Personal data protection policy

This Personal Data Protection Policy ("Policy") outlines the practices regarding the processing of User personal data when accessing VFC websites or applications.

1. Scope and Applicability

This Policy governs how Vietnam Fumigation Joint Stock Company (VFC) collects, processes, and stores the personal data of Users who utilize or interact with VFC’s products, websites, applications, or services.

For clarity, this Policy applies exclusively to individual users. VFC encourages Users to read this Policy carefully and regularly check our website for any updates or amendments made in accordance with the terms herein.

2. Definitions

2.1. “User”

Refers to an individual who accesses, inquiries about, registers for, uses, or is involved in the operational processes or provision of VFC products and services.

2.2. “Personal Data”

Refers to information in the form of symbols, text, numbers, images, sounds, or similar formats in an electronic environment that is associated with a specific human being or serves to identify a specific human being.

Personal Data includes Basic Personal Data and Sensitive Personal Data.

2.3. Basic Personal Data includes:
(a) Surname, middle name, and birth name; other names (if any)
(b) Date of birth; date of death or missing status;
(c) Gender
(d) Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, and contact address
(e) Nationality
(f) Personal image
(g) Phone number, ID card number, personal identification number, passport number, driver’s license number, license plate number, personal tax code, social security number, and health insurance card number
(h) Marital status
(i) Information regarding family relationships (parents, children)
(j) Information regarding personal digital accounts; personal data reflecting activity and activity history in cyberspace
(k) Other information associated with a specific person or serving to identify a specific person that does not fall under Sensitive Personal Data.
(l) Other data as prescribed by applicable laws

2.4. Sensitive Personal Data

Refers to personal data associated with individual privacy where infringement would directly affect the individual's legal rights and interests, including:
(a) Political opinions and religious opinions
(b) Health status and private life recorded in medical records, excluding blood type information
(c) Information relating to racial or ethnic origin
(d) Information regarding inherited or acquired genetic characteristics
(e) Information regarding physical attributes and unique biological characteristics
(f) Information regarding sex life and sexual orientation
(g) Data on crimes and criminal activities collected and stored by law enforcement agencies
(h) User information held by credit institutions, foreign bank branches, payment intermediary service providers, and other authorized organizations, including: User identification as prescribed by law, account information, deposit information, deposited asset information, transaction details, and information regarding organizations or individuals acting as guarantors at credit institutions, bank branches, or payment intermediary service providers
(i) Personal location data determined via location-based services
(j) Other personal data designated by law as specific and requiring necessary security measures.

2.5. Personal Data Protection

Refers to activities regarding the prevention, detection, deterrence, and handling of violations related to personal data in accordance with the law.

2.6. Processing of Personal Data

Refers to one or more activities impacting personal data, such as: collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, retrieval, withdrawal, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction, or other relevant actions.

2.7. Third Party

Refers to organizations or individuals other than VFC and the User as defined in this Policy.

For further clarity, any terms not defined in this Article shall be interpreted and applied in accordance with Vietnamese law.

3. Purposes of Personal Data Processing

3.1. VFC may process Users' personal data for one or more of the following purposes:
(a) To provide VFC products or services
(b) To adjust, update, secure, and improve the products, services, and applications that VFC provides to Users
(c) To verify identity and ensure the security of Users' personal information;
(d) To fulfill service requests and User support requirements
(e) To notify Users of changes to policies or promotions regarding the products and services VFC provides
(f) To measure and analyze internal data and perform other processing activities to improve and enhance the quality of VFC services/products or to execute marketing communications
(g) To prevent and combat fraud, identity theft, and other illegal activities
(h) To establish grounds for exercising legal rights or defending against legal claims involving VFC, Users, or any other individual. These purposes may include exchanging data between VFC and other organizations to prevent and detect fraud and reduce credit risks
(i) To comply with applicable laws, relevant industry standards, and other applicable VFC policies
(j) Any other purposes specific to VFC's operational activities

3.2. VFC will request User permission before using User personal data for any purpose other than those stated in Article 3.1 above, at the time of data collection, prior to commencing relevant processing, or as otherwise required or permitted by applicable law.

