you are solely responsible for processing of the Related persons and the Third party data you provide to GTJAVN.

• To the extent of processing personal data in accordance with this Regulation, GTJAVN is the controller and/or controller and processor of personal data.

• Processing of personal data is one or a number of activities affecting personal data, such as: collection, recording, analysis, confirmation, storage, correction, disclosure, combination, access, retrieval, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction of personal data or any other relevant actions which are defined by law at each time or by any applicable law. Processing of personal data may take place at any time, including automatic processing of personal data and transfer of personal data abroad.

2. Type of processed personal data
   Group 1 personal data: Last name, middle name and first name, other names (if any); Date of birth; date of death or going missing; Gender; Place of birth, registered place of birth; place of permanent residence; place of temporary residence; current place of residence; hometown; contact address; Nationality; Personal image; Phone number; ID Card number, personal identification number, passport number, driver’s license number, license plate, taxpayer identification number, social security number and health insurance card number; Marital status; Information about the individual’s family relationship (parents, children); Digital account information; personal data that reflects activities and activity history in cyberspace; Information associated with an individual or used to identify an individual other than that specified in Group 2 personal data as below.

• Group 2 personal data (on a case by case basis): Political and religious opinions; Health condition and personal information stated in health record, excluding information on blood group; Information about racial or ethnic origin; Information about genetic data related to an individual’s inherited or acquired genetic characteristics; Information about an individual’s own biometric or biological characteristics; Data on crimes and criminal activities collected and stored by law enforcement agencies; Information on Clients of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including: Client identification as prescribed by law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service providers; Personal location identified via location services; Other specific personal data as prescribed by law that requires special protection.
• Group 3 personal data
  • Data generated/extracted from or related to technical systems (including devices, operating systems, browsers, IP addresses, other technical systems) such as: language settings information, date and time of connection to the website, application usage statistics, application settings, date and time of connection to the application; account name; password; secure login details; usage data; data and other relevant information.
  • Data generated/extracted in relation to advertising interests; cookie data; clickstream data; browsing history; response to direct marketing; and opt out of direct marketing; data and other relevant information.

3. Purpose of processing personal data

• Handling your requests when requesting to open an account, register to use securities services provided by GTJAVN:
  • Verify the accuracy and completeness of the information provided by the Client; Verify Client’s identity and background and implement Client authentication process;
  • Update personal information
  • Check and compare with relevant data sources;
  • Enter, check and control the completeness and accuracy of the data entered into the system;
  • Evaluate and verify the Client’s legal profile, financial status and eligibility for any products and services proposed or provided by GTJAVN;
  • Measure, build and assess the reliability of credit reputation;
  • For the purpose of preventing, combating money laundering, combating terrorist financing, complying with sanctions or sending it to the competent authority as regulated from time to time;
  • For purposes of complying with FATCA (Tax Compliance Act for Foreign Account Holders) as agreed between the IRS and the Vietnamese government;
  • Checking on your behalf your account information (excluding password) at the company providing products and services that GTJAVN deems necessary to serve the assessment, appraisal, account opening, registration to use securities services at your request;
  • Authenticate you so that you can access your digital/electronic account, to personalize your experience with GTJAVN products and services;
  • Automatically register you in digital applications for you and/or GTJAVN to open an account, register to use securities services for you;
  • Activate, manage, maintain, close/lock information(s) for account opening, using securities services that you use;
  • Provide/send statements, messages, correspondence, letters or other Regulations to you or other relevant parties;
  • Implement advertising, promotion, preferences and support programs of GTJAVN;
  • Respond to your inquiries and complaints and resolve disputes.
• Use, analyze to develop, provide, improve and improve the quality of services and products, including:
  • Generate data, reports and statistics, feedback for GTJAVN and/or other relevant third parties of GTJAVN;
  • Conduct market research, survey and data analysis related to account opening, securities services, other services provided by GTJAVN itself and/or GTJAVN together with other parties;
  • Risk assessment, trend analysis, statistics, planning, including analysis and processing of statistical data on credit, risk to create and maintain credit scoring systems, to evaluate and maintain data on personal credit history;
• Meet the requirements for GTJAVN to exercise its rights and obligations in implementing and complying with the laws and regulations of GTJAVN, including:
  • Manage and record calls and electronic communications with you and other interested parties;
  • Defend or enforce GTJAVN’s rights, including to collect fees and charges and to collect debts;
  • Meet or comply with GTJAVN’s internal policies;
  • Respond to or comply with procedures, rules, regulations, guidelines, directives or requests issued by any court, authority (domestic or international) (including but not limited to the disclosure of information to such authority);
  • Conduct transactions to buy, sell, transfer, transfer the business and/or assets of GTJAVN;
  • Entering into contracts, agreements and documents; transaction of purchase, sale, transfer, transfer of rights, interests or obligations under your contract(s) with GTJAVN;
  • Implement and comply with agreements and contracts between GTJAVN and other parties;
  • Provide data to service providers of GTJAVN;
  • For any other purpose as required or permitted by any law, regulation or directive of any competent authority;
  • For statistical, management and reporting purposes; serving the requirements of tax, accounting, auditing, risk control, internal control; serve, care for and enhance the Client experience; preventing and combating money laundering, combating terrorist financing, complying with sanctions; settlement of complaints, settlement of disputes; comply with the provisions of law (including Vietnamese law, foreign law, international treaties, international agreements) and requirements of competent authorities.
• Perform other activities related to the provision, operation, handling and management of GTJAVN for account opening, securities services provided to you.
• Serving other purposes that GTJAVN deems appropriate from time to time.

