Pursuant to the Vietnamese laws, by this Notice of Personal Data Processing (hereinafter referred to as the “Notice”), Indovina Bank Ltd. (“IVB”/ “the Bank”) would like to inform you as a Data Subject (Hereinafter referred to as “Data Subject” or “Customer” or “you”) regarding Personal data processing (as defined below) with the Terms and Conditions stipulated in this Notice.
 

A. Definition of terms
1. “Personal data” means information in the form of symbols, letters, numbers, images, sounds or similar forms on the electronic medium associated with an individual or used to identify an individual. The Personal data includes Basic Personal data and Sensitive Personal data.
2. “Basic Personal data” includes:
a. Last name, middle name and first name, others name (if any);
b. Date of birth; date of death or going missing;
c. Gender;
d. Place of birth, registered place of birth, place of permanent residence, temporary residence, current
residence, hometown, contact address;
e. Nationality;
f. Personal image;
g. Phone number, identity card number, personal identification number, passport number, driver's license number, license plate number, taxpayer identification number, social security number and health insurance card number;
h. Marital status;
i. Information about family relationships (parents, children);
j. Digital account information of individual; Personal data reflecting activities, history of activities on cyberspace;
k. Other information associated with an individual or used to identify an individual but not Sensitive Personal data.
3. “Sensitive Personal data” refers to Personal data associated with individual privacy which, when being infringed, will directly affect the legal rights and interests of an individual, including:
a. Political and religious views;
b. Health status and private information stated in the medical record, excluding blood type information;
c. Information related to racial or ethnic origin;
d. Information about genetic date related to inherited or acquired genetic characteristics of an individual;
e. Information about the individual's own biometric and biological characteristics;
f. Information about an individual's sex life and sexual orientation;
g. Data on crimes and criminal activities collected and stored by law enforcement agencies;
h. Individual identification information including but not limited to signatures, fingerprints, face image and other biometric characteristics;
i. Finance and transaction information with the Bank including but not limited to bank account information, investment account information, credit card number, debit card number, credit card type, debit card type, statement information, credit and debit card transaction history, income and
expenditure information, credit information, credit rating information, debt information, debt payment plans; information on assets including deposit and security assets, information on financial position, information on risk assessment, information on insurance or investment contracts through the Bank; information generated from the analysis of Personal data that the Bank is authorized to collect and other information related to the request to use the Bank's products and services;
j. Information about transactions with the Bank, including but not limited to information about location, time, internet protocol address (IP address), technical information, browser, operating system and platforms, internet or mobile networks, device settings and other technical data obtained from the use of the Bank's platforms, applications and operating systems, personal choices, transactional personal preferences and other information arising in the course of performing any transaction with the Bank;
k. Personal location data identified through location services;
l. Other specific Personal data as prescribed by law that requires necessary security measures.
4. “Data Subject” means individual to whom the Personal data relates, which can be:
(i) individuals who interact, propose to engage, learn, and transact with the Bank whether they are old, current or potential customers of the Bank; (ii) individual employee, officers, representatives, shareholders, managers, directors, contact persons, agents, persons related to an organization that is a former, current or potential customer of the Bank or related to individuals listed in item (i); (iii) individuals who are managers, executive officers, member of the board of control of the Bank and persons related to these individuals; (iv) individuals who are contract employees with the Bank, individuals who are employees of suppliers, of the Bank and those related to such individuals;
5. “Personal data processing” or “data processing” or “process” means one or more activities affecting Personal data, including but not limited to collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, traceability, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction Personal data or other relevant activities.
“Personal data processing” or “data processing” or “process” shall include a form of Personal data processing carried out by electronic devices in order to evaluate, analyze and predict the activities of an individual, including but not limited to habits, preference, reliability, behavior, location, trends, capability and other circumstances.

B. General provisions
1. This Notice forms an integral part of the respective agreements, terms and conditions governing the relationship between you and the Bank. By registering to use or using the Bank's products or services or by allowing the Bank to use your personal information, you accept the terms and conditions detailed herein this Notice.
2. In the event of any discrepancy or conflict between the terms and conditions contained in this Notice and the agreements, terms and conditions governing your relationship with the Bank entered into before, on the same day or after the date of this Notice, the contents of this Notice shall prevail.
3. If in the contracts, agreements and other documents entered into between you and the Bank, there are clearer provisions on how the Bank collects, stores, protects and processes your Personal data, the Bank's rights under this Notice shall be supplemented by such terms and nothing in this Notice shall imply restrict any of the rights of the Bank.
4. By providing Personal data of a third party (including but not limited to: information of dependents, legally related persons, spouses, children and/ or your parent and/or guardian, friend, reference, beneficiary, authorized person, partner, emergency or other personal contact) to the Bank, you
represent, warrant and are responsible that you have obtained the legal consent of such third party for the Bank's data processing with the purposes set out in this Notice.
5. The Bank will process the Personal data as a controller and process the Personal data that the Bank collects from you or collects during the process of the Bank's dealings with you, accordingly, the Bank will decide the purpose, means and directly process the Personal data.