4. Security of User Personal Data

4.1. User Personal Data is committed to maximum confidentiality in accordance with VFC regulations and applicable laws. The processing of each User's Personal Data is performed only with User consent, unless otherwise prescribed by law.

4.2. VFC does not use, transfer, provide, or share User Personal Data with any third party without User consent, unless otherwise prescribed by law.

4.3. VFC shall comply with other personal data security principles in accordance with applicable laws.

4.4. VFC employs various information security technologies to protect User Personal Data from unintended access, use, or sharing. However, no data can be guaranteed to be 100% secure. Therefore, VFC is committed to protecting User Personal Data to the maximum extent possible. Some unintended consequences or damages may occur, including but not limited to:
(a) Hardware or software errors during data processing resulting in the loss of User data
(b) Security vulnerabilities beyond VFC's control, or relevant systems being attacked by hackers causing data leakage
(c) Users inadvertently disclosing their own personal data due to: negligence or falling victim to fraud; accessing websites/downloading applications containing malware, etc.

4.5. Users should safeguard their electronic devices during use; Users should lock, log out, or exit their accounts on VFC websites or applications when not in use.

5. Types of Personal Data VFC Collects and Processes

To enable VFC to provide products and services to Users and/or process User requests, VFC may need to and/or be required to collect personal data, including:
(a) Basic Personal Data of Users and Users' related individuals
(b) Sensitive Personal Data of Users and Users' related individuals
(c) Data related to websites or applications: technical data (as mentioned above, including device type, operating system, browser type, browser settings, IP address, language settings, date and time of connection to the website, application usage statistics, application settings, date and time of connection to the application, location data, and other technical communication information); security login details; usage data, etc.
(d) Marketing data: advertising interests; cookie data; clickstream data; browsing history; responses to direct marketing; and opt-outs from direct marketing.

6. Methods of Collecting Personal Data
VFC collects personal data from Users via the following methods:

6.1. Directly from Users via various means
(a) When Users submit registration requests or any other forms related to VFC products and services;
(b) When Users interact with VFC customer service staff, for instance, via telephone calls, letters, face-to-face meetings, emails, or social media interactions
(c) When Users utilize VFC websites and applications
(d) When Users are contacted by and respond to VFC marketing representatives and customer service staff
(e) When Users submit their personal information to VFC for any other reason, including when registering for free trials of any products and services or expressing interest in any VFC products and services

6.2. From other third parties:
(a) If Users interact with third-party content or advertisements on the website or within the application, VFC may receive User personal information from the relevant third party, in accordance with that third party's applicable privacy policy.
(b) If Users opt for direct electronic payment to VFC or via the website or application, VFC may receive User personal data from third parties, such as payment service providers, for the purpose of facilitating such payments.
(c) To comply with obligations under applicable law, VFC may receive User personal data from law enforcement agencies and public authorities in accordance with legal regulations.
(d) VFC may obtain User personal data from public sources (such as telephone directories, advertisements/flyers, and information made publicly available on websites).

Whenever such personal data is collected, VFC ensures that data acquisition from relevant third parties is conducted lawfully and requires said third parties to bear responsibility for compliance with personal data protection laws.

7. Organizations Authorized to Process Personal Data

7.1. VFC will share or jointly process personal data with the following organizations and individuals:
(a) Contractors, agents, partners, and operational service providers of VFC.
(b) Branches, business units, and employees working at VFC's branches, business units, and agencies.
(c) Telecommunications enterprises in the event of a User's default on service charge payment obligations.
(d) VFC's professional advisors, such as auditors and legal counsel, in accordance with legal regulations.
(e) Courts and competent state authorities in accordance with the law and/or when required and permitted by law.

7.2. VFC commits that sharing or joint processing of personal data is performed only when necessary to fulfill the Processing Purposes stated in this Policy or as required by law. Organizations and individuals receiving User personal data must comply with the provisions stipulated in this Policy and relevant personal data protection laws.

Although VFC will make every effort to ensure User information is anonymized/encrypted, the risk of data disclosure in force majeure events cannot be completely ruled out.

7.3. In the event of the involvement of other personal data processing organizations mentioned in this Article, the User agrees that VFC shall notify the User prior to implementation.