4. Organizations and individuals entitled to process personal data

 Officials and employees at Head Office, branches/units in the system of GTJAVN, subsidiaries/affiliated companies of GTJAVN;

• Companies and/or organizations acting as vendors, suppliers, partners, agents, consultants, including but not limited to:
  • Company providing services to help GTJAVN operate products, operate websites, applications or devices, provide you with products or services you have selected, or to manage activities on behalf of GTJAVN, such as sending newsletters or surveys;
  • The Company provides administrative, postal, telecommunications, data processing, information technology, payment, credit reference, custody, data entry, verification, records management, technology support, information security, data center, consulting and/or other services in connection with, or to support, the operation of GTJAVN;
  • The company provides payment services and related services with payment transactions via websites and applications;
  • The company provides debt recovery services, limiting services, and controlling credit risks (if any).
  • Auditing company; Law consulting firm;
  • Valuation, appraisal and price consulting company (if any);
  • Rating organization.
  • Individuals, agencies and organizations to whom GTJA must provide information in accordance with (i) legal obligations, or (ii) provisions of law, or (iii) requests of regulatory agencies or authorities.
• Transactional/expected party to buy, sell, transfer, transfer business and/or assets of GTJAVN;
• Transaction staff /expected party to purchase, sell, transfer, transfer rights, interests or obligations under your contract(s) with GTJAVN;
• Any person, authority or regulatory body or third party to whom GTJAVN is authorized or required to disclose under the laws of any country, or under any other contract or undertaking between a third party and GTJAVN;
• Any person or entity involved in the exercise or maintenance of any rights of GTJAVN under the agreements between you and GTJAVN;
• Any individual or organization intending to pay any of your outstanding amounts with GTJAVN;
• Other organizations and individuals as prescribed by law;
• Any party that GTJAVN deems necessary for the purposes of processing personal data mentioned in Article 3.

