(Issued together with Decision No. 05A/2026/QĐ-MKTT dated January 5, 2026 of Viet Dragon Securities Corporation)

These TERMS AND CONDITIONS ON PERSONAL DATA PROCESSING AND PROTECTION govern the processing and protection of personal data when clients, partners, collaborators, candidates or other individuals (hereinafter referred to as “Users”) use any Products, Services, applications, features or portals provided or operated by Viet Dragon Securities Corporation (hereinafter referred to as “RongViet” or the “Company”). These Terms and Conditions on Personal Data Processing and Protection constitute an integral part of Account opening Contracts, service agreements, arrangements, terms and conditions, or other documents governing the relationship between the User and RongViet.

The User undertakes to carefully read, regularly review and comply with these Terms and Conditions on Personal Data Processing and Protection and any amendments or supplements thereto made by RongViet from time to time. 

1. Scope of Application

These Terms and Conditions on Personal Data Processing and Protection apply to the processing of personal data of: 

a. Individuals who use any products or services provided by RongViet (“Clients”). 

b. Individuals who access RongViet’s website, applications or official communication channels. 

c. Candidates applying for positions, collaborators, and partners providing products or services to RongViet. 

d. Individuals whose personal data is collected or processed by RongViet in connection with contracts, agreements, programs or activities organized by RongViet, or as required by law. 

(hereinafter collectively referred to as “Data Subjects”). 

These Terms and Conditions on Personal Data Processing and Protection do not apply to data of enterprises or organizations and do not govern data processing activities conducted by third-party platforms or services that are outside RongViet’s control. 

2. Personal Data Collected 

When Users access and/or use RongViet’s products, services, applications and/or website features, including but not limited to the online trading system, securities price board, account opening application forms, recruitment application forms, registration for research reports, and other subsequent modules and features of the website, Users acknowledge that RongViet will collect one or more of the following categories of personal data relating to Data Subjects (hereinafter referred to as “Personal Data”), including: 

2.1. Basic Personal Data includes: 

a. Full name at birth, including surname and middle name, and other names (if any); 

b. Date of birth; date of death or disappearance; 

c. Gender; 

d. Place of birth, place of birth registration, permanent residence, temporary residence, current residence, place of origin, and contact address; 

e. Nationality; 

f. Images of the individual; 

g. Telephone number, personal identification number, passport number, and personal tax identification number; 

h. Marital status; 

i. Information on family relationships (parents and children); 

j. Information on the individual’s digital accounts; personal data reflecting online activities and online activity history; 

k. Email address; 

l. Other information associated with a specific individual or capable of identifying a specific individual that does not constitute Sensitive Personal Data; 

m. Investment experience, investment objectives, risk tolerance, transactions and trading behavior of Clients in relation to the products and services provided by RongViet. 

2.2. Sensitive Personal Data: 

a. Information relating to racial origin or ethnic origin; 

b. Political opinions, religion and beliefs; 

c. Health status; 

d. Biometric data and genetic characteristics; 

e. Data relating to crimes or criminal acts collected and stored by law enforcement authorities; 

f. Login names and passwords used to access an individual’s electronic identification account; images of identity cards and citizen identity cards; 

g. Customer information of credit institutions, foreign bank branches, payment intermediary service providers and other licensed organizations, including: customer identification information as prescribed by law; account information; deposit information; information on deposited assets; transaction information; and information on organizations or individuals acting as securing parties at credit institutions, bank branches, securities payment intermediary service providers, insurance organizations and other licensed organizations; 

h. Data tracking behavior and activities relating to the use of telecommunications services, social networks, online communication services and other cyberspace services; data files (cookies); 

i. Other personal data that is required by law to be kept confidential or subject to stringent security measures. 