C. Types of Personal data collected and how to collect Personal data
1. In order for the Bank and/or the data processor hired by the Bank to be able to provide products and services to you and/or to process your requests, the Bank and/or the processor data may and/or may be required to collect Personal data, including: (i) Basic Personal data and (ii) Sensitive Personal data
relating to you and individuals related to you.
2. The Bank and/or the data processors hired by the Bank may collect Personal data of Data Subject from various lawful sources, including but not limited to:
a. Through the relationship established between the Bank and you when you use the Bank's products and services or participate in the Bank's lawful programs and activities including direct transactions at the branches, transaction offices of the Bank and online transactions through electronic forms of transactions;
b. From suppliers, service providers, partners, affiliates and third parties related to the Bank's business activities;
c. From third parties who have a relationship with you, such as employers, account co-owners,
guarantors, security providers;
d. From the State Bank and/or other competent state agencies in Vietnam;
e. From the analysis of your activities during the use of the Bank's products and services;
f. From third party sources whom you agree to share/provide data or sources where collection is required or permitted by law

D. Data processing purposes

The Bank and/or the data processor hired by the Bank will process your Personal data in accordance with the law, specifically for one or more of the following purposes:
To contact, exchange and provide information related to products and services provided by the Bank;
2. To verify the accuracy and completeness of the information provided by you and to identify you in
accordance with the Bank's customer identification process and as required by law;
3. To appraise your legal documents, credit, assets, financial capacity, civil act capacity, civil legal
capacity, other conditions and capacity for any product, any service provided or offered by the Bank;
4. To conduct the Bank's rights and obligations under the contract, agreement or document entered into
with you and the agreement or contract entered into with other third parties (including but not limited
to due to debt sales contracts);
5. To handle your loans, debts and security assets, provide the status, handle your requests, questions,
complaints, lawsuits during the use of the product, service;
6. To serve the internal operations of the Bank, including but not limited to:
a. Audit;
b. Administration;
c. Risk management;
d. Internal meetings and staff training;
e. Build your personal profile;
f. Adjust strategy, protect interests, or evaluate the Bank's performance or service delivery;
g. Crime prevention and compliance with the law;
7. To conduct promotions, communication, advertising and related activities about products, services and/or events organized and provided by the Bank or its business partners to you;
To personalize your transactions when using the Bank's products and services and systems;
9. To provide the Bank's partners in cooperation agreements to develop products and services; data analysis and processing partners for the purpose of analyzing customer behavior, analyzing consumer trends, consumer tastes;
10. To perform other activities related to the provision, operation, handling and management of the Bank's products and services for you;

11.To implement assessment activities, analyze and process data to evaluate business performance, create and maintain credit scoring systems, manage credit quality and maintain historical data personal credit;
12. To provide Personal data and take any action upon request at the request of a competent state agencies in accordance with the laws;
13. To conduct market research, surveys and data analysis related to any products or services provided by the Bank (whether performed by the Bank or another third party cooperating with the Bank) which may involve you;
14. To comply with the Bank's internal policies, procedures and any rules, regulations, instructions,
directives or requests issued by the state agencies in accordance with the laws;
15. To evaluate any request to acquire, transfer business and/or assets, transfer or assign rights, interests or obligations under contracts between you and the Bank;
16. To serve other purposes related to the Bank's business operations or transactions with you as the Bank deems appropriate from time to time;
17. For any other purpose permitted by Vietnamese laws.