5. The way of collecting personal data and collecting method

 The way of collecting personal data

• Directly from you:
  • Through the relationship established between GTJAVN and you when you register, use any product or service of GTJAVN.
  • From GTJAVN Websites: GTJAVN may collect personal data when you visit any GTJAVN website or use any features or resources available on or through the Website.
  • From GTJAVN’s Mobile App: GTJAVN may collect personal data when you download or use GTJAVN’s mobile app.
  • From the exchange and communication between GTJAVN and you: GTJAVN may collect personal data during the exchange and communication between GTJAVN and you (in person, by mail, phone, online, electronic communication or any other means) including GTJAVN surveys that you participate in.
• From interactions or automated data collection technologies: GTJAVN may collect information including IP address, referring URL, operating system, web browser and any other information automatically logged from the connection:
  • • Cookies, flash cookies, pixel tags, electronic beacons, or other tracking technologies.
    • Third-party cookies, plug-ins or social media connectors.
    • Any technology capable of tracking personal activity on devices or websites.
    • Location information or other metadata provided by a device.
    • Other means: GTJAVN may collect personal data when you interact with GTJAVN through any other means.
• From other third parties:
  • From suppliers, service providers, partners, affiliates and third parties related to GTJAVN’s business.
  • From third parties who have a relationship with you such as Related persons, employer, guarantor, security provider.
  • From social networking platforms (google, social insurance, Tax code, Facebook, Zalo…) that you have updated.

Whenever data is collected from other third parties, GTJAVN will ensure that the relevant third parties have obtained your consent for: (i) the third party’s provision of personal data to GTJAVN; and (ii) the processing of data for the purposes of GTJAVN in this Regulation. If you do not agree, please do not provide your personal data to third parties.

• Collecting method

GTJAVN has the right but has no obligation to collect your personal data by the following methods: recording, entering data electronically, recording instructions or information orally, video recording, notarization, license and other methods of collection that GTJAVN deems appropriate.

6. Rights and obligations of Client

 You have the right to know, consent, access, withdraw consent, request data deletion, restrict data processing, provide data, object to data processing, complain, denounce, sue, claim damages, right to self-protection under personal data protection laws.

• You have obligations to protect your personal data yourself; request other relevant organizations and individuals to protect their personal data; fully and accurately provide personal data when agreeing to allow GTJAVN to process personal data; perform the provisions of the law on protection of personal data and other obligations in accordance with the law.

7. Risks of Personal Data Disclosure and Protection Measures

 Client understands that providing and consenting to GTJAVN to use Personal Data will always exist potential risks due to system failure, transmission line, force majeure events, virus, network attack or hardware, software failure, actions and manipulations of Client or any other third party affecting the provision and processing of Client’s Personal Data…. Risks may arise such as that Client’s Personal Data may be exposed or stolen by another party, resulting in these Personal Data being used for undesired purposes or beyond the control of GTJAVN and Client causing both material and spiritual losses.

• GTJAVN considers Client’s Personal Data as the most important asset of GTJAVN and GTJAVN always strives to ensure confidentiality, safety, compliance with the law, limit the consequences, unwanted damage that may occur. We are committed not to exchange, rent your personal data without your consent or sell your personal data in any way.
• Responsibility for confidentiality of Client’s Personal Data is a mandatory requirement of GTJAVN for all employees. GTJAVN carries out its responsibility to protect Personal Data in accordance with current laws with the best security methods in accordance with the law and regularly reviews and updates management and technical measures when processing Client’s Personal Data (if any).

8. Storage of Personal Data

 Client’s personal data stored by GTJAVN will be kept confidential. GTJAVN will take reasonable measures to protect Client’s Personal Data when stored at GTJAVN.

• GTJAVN stores Client’s Personal Data for the period necessary to fulfill the purposes in accordance with the agreements, contracts, documents signed by the Client with GTJAVN and the General Terms and Conditions of this Regulation, unless the retention period of Personal Data is longer if required or permitted by the Client and applicable laws.

9. Data processing time

The processing of personal data will be started from the time GTJAVN receives your information and personal data. GTJAVN will maintain the processing of your personal data during the period when you establish contracts, agreements and documents with GTJAVN. We may also store your personal data for a period of time as required by law.

10. Miscellaneous

• When you wish to access your personal data that GTJAVN is processing, or when you suppose that the personal data held by GTJAVN is inaccurate, incomplete, misleading or not up to date, you may submit a written request for access, correction, or update through GTJAVN’s branch/transaction office or through any other channel(s) established by GTJAVN from time to time as may be established by GTJAVN.
• Clients who want GTJAVN to provide themselves with their personal data can perform the following forms of requesting personal data:

• • Clients directly or legally authorize others to come to GTJAVN’s head office and fill in the information in the Request for providing personal data according to the Form attached to this Regulation.
  • Send the request form for providing personal data according to the Form attached to this Regulation via electronic network, postal service, fax to GTJAVN.