3. Purposes of Personal Data Collection and Processing 

Subject to the Data Subject’s consent and/or to the extent permitted by law, Personal Data will be collected and processed by RongViet for the following purposes: 

3.1. For Clients: 

a. Appraising and assessing conditions for providing products and services; verifying and identifying Clients. For this purpose, RongViet will collect and process Clients’ Personal Data to review legal documents, verify information, financial capacity, capabilities and eligibility of Clients in relation to any product or service proposed/provided by RongViet; and to identify and authenticate Client’s identity before and during the provision of services in order to comply with applicable laws. 

b. Providing products, services and other features to Clients and exercising RongViet’s rights and fulfilling its obligations under contracts/agreements signed with Clients. For this purpose, Clients’ Personal Data is essential for RongViet to provide products and services to Clients, including but not limited to opening securities trading accounts; carrying out, or providing Personal Data to RongViet’s service providers/partners for the purpose of carrying out Clients’ transactions, orders, instructions and requests; providing investment consultant services and investment recommendations; exercising the right to collect fees and charges and recover outstanding debts; and handling procedures relating to claims, complaints and disputes. 

c. Contacting Clients to communicate and provide necessary information and documents, including but not limited to documents or other materials relating to contracts/ agreements between RongViet and Clients; policies, regulations, fee schedules and other information relating to products and services; information on transactions, accounts and assets of Clients managed by RongViet; and the rights and obligations of the parties under applicable laws and other relevant agreements. 

d. Fulfilling RongViet’s responsibilities under applicable laws and at the request of competent authorities. For this purpose, RongViet is required to collect and process Clients’ Personal Data in order to comply with RongViet’s internal regulations and relevant laws, including but not limited to preparing reports and providing information at the request of competent State authorities; implementing measures to ensure the security of RongViet’s systems; preventing money laundering; preventing risks, fraud and violations of law; and protecting the public interest and the lawful rights and interests of relevant parties in accordance with law. 

e. Client care, marketing, communications and service quality enhancement, including but not limited to receiving and handling feedback and complaints in order to improve and enhance the quality of RongViet’s products and services; registering to receive notices and advertisements regarding products and services, research reports, investment recommendations, promotions, incentives, surveys, news and events of RongViet and its subsidiaries via email, telephone, SMS and other communication and media channels or applications, to the extent permitted by law and on the basis of appropriate legal grounds. 

f. Research and analysis for the enhancement of service quality and Client’s experience. For this purpose, RongViet collects and processes Personal Data to conduct market research, surveys, and analyses of data and behavior relating to any products or services provided by RongViet, in order to personalize advertising appropriate to Users for the marketing and advertising of products and services of RongViet and its subsidiaries; and to manage, improve and develop products, services and features (whether carried out by the Company or by third parties cooperating with the Company in accordance with law) that may be relevant to Users. 

3.2. For candidates, collaborators and partners:

a. Verifying and assessing the suitability of candidates, collaborators and partners for recruitment and entering into contracts. For this purpose, RongViet will collect and process Personal Data to review the eligibility of candidates and collaborators; assess applications, records, documents and supporting materials for the purpose of  evaluating the status and suitability of candidates, collaborators and partners; register candidate and collaborator records; and support recruitment and the process of entering into contracts; 

b. Entering into and performing labor contracts, employment arrangements and service agreements with candidates, collaborators and partners, including but not limited to establishing and executing contracts; managing personnel records; paying salaries, remuneration for collaborators and service fees; making social insurance contributions; and carrying out procedures prescribed by law with relevant competent authorities such as labor, insurance and tax authorities and the State Securities Commission of Vietnam, etc.;

c. Training, inspecting and evaluating work quality and compliance with obligations under contracts, agreements and commitments with RongViet; 

d. Carrying out other purposes relating to human resources development and management. 

4. Methods of Personal Data Processing

RongViet collects Clients’ Personal Data through one or more of the following principal methods: 

a. From Users: data is collected through meetings, exchanges, communications, securities trading account opening procedures, registration for products and services, or through other means such as email, telephone calls, messages, surveys and/or any other means of communication between RongViet or RongViet’s employees and Users, where information is provided by Users. 

b. Through RongViet’s website or mobile applications: when Users access the Website or use any feature or sub-module of RongViet’s Website and/or when Clients download or use RongViet’s mobile applications. 

c. Through automated data collection: RongViet may collect Personal Data of Users and related parties that is automatically recorded from Users’ connections to RongViet through cookies, plug-ins or any technology capable of automatically tracking and collecting Personal Data on such devices or websites. 

d. From competent State authorities: RongViet may collect Personal Data from regulatory authorities such as the State Securities Commission of Vietnam, the Vietnam Securities Depository/Vietnam Securities Depository and Clearing Corporation, the Stock Exchanges, or other competent authorities in Vietnam. 

e. From third parties such as banks, credit institutions, electronic identification and authentication service providers, and other relevant service providers, to the extent consented to by Clients or permitted by law. 

f. From other sources where Users have consented to the sharing/provision of Personal Data, or where such collection is required or permitted by law. 