8. Processing Personal Data in Special Cases
VFC ensures that the processing of User personal data fully complies with legal requirements in the following special cases:

8.1. VFC is committed to respecting and protecting children's personal data. In addition to personal data protection measures prescribed by law, prior to processing children's personal data, VFC will verify the child's age and obtain consent from (i) the child and/or (ii) the child's parents or guardians in accordance with legal regulations.

8.2. In addition to complying with other relevant legal regulations, regarding the processing of personal data related to persons declared missing or deceased persons, VFC must obtain consent from one of the relevant individuals in accordance with applicable laws.

9. User Rights and Obligations Regarding Personal Data Provided to VFC

9.1. Users have the right to be informed about the processing of their personal data, unless otherwise prescribed by law.
(a) Users have the right to consent or refuse to consent to the processing of their personal data, unless otherwise prescribed by law.
(b) Users have the right to access to view, rectify, or request rectification of their Personal Data by sending a written request to VFC, unless otherwise prescribed by law.
(c) Users have the right to withdraw their consent by sending a written request to VFC, unless otherwise prescribed by law. The withdrawal of consent does not affect the lawfulness of data processing agreed to by the User prior to such withdrawal.
(d) Users have the right to delete or request the deletion of their personal data by sending a written request to VFC, unless otherwise prescribed by law.
(e) Users have the right to request the restriction of processing of their Personal Data by sending a written request to VFC, unless otherwise prescribed by law. VFC shall implement the restriction of data processing within 72 hours of receiving the User's request regarding all Personal Data for which the User requests restriction, unless otherwise prescribed by law.
(f) Users have the right to request that VFC provide them with their Personal Data by sending a written request to VFC, unless otherwise prescribed by law.
(g) Users have the right to object to VFC or the Organizations Authorized to Process Personal Data defined in this Policy processing their personal data by sending a written request to VFC to prevent or restrict the disclosure of Personal Data or the use of Personal Data for advertising or marketing purposes, unless otherwise prescribed by law. VFC shall fulfill the User's request within 72 hours of receipt, unless otherwise prescribed by law.
(h) Users have the right to lodge complaints, denunciations, or file lawsuits in accordance with the law.
(i) Users have the right to claim compensation for actual damages in accordance with the law if VFC violates regulations regarding the protection of their Personal Data, unless otherwise agreed by the parties or prescribed by law.
(j) Users have the right to self-protection in accordance with the Civil Code and other relevant laws, or to request competent agencies or organizations to implement civil rights protection measures as prescribed in Article 11 of the Civil Code.
(k) Other rights as prescribed by applicable laws.

9.2. User Obligations
(a) Comply with legal regulations, as well as VFC's regulations and guidelines regarding the processing of User Personal Data.
(b) Provide complete, truthful, and accurate Personal Data and other information as requested by VFC during registration and service usage, and whenever such information changes. VFC will secure User Personal Data based on the information registered by the User; therefore, VFC shall not be held responsible if any inaccurate information affects or limits the User's rights and benefits. In the event of a failure to notify, should any risks or losses arise, the User shall bear full responsibility for errors, fraudulent acts, or misuse of services resulting from their own fault or failure to provide correct, complete, accurate, and timely updates; this includes financial damages and costs incurred due to incorrect or inconsistent information provided.
(c) Cooperate with VFC, competent state authorities, or third parties in the event of issues affecting the security of User Personal Data.
(d) Self-protect their personal data; proactively apply measures to protect their Personal Data while using VFC services; and promptly notify VFC upon detecting any errors or discrepancies regarding their Personal Data or suspecting that their Personal Data is being infringed upon.
(e) Bear sole responsibility for the information, data, and consents they create or provide in the network environment; and bear responsibility for any personal data leakage or infringement resulting from their own fault.
(f) Regularly review updated VFC Regulations and Policies as notified to Users or published on websites and/or other VFC transaction channels from time to time. Perform actions according to VFC instructions to clearly demonstrate consent or non-consent to the Personal Data processing purposes notified by VFC to Users from time to time.
(g) Respect and protect the personal data of others.
(h) Other responsibilities as prescribed by law.

