1. 1. Introduce

The Statement on Personal Data Protection of Indovina Bank Limited ("IVB") clearly states IVB's commitment to protecting customers' personal data. This statement includes important definitions of personal data, and explains the rights of data subjects. IVB is committed to processing personal data only with the consent of customers, and implements technical and organizational measures to protect personal data. IVB also commits to respond and handle in a timely manner if there is a breach of personal data, and recommends that customers regularly monitor the updates of this statement.

• 2. Definition
• Personal data subjects: are the individuals reflected by personal data, including all individual customers who are using IVB's products and services, IVB's employees, shareholders and/or other individuals who have a legal relationship with IVB.
• Personal data: means information in the form of symbols, letters, digits, images, sounds or similar forms in the electronic environment associated with a specific person or helping to identify a specific person. Personal data includes basic personal data and sensitive personal data.
• Information that helps identify a specific person: is information formed from the activities of an individual that, when combined with other data and archival information, can identify a specific person.
• Personal data: Full name, middle name and birth name, other name (if any); Date of birth; date of death or disappearance; Gender; Place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence, hometown, contact address; Nationality; Images of individuals; Telephone number, identity card number, personal identification number, passport number, driver's license number, license plate number, personal tax identification number, social insurance number, health insurance card number; Marital status; Information about family relationships (parents, children); Information about the individual's digital account; personal data reflecting activities and history of activities in cyberspace; Other information that is associated with a specific person or helps identify a specific person. Political views, religious views; Health status and private life are recorded in medical records, excluding information about blood type; Information related to racial origin, ethnic origin; Information about an individual's inherited or acquired genetic trait; Information about physical attributes, unique biological characteristics of individuals; Information about the individual's sex life and sexual orientation; Data on crimes and criminal acts collected and stored by law enforcement agencies; Your information of credit institutions, foreign IVB branches, payment intermediary service providers, and other licensed organizations, including: your identification information in accordance with the law, information about accounts, information about deposits, information on deposited assets, etc  information about transactions, information about organizations and individuals that are guarantors at credit institutions, IVB branches, payment intermediary service providers; Data on an individual's location determined through location services; Other personal data prescribed by law is specific and requires necessary security measures.
  3. IVB's Commitment

At IVB, protecting your personal data is important to us. We are committed to complying with the principles set out in Decree 13 on Personal Data Protection during the processing of your personal data. IVB always applies and updates technical measures in accordance with the provisions of Vietnamese laws to ensure the data security of Personal Data, including protection measures from unauthorized or unlawful access and/or destruction,  loss or damage to Personal Data; We are constantly implementing and continuously improving organizational and technical measures to strengthen and consolidate the information ecosystem, ensuring that your personal data and interests are always protected.

1. 4. Methods of collecting personal data

IVB and/or the data processors hired by IVB may collect Personal data of Data Subject from various lawful sources, including but not limited to:

1. Through the relationship established between IVB and you when you use IVB's products and services or participate in IVB's lawful programs and activities including direct transactions at the branches, transaction offices of IVB and online transactions through electronic forms of transactions;
2. From suppliers, service providers, partners, affiliates and third parties related to IVB's business activities;
3. From third parties who have a relationship with you, such as employers, account co-owners, guarantors, security providers;
4. From the State Bank and/or other competent state agencies in Vietnam;
5. From the analysis of your activities during the use of IVB's products and services;
6. From third party sources whom you agree to share/provide data or sources where collection is required or permitted by law.
   5. Purpose of processing personal data

Personal Data may be processed by IVB or IVB's data processor or a third party authorized to process data for IVB for one or more of the following purposes:

1. 5. 1. 1. 1. To contact, exchange and provide information related to products and services provided by IVB;
            2. To verify the accuracy and completeness of the information provided by the Data Subject and identify the Customer in accordance with IVB's data subject identification process and as required by law;
            3. Appraisal of legal documents, credit, assets, financial capacity, civil act capacity, civil legal capacity, other conditions and capacity of the Data Subject for any products and services provided or proposed by IVB;
            4. To exercise IVB's rights and obligations under contracts, agreements or documents signed or concluded with the Data Subject and agreements and contracts entered into with other third parties (including but not limited to debt purchase and sale contracts);
            5. To handle loans, debts and handling collateral of the Customer, providing status, handling requests, questions, complaints and lawsuits of the Data Subject in the process of using products and services;
            6. To serve IVB's internal activities, including but not limited to:
               1. Audit;
               2. Administration and administration;
               3. Risk management;
               4. Internal meetings and staff training;
               5. Build a personal profile of the customer;
               6. To adjust strategies, protect interests, or evaluate the performance of IVB's operations or service provision;
               7. For the purposes of anti-money laundering, terrorist financing, financing of the proliferation of weapons of mass destruction; crime prevention and compliance with the provisions of law;
            7. To carry out promotions, communications, advertising and related activities about products, services and/or events organized and provided by IVB or IVB's business partners to Customers;
            8. To personalize the transactions of Data Subjects when using IVB's products, services and systems;
            9. To provide IVB's partners in cooperation agreements to develop products and services; partners analyze and process data for the purpose of analyzing customer behavior, analyzing consumer trends and consumer tastes;
            10. To carry out other activities related to the provision, operation, processing and management of IVB's products and services for customers;
            11. To implement data assessment, analysis and processing activities to evaluate business performance, create and maintain credit scoring systems, manage credit quality and maintain data on personal credit history;
            12. To provide information and take any action as required of competent state agencies and in accordance with law;
            13. To conduct market research, surveys and data analysis related to any products and services provided by IVB (whether conducted by IVB or another third party with which IVB cooperates) that may be relevant to the Customer;
            14. To meet and comply with IVB's internal policies, procedures and any rules, regulations, guidelines, directives or requirements issued by competent state agencies in accordance with the law;
            15. To evaluate any request for acquisition, transfer of business and/or property, assignment or transfer of rights, interests or obligations under contracts between the Data Subject and IVB;
            16. To serve other purposes related to IVB's business activities or transactions with Data Subjects that IVB deems appropriate from time to time;
            17. For any other purpose permitted by Vietnamese law.
   6. Rights of personal data subjects

As a personal data subject, you have the following rights:

• Right to know;
• Right to consent;
• Right to access;
• Right to withdraw consent;
• Right to request deletion of data;
• Right to restriction of data processing;
• Right to provide data;
• Right to object to data processing;
• Right to complain, denounce and initiate lawsuits;
• Right to claim compensation for damages;
• Right to self-protection and other relevant rights as prescribed by law.

With reasonable efforts, IVB will make a lawful and valid request from the Personal Data Subject within the time in accordance with the provisions of the law from the time of receipt of a valid request from you.

In the event that you withdraw your consent to the processing of your personal data, request erasure of your data, exercise other relevant rights with respect to any or all of your personal data, such actions may be taken:

• Affecting the legal validity of the contract, the legal relationship between IVB and you;
• IVB's products and services for customers are limited, restricted, suspended, or canceled depending on each case. This change may result in costs and damages that you and/or a third party will have to bear.

IVB will continue to use your personal data to the extent required (if any) or as prescribed by law.

1. 7. Potentially Risky Events

IVB is committed to taking measures

within IVB's ability and authority to protect your personal data. The selection and implementation of these measures will be based on an assessment and mitigation of the risks associated with your personal data. However, some risk events are still likely to occur with your personal data, including but not limited to:

• Hardware and software errors in the process of data processing cause data loss;
• The security vulnerability is beyond the control of IVB, the system is attacked by hackers causing data leakage;
• You disclose your personal data due to: carelessness or being scammed or accessing websites/downloading applications containing malware, etc.

In the event of a risk event, IVB will immediately activate the Incident Management Process to localize, isolate, resolve the incident and ensure the incident does not recur. During this process, IVB will proactively notify you and the competent State agencies to understand the information.

1. 8. Contact

In case the Personal Data Subject has any questions related to the Statement on Personal Data Protection Statement, please contact IVB at the nearest Branch/Transaction Office or call the 24/7 Customer Support Center at hotline 1900588879.

1. 9. Review and update

When necessary, IVB may amend, update or adjust the contents of this Statement on Personal Data Protection at any time. IVB recommends that you regularly check the Statement on Personal Data Protection on IVB's official website to update the changes and always be informed by IVB about how to protect your personal data. Your continued use of IVB's products and services is understood to mean that you have accepted the updated Statement on Personal Data Protection.