5. Commencement and Termination of Processing of Data Subjects’ Personal Data 

5.1. Upon obtaining the Data Subject’s consent during the proposal, registration and establishment of agreements, terms and conditions governing the relationship between the User and RongViet and these Terms and Conditions on Personal Data Processing and Protection, RongViet will commence the collection and processing of the Data Subject’s Personal Data within the scope consented to by the User, except where the Data Subject’s consent is not required as provided in Section 7 below. The User acknowledges that the User’s consent applies to all activities within the Personal Data processing cycle, and subsequent processing of the User’s Personal Data will continue without further notice or additional consent from the User. 

5.2. Depending on the purpose of Personal Data processing and the type of data processed, RongViet is entitled to determine the maximum retention period for the Data Subject’s Personal Datapermitted by laws. In case a User ceases to use RongViet’s services, products, features or information technology systems, or a candidate, collaborator or partner is not recruited or does not enter into a cooperation agreement or service agreement, the User acknowledges and agrees that RongViet may retain and continue to process and use Personal Data to the extent permitted by law and under these Terms and Conditions on Personal Data Processing and Protection until the following events: 

a. Upon the expiry of the retention period prescribed by law, the Data Subject withdraws consent for RongViet to process Personal Data or requests in writing the deletion/destruction of all Personal Data; 

b. The data processing must be terminated at the request of the competent authorities; 

c. Implementation in accordance with an agreement among the User/Data Subject, RongViet and relevant parties; 

d. Another time as prescribed by law.  

5.3. Where a Data Subject requests withdrawal of consent for RongViet to process his/her Personal Data or requests deletion/destruction of such data, RongViet will cease processing the Data Subject’s Personal Data. However, the User acknowledges that access to and processing of Personal Data is essential for RongViet to provide features, products and services, fully and timely perform obligations agreed under contracts and agreements and/or fulfill legal responsibilities prescribed by law. Accordingly, if a User does not consent to RongViet’s collection and processing of Personal Data, or having previously consented but subsequently withdraws consent in respect of the groups of purposes listed below, RongViet shall, at its discretion, decline to provide or maintain some or all products, services and features for the User and will be unable to process and fulfill fully and on time the User’s requests: (i) for Clients, the groups of purposes set out at Points a, b, c and d of Clause 3.1, Section 3 of these Terms and Conditions on Personal Data Processing and Protection; or (ii) for candidates, collaborators and partners, the groups of purposes set out at Points a, b and c of Clause 3.2, Section 3 of these Terms and Conditions on Personal Data Processing and Protection. RongViet may therefore consider discontinuing any service, product or feature affected by the User’s withdrawal of consent or request for deletion/destruction of Personal Data. The User acknowledges that such actions by the User are deemed to constitute a refusal to use, or unilateral termination of the use of, the services, products or features being provided by RongViet and may result in a breach of obligations or commitments under service agreements/contracts entered into between RongViet and the User. Accordingly, the User undertakes to bear responsibility for any risks, losses, damages or legal consequences that may arise and to comply with any measures that RongViet is entitled to take in response to the User’s breach under such agreements/contracts and/or applicable law. 

Requests for data deletion, withdrawal of consent, restriction of processing or objection to data processing will not affect the lawfulness of RongViet’s Personal Data processing activities conducted prior to such requests. 

6. Parties Entitled to Access Users’ Personal Data 

RongViet undertakes not to sell, exchange or lease Users’ Personal Data without the User’s consent in accordance with applicable law. However, for the purposes set out in Section 3 of these Terms and Conditions on Personal Data Processing and Protection, the User agrees that RongViet may disclose or transfer the Data Subject’s Personal Data to one or more of the following parties: 

6.1. Internal parties: including RongViet’s head office, branches, transaction offices, representative offices, divisions, departments, personnel and subsidiaries. 

6.2. Governmental authorities and law enforcement agencies: where required or prescribed by law, rules, regulations or legal process, including but not limited to reporting to governmental authorities or discharging any obligation of RongViet, such as providing information at the request of a court or competent authority, or to other organizations such as the State Securities Commission of Vietnam, the Stock Exchanges and the Vietnam Securities Depository.