GTJAVN reserves the right to review and make decisions on personal data protection in accordance with GTJAVN’s regulations and relevant laws on a case-by-case basis.

• GTJAVN, with reasonable efforts, will comply with your request to access or correct your personal data upon receipt of a complete, valid request and related processing fee (if any) from you.
• Please note that GTJAVN may, in its sole discretion, authorize the required correction and/or may request additional documentation of new data to avoid fraud and inaccuracies.
• GTJAVN is committed to processing your data based on your consent in accordance with this Regulation, unless otherwise provided by law.
• In the event that you become aware of a breach in the processing of your personal data, you have the right to request GTJAVN in writing to assist in processing, within the capacity of GTJAVN, to prevent or limit the disclosure of your personal data, unless otherwise provided by law.
• In order to meet your legal rights and obligations, the rights and responsibilities of GTJAVN, the exercise of rights and obligations in this Article is performed by GTJAVN when there are sufficient grounds to authenticate you / your authorized person, the validity and legality of the relevant documents and ensure compliance with the provisions of the law on data protection and other relevant regulations.
• You may send a written withdrawal of your consent to any or all of the contents set forth in this Regulation through GTJAVN branches/transaction offices or through other channel(s) as may be established by GTJAVN applicable to you from time to time. If you withdraw your consent to the data processing in accordance with this Regulation, GTJAVN reserves the right to discontinue providing GTJAVN products or services to you. Withdrawal of this consent will be deemed a termination on your part of any contractual relationship you have with GTJAVN, and a breach of your contractual obligations or commitments, and we expressly reserve our legal rights and remedies in such cases. GTJAVN shall not be liable to the Client for any loss (if any), and GTJAVN’s legal rights shall be expressly reserved with respect to such limitation, restriction, suspension, cancellation, restriction, or prohibition. Clients should note that, due to the characteristics of GTJAVN’s operations, the law requires that GTJAVN have to store Client information in certain cases, then GTJAVN cannot meet Client’s request to delete data if the deletion of data leads to a violation of the law.
• For security purposes, Client may need to make its request in writing or use another method to prove and verify Client’s identity. GTJAVN may require Client to verify their identity before processing Client’s request.
• Clients are responsible for protecting their own Personal Data, requesting other relevant organizations and individuals to protect their Personal Data. At the same time, respect and protect the Personal Data of others.
• Provide complete and accurate Personal Data to GTJAVN when entering into a contract or using services provided by GTJAVN.
• Implement and comply with the provisions of the law on protection of Personal Data and participate in the prevention and combat of violations of regulations on the protection of Personal Data.
• Without prejudice to the foregoing, you agree and acknowledge that any withdrawal of your consent to the processing of data in accordance with this Regulation will not affect the previous processing of your personal data in accordance with the consent you have obtained with GTJAVN.
• In case there is a change or adjustment of Personal Data, the Client is responsible for contacting and immediately informing GTJAVN so that GTJAVN can promptly update such changes and adjustments. Client will be fully responsible for any delay in this notice; at the same time, the delay in this notice from the Client will exempt GTJAVN from all damages and risks arising to the Client and related parties (if any).
• When using any service, product or accessing any website, application or device of GTJAVN or connected to GTJAVN, the Client is deemed to have accepted the entire General Terms and Conditions of this Regulation. In case the Client does not accept the General Terms and Conditions of this Regulation, the Client has the right to terminate the use of services, products or access to GTJAVN websites, applications or devices or connected to GTJAVN.

• All amendments, supplements and replacements of this Regulation shall be decided by the General Director of Guotai Junan Securities (Vietnam) Corp..

ANNEX PERSONAL DATA REQUEST FORM:  Form No.01_EN (for individuals)  Form No.02_EN (for organizations and enterprises)

                                                                                                                                                                                                                                                                   GENERAL DIRECTOR

                     

                                                                                                                                                                                                                                                                                 HOÀNG ANH