10. Personal Data Retention

VFC commits to retaining User personal data only as relevant to the purposes outlined in this Policy. VFC may also need to retain your personal data for a specific period, such as when required by applicable law.

11.  Processing of Personal Data Involving Foreign Elements
11.1. To fulfill the personal data processing purposes outlined in this Policy, VFC may need to provide or share User personal data with relevant third parties. These parties may be located within Vietnam or in any other location outside the territory of Vietnam.

11.2. When transferring or sharing personal data internationally, VFC will require the receiving party to ensure the confidentiality and security of the User personal data transferred to them. VFC guarantees compliance with legal obligations and regulations regarding the transfer of User personal data.

11.3. Users in the European Union (EU): User personal data may be accessed, transferred, and/or stored outside the European Economic Area (EEA), including in countries that may have lower levels of data protection under EU data protection laws. VFC must comply with specific rules when transferring Personal Data from within the EEA to outside the EEA. Accordingly, VFC will employ appropriate safeguards to protect all transferred Personal Data.

12. Cookies

12.1. When Users use or access VFC websites or online pages (hereinafter collectively referred to as “websites”), VFC may place one or more cookies on the User's device. A “Cookie” is a small file placed on the User's device when the User visits a website; it records information about the User's device and browser, and in some cases, the User's preferences and browsing habits.

VFC may use this information to recognize Users when they return to VFC websites, to provide personalized services on VFC websites, to compile analytics to better understand website activity, and to improve VFC websites. Users can use their browser settings to delete or block cookies on their devices. However, if Users decide not to accept or to block cookies from VFC websites, they may not be able to fully utilize all features of VFC websites.

12.2. VFC may process User personal information through cookie technology, in accordance with the provisions of this Article. VFC may also use remarketing measures to serve advertisements to individuals identified as having previously visited its websites.

12.3. To the extent that third parties have embedded content on VFC websites (e.g., social media features), such third parties may collect User personal information (e.g., cookie data) if Users choose to interact with that third-party content or use third-party services.

13. Contact Information for Personal Data Processing

In the event Users have any questions regarding this Policy, or issues related to data subject rights or the processing of User personal data, Users may use the following contact methods:

VIETNAM FUMIGATION JOINT STOCK COMPANY (VFC)
Address: No. 29 Ton Duc Thang, Sai Gon Ward, Ho Chi Minh City
Email: info@vfc.com.vn/ webmaster@vfc.com.vn
Tel: 028 3822 8097
Service Divisions:
Fumigation: (028) 3822 5069
PestMan: (028) 3911 8077
Agrochemicals: (028) 3822 8097

14. General Terms

14.1. This Policy is effective as of August 1, 2023. Users understand and agree that this Policy may be amended from time to time and notified to Users via VFC Transaction Channels prior to implementation. Amendments and their effective dates will be updated and published on Transaction Channels and other VFC channels. The User's continued use of services following the notification period regarding amendments and supplements signifies the User's acceptance of such amendments and supplements.

14.2. Users acknowledge and agree that this Policy also serves as the Notice of Personal Data Processing as stipulated in Article 13 of Decree 13/2023/ND-CP, including any amendments or supplements made from time to time, prior to VFC processing Personal Data. Accordingly, VFC is not required to take any further measures for the purpose of notifying Users regarding the Processing of Personal Data.

14.3. Users commit to strictly complying with the provisions of this Policy. For matters not covered herein, the Parties agree to comply with legal regulations, guidelines from competent State authorities, and/or amendments and supplements to this Policy as notified by VFC to Users from time to time.

14.4. Users may encounter advertisements or other content on any website, application, or device that may link to the websites or services of partners, advertisers, sponsors, or other third parties. VFC does not control the content or links appearing on third-party websites or services and assumes no responsibility and/or liability for the activities employed by third-party websites or services linked to or from any website, application, or device. These websites and services may be subject to the third parties' own privacy policies and terms of use.

14.5. This Policy is entered into on the basis of good faith between VFC and the User. During implementation, should any dispute arise, the Parties shall proactively resolve it through negotiation and conciliation. In the event that conciliation fails, the dispute shall be referred to a competent People's Court for settlement in accordance with the law.