6.3. Other third parties: The User acknowledges that RongViet may disclose or transfer the Data Subject’s Personal Data, without obtaining further consent from the User, to third parties whether or not affiliated with RongViet if such disclosure or transfer is necessary to achieve the purposes of Personal Data processing. However, RongViet undertakes to conduct necessary and reasonable measures to remind and require third parties accessing or processing the Data Subject’s Personal Data to maintain the confidentiality of the User’s Personal Data. 

7. Rights and Obligations of Data Subjects/Users 

7.1. Rights of Data Subjects 

- To be informed of Personal Data processing activities. 

- To accept or refuse, and to request withdrawal of consent to Personal Data processing, except in the following cases: (i) urgent cases in which relevant Personal Data must be processed immediately to protect the life or health of the Users or another person; (ii) disclosure of Personal Data as prescribed by law; (iii) processing of data by a competent authority in a state of emergency concerning national defense, national security, social order and safety, major disasters or dangerous epidemics; where there is a threat to national security or defense that does not yet warrant declaration of a state of emergency; or for the prevention and suppression of riots, terrorism, crimes and violations of law as prescribed by law; (iv) for the performance of the Client’s contractual obligations toward relevant agencies, organizations or individuals as prescribed by law; (v) for activities of State authorities as prescribed by law; and (vi) where the Data Subject/User does not accept the consequences or losses arising as provided in Section 5.3 of these Terms and Conditions on Personal Data Processing and Protection, or where applicable law does not permit the Data Subject’s request to be carried out. 

- To access, review, correct, or request correction of his/her Personal Data. 
To delete or request deletion of Personal Data, restrict Personal Data processing, or submit an objection to Personal Data processing by written request/email sent to RongViet, except where otherwise provided by law. 

- To request RongViet to provide the Data Subject with his/her Personal Data by a written request sent to RongViet’s head office, except where otherwise provided by law. A request for provision of Personal Data must be made in Vietnamese and contain the following principal information: (i) full name; place of residence and address; identity card number, citizen identity card number or passport number of the requester; fax number, telephone number and email address (if any); (ii) the Personal Data requested, specifying the relevant document, record or material; (iii) the form in which the Personal Data is to be provided; and (iv) the reason and purpose for requesting the Personal Data. Upon receipt of a valid request from the Customer, RongViet will notify the Customer of the timeframe, method, and actual costs for providing the requested Personal Data. 

- To lodge complaints or denunciations, initiate legal proceedings, and claim damages in accordance with law; and to request competent authorities or agencies, organizations or individuals involved in Personal Data processing to implement measures and solutions to protect his/her Personal Data in accordance with law. 

- Other rights as prescribed by law. 

7.2. Obligations of Data Subjects and Users 

- To protect his/her own Personal Data and request other relevant organizations and individuals to protect his/her Personal Data. 

- To respect and protect the Personal Data of others. 

- To provide complete and accurate Personal Data when consenting to Personal Data processing. In the event of any change or adjustment to Personal Data, the User is responsible for promptly notifying RongViet so that such changes or adjustments can be timely updated. The User bears full responsibility for the accuracy and completeness of the Personal Data provided and shall release RongViet from liability for any losses or risks incurred by the User and relevant parties (if any) arising from inaccurate, incomplete or untimely updated information provided by the User. 

- Where a User provides RongViet with Personal Data of another Data Subject (including but not limited to information of dependents, related persons as prescribed by law, spouse, children and/or parents and/or guardians, friends, references, representatives, beneficiaries, authorized persons, partners, emergency contacts or other individuals associated with the Customer), the User represents, undertakes and is responsible for ensuring that, at the time of disclosure of such Personal Data or at the time of consenting to RongViet’s collection and processing of such Personal Data, the User has obtained the lawful consent of such third party for RongViet to process such information for the purposes set out in Section 3 of these Terms and Conditions on Personal Data Processing and Protection; has provided these Terms and Conditions on Personal Data Processing and Protection to the Data Subject; and has obtained the Data Subject’s full acceptance of their contents. 

- For the purpose of protecting the confidentiality of Users’ Personal Data, RongViet is entitled to conduct verification, and the User is obliged to provide information and supporting documents and authenticate his/her identity as the Data Subject or as a person duly authorized by the Data Subject when submitting requests to RongViet, including but not limited to requests to withdraw consent, correct data, delete/destroy data, or obtain his/her own Personal Data. 