E. Parties involved in the Personal data processing
For the purposes of Personal data processing above, the Bank may provide the Personal data of Data Subject to one or more of the following parties:
a. Capital contributors of the Bank, related persons of the Bank;
b. Business partners of the Bank related to financial services, banking, investment, insurance,
communication, trade promotion and other activities which the Bank cooperates, individuals and
organizations related to the supply of goods and services to the Bank, consulting units (including but not limited to lawyers, legal consultants, financial consultants, technicians, accountants, auditors and/or other professional consulting units), credit institutions, financial institutions, international card organizations, payment intermediaries, clearing and settlement services, payment or settlement services, insurance companies or insurance brokers, the Bank's service partners, domestic and international correspondent banks which the Bank is a contracting party, infrastructure development service providers, internet service providers, telecommunications and communications service providers, technical infrastructure providers, information technology and electronic systems developers and suppliers providing financial and security products or services or other products and services to the Bank;
c. Others related to you, such as joint deposit account holders, joint obligors, authorized persons, trustees, beneficiaries, asset managers, guarantors, or any individual whose assets are used as security for the performance of your obligations to the Bank, your heirs, heritage managers;
d. Associations, organizations, clubs, working groups related to the Bank's activities;
e. Competent State agencies in Vietnam or any competent individual, organization or regulatory agency or third party to whom the Bank is permitted or required to provide information in accordance with the laws of any country or any contract/agreement between a third party and the Bank;
f. Vietnam National Credit Information Center (CIC) or any other competent agency to the Bank;
g. Individuals and organizations that acquired the rights, obligations and legal requirements of the Bank, including those related to business restructuring, business transfer, investment, mergers and
acquisitions or purchase and sale of assets, shares or enterprises;
h. Any person or entity involved in conducting or maintaining any rights or obligations under the
agreements between you and the Bank;
i. Third parties as prescribed by Vietnamese law that the Bank is entitled to provide Personal data or you agree to provide Personal data or the Bank has a legal basis to provide Personal data.

F. Rights and obligations of Data Subject in relation to Personal data
1. The Data Subject has the rights and obligations related to the Personal data processing in accordance with the relevant provisions of the laws of Vietnam.
2. To the extent permitted by law, the Data Subject may carry out its rights by contacting the Bank using the information and methods provided in this Notice. After receiving a complete and valid request and the processing fee (if any) as prescribed by the Bank from time to time, the Bank will endeavor to fulfill the request within the time required by law except for exceptions as prescribed by law.
3. When responding to a Data Subject's correction request, the Bank reserves the right to request additional documents to prove new data to avoid fraud and inaccuracies.
4. The Bank reserves the right to restrict and/or refuse the Data Subject's requests under certain circumstances, for example when the Bank is unable to identify the Data Subject or in the cases where the Bank is not allowed to do by law.
5. You can request to delete or withdraw your consent for Personal data in writing and send it directly to the Bank's branches and transaction offices.
6. In the event that you withdraw your consent, request data deletion and/or carry out other relevant rights with respect to any or all of your Personal data, and subject to the nature of your request, the Bank may not continue to provide the Bank's products or services to you. The acts performed by you in this clause will be considered as a unilateral termination of the agreements and contracts signed with the Bank and a breach of your obligations according to such agreements and contracts. The Bank will
reserve all rights in relation to handling the event of breach and taking the Bank's lawful remedies in such cases. The Bank shall not be liable to you for any loss incurred in connection therewith.

G. Outbound transfer of Personal data
1. In order to fulfill the purposes of Personal data processing in this Notice, the Bank may be required to provide/share your Personal data with relevant third parties of the Bank who may be located in Vietnam or any other location outside the territory of Vietnam.
2. When providing/sharing Personal data abroad, the Bank will require the receiving party to ensure that your Personal data transferred to them will be confidential and secure. The Bank ensures to comply with legal obligations and regulations regarding the transfer of your Personal data.
 

H. Storage of Personal data
1. The storage and protection of Personal data shall be applied as from the commencement and throughout the data processing.
2. The Bank fulfills its responsibility to protect Personal data in accordance with applicable laws with optimal security methods and regularly updates technical and management measures when processing Personal data of Customer.
3. The Bank will retain your Personal data for the period necessary to fulfill the Personal data processing purposes set out in this Notice and agreements/contracts that the Bank enters into with you, unless the
law provides for a different retention period or where Personal data cannot be deleted as required by law.
 

I. Amendment of the Notice of Personal Data Processing
This Notice may be amended or supplemented or superseded from time to time. The Bank will post the Notice publicly on the Bank's website or will notify you in such a manner as the Bank deems appropriate.
 

J. Contact with the Bank to carry out the rights to Personal data processing
If you have any questions regarding this Notice or matters regarding the rights of Data Subject or your Personal data processing, please contact directly with the Bank's branches and transaction offices or contact our Customer Service Center at 1900588879.