- Other obligations as prescribed by law. 

8. Risk Warnings and Disclaimer of Liability 

8.1. RongViet uses our best efforts and implements all measures we consider necessary within reasonable capabilities to safeguard Data Subjects’ Personal Data. Nevertheless, the User acknowledges that sharing Personal Data in an electronic environment entails certain risks beyond the protective capabilities of the measures applied by RongViet, including the following: 

a. In practice, the use and operation of electronic information systems over the Internet may not be absolutely safety, and the open nature of the Internet may result in leakage of data containing the Data Subject’s Personal Data. 

b. The Data Subject’s Personal Data may be disclosed or stolen as a result of unauthorized access by third parties. 

c. Personal Data exchanged between RongViet and the User may not guarantee absolute safety  or integrity throughout transmission over the Internet. 

8.2. The User/Data Subject acknowledges and accepts the risks that may arise in relation to the Data Subject’s Personal Data in circumstances beyond RongViet’s reasonable control. To minimize such risks, particularly to prevent unauthorized persons from unlawfully accessing or using the Data Subject’s Personal Data, the information systems used by RongViet to store and secure the Data Subject’s Personal Data will be protected by a secure network architecture as reasonably determined by RongViet from time to time in compliance with applicable law. 

8.3. To assist RongViet in best protecting the rights and interests of the Data Subject/User, the Data Subject/User undertakes to implement information security and cybersecurity measures on his/her own access devices and to keep strictly confidential the Data Subject’s Personal Data used on RongViet’s electronic information systems and/or other service channels. 

8.4. Where there are reasonable grounds to believe or suspect that the Data Subject’s Personal Data has been stolen or disclosed, the Data Subject/User must immediately notify RongViet so that preventive measures can be taken. As soon as possible after receiving such notice, RongViet will take necessary and reasonable measures to mitigate consequences for the Data Subject. A failure or delay by the Data Subject/User to notify RongViet of actual or suspected loss of information will constitute reasonable grounds for excluding or exempting RongViet from liability for any damage or loss relating to the Data Subject’s Personal Data. 

8.5. With respect to information provided by Users to third parties through websites, software, applications or any other third-party platforms displaying RongViet advertisements or information containing links to RongViet, regardless of whether any agreement or affiliation exists between RongViet and such third parties, the User understands and acknowledges that these Terms and Conditions on Personal Data Processing and Protection do not apply to Personal Data provided by the User to third parties in the foregoing circumstances, and RongViet shall have no obligation or liability in connection with access to, exchange of, or provision of information between the User and such third parties. 

9. Contact, Handling of Feedback and Complaints, and Protection of Data Subjects’ Rights and Interests 

If a User/Data Subject has any questions relating to Personal Data processing, the User/Data Subject may contact RongViet through customer service channels announced from time to time, including but not limited to hotline +84 28 62992020 or email address cskh@vdsc.com.vn, or submit a written request or complaint to the address of RongViet’s head office or branches published on “Network” section of RongViet’s Website. 

Upon receipt of a request, feedback or complaint, RongViet is responsible for verifying the requester’s information, providing guidance on completing the required documents and procedures, and handling the request within a timeframe consistent with applicable law. The User acknowledges that the processing time may be longer than expected if the User does not comply with the procedures set out herein and RongViet’s instructions. 

In accordance with law, requests to exercise Data Subjects’ rights may be considered for suspension or refusal in certain cases, including: (i) the request is inconsistent with applicable law; (ii) the requester fails to provide sufficient documents to verify the Data Subject’s identity or demonstrate authority to exercise the Data Subject’s rights; (iii) the Personal Data and/or information or documents provided by the requester show signs of violating the law; and/or (iv) the exercise of the Data Subject’s rights is not permitted or is restricted under applicable law. 

10. Amendments 

RongViet reserves the right to amend, update or revise these Terms and Conditions on Personal Data Processing and Protection from time to time without obtaining any additional consent from the Data Subject/User, provided that such amendments and supplements comply with applicable laws. The Data Subject/User is responsible for regularly reviewing and keeping updated on any changes to these Terms and Conditions on Personal Data Processing and Protection. 

To the extent permitted by applicable law, continued use by the Data Subject/User of RongViet’s services and products after any amendments or supplements take effect will constitute the Customer’s acceptance of the updated contents of these Terms and Conditions on Personal Data Processing and Protection.