Personal data protection policy

I. PURPOSE AND SCOPE

LEXDATA CONSULTING CO., LTD. (“LEXDATA”, the “Company”, “we”) respects individuals’ rights over their personal data and applies appropriate measures to protect personal data in the course of its operations.

This Personal Data Protection Policy (the “Policy”) describes how LEXDATA collects, processes, uses, stores, protects, provides, transfers and otherwise handles the personal data of individuals who interact with LEXDATA.

This Policy applies to the personal data of:

• clients and prospective clients;
• representatives, contact persons and staff of clients, partners or suppliers;
• individuals who contact LEXDATA to request advice, a quotation, an appointment or a service;
• visitors to LEXDATA’s website, online platforms or contact channels;
• individuals whose data is provided to LEXDATA by clients or partners in the course of consulting work, where our processing role is defined by contract or agreement; and
• other individuals whose personal data LEXDATA lawfully processes in the course of its operations.

For personal data arising from the provision of services to clients, the contract, data processing agreement (DPA), data transfer agreement, annex or other agreement between the parties may contain more detailed terms. Where they differ, those documents apply to the specific transaction, in accordance with the law.

II. LEGAL BASIS

LEXDATA has adopted and applies this Policy on the basis of current Vietnamese personal data protection law, including:

1. the Law on Personal Data Protection No. 91/2025/QH15 dated 26 June 2025;
2. Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection;
3. related laws on data, cybersecurity, network information security, electronic transactions, advertising, tax, accounting and other applicable sector regulations; and
4. lawful contracts, agreements and commitments between LEXDATA and clients, partners or data subjects.

When the law is amended, supplemented or replaced, LEXDATA may update this Policy to reflect legal requirements and actual processing activities.

III. DEFINITIONS

In this Policy, the terms “personal data”, “basic personal data”, “sensitive personal data”, “data subject”, “processing of personal data”, “personal data controller”, “personal data processor”, “personal data controller and processor”, “third party” and related terms have the meanings given in the Law on Personal Data Protection and its implementing regulations.

“Consent” means a data subject’s permission for the processing of their personal data in accordance with the law, except where the law permits processing without consent.

IV. PRINCIPLES OF PERSONAL DATA PROTECTION AND PROCESSING

LEXDATA applies the following principles as appropriate to each processing activity:

1. Lawfulness and transparency: data is processed in accordance with the law, agreements and the information provided to data subjects;
2. Purpose limitation: data is processed for specific, explicit and appropriate purposes;
3. Data minimisation: only data necessary for the defined purpose is collected and processed;
4. Accuracy: reasonable measures are taken to keep data accurate and up to date where necessary;
5. Storage limitation: data is not kept longer than necessary, unless the law, a contract or the protection of lawful rights and interests requires otherwise;
6. Security and safety: governance, organisational and technical measures appropriate to the risk are applied;
7. Accountability: the records, evidence and controls needed to demonstrate compliance with the law are maintained.

V. CATEGORIES OF PERSONAL DATA PROCESSED

1. Basic personal data

Depending on the relationship and purpose of processing, data may include full name; date of birth; gender; nationality; contact address; telephone number; email address; online account information; occupation, job title and position; information about the organisation or business the individual works for or represents; images; the content of communications; and other information the individual chooses to provide.

2. Sensitive personal data

In the course of consulting work, or when data subjects choose to provide information, LEXDATA may process sensitive personal data as listed by law, for example data on health, finances, location, biometrics, private life, or data tracking online behaviour and use of services.

LEXDATA processes sensitive personal data only where necessary, on an appropriate legal basis and with enhanced safeguards. When LEXDATA seeks consent to process sensitive personal data, the data subject will be clearly informed that the data concerned is sensitive personal data.

3. Technical data and data generated when using the website

This may include device information; browser type; operating system; time of access; pages and content accessed; interaction events; cookies or similar identifiers; and log and technical data needed to secure, operate and analyse the website. Some data tracking the use of online services may be classified by law as sensitive personal data.

4. Data from the consultation form on the website

Through the consultation request form, LEXDATA intends to collect: full name, company and work email as required fields; telephone number and a description of your needs as optional fields. Data subjects are advised not to provide sensitive personal data in the free-text field unless it is genuinely necessary for the request.

VI. PURPOSES OF PROCESSING

LEXDATA may process personal data for one or more of the following purposes, depending on the relationship:

1. receiving, verifying and responding to contact, consultation, appointment or quotation requests;
2. assessing needs and preparing service proposals;
3. entering into, performing, managing and maintaining contracts or agreements;
4. providing consulting, DPO, compliance assessment, dossier preparation or other professional services;
5. managing clients, partners, suppliers and operations;
6. communicating, supporting and resolving requests in the course of providing services;
7. fulfilling accounting, tax and record-keeping obligations, handling complaints and disputes, and other legal obligations;
8. ensuring security and safety, and preventing fraud, spam, unauthorised access and attacks on our systems;
9. analysing website performance and usage after appropriate consent;
10. sending professional content, product or service information or marketing where there is separate consent or another appropriate legal basis; and
11. other purposes specifically notified to data subjects and, where the law requires consent, carried out only after valid consent for that purpose.

VII. LEGAL BASIS FOR PROCESSING AND CONSENT

Personal data is collected after the data subject has given consent, except where the law permits processing without consent. Where the law permits processing without consent, LEXDATA processes data only within the scope, purposes and conditions of the applicable case, and maintains appropriate oversight and safeguards.

For activities based on consent, LEXDATA applies the following principles:

• consent must be freely given, and the data subject must clearly know the type of data processed, the purpose of processing, LEXDATA’s role and their own rights and obligations;
• consent must be clear and specific, in a form that can be printed, copied or otherwise verified;
• consent is obtained separately for each relevant purpose; data subjects are not required to consent to purposes that are not necessary for the transaction or request they choose;
• silence, non-response or default settings are not treated as consent;
• consent checkboxes or options on the website are never pre-ticked or pre-selected;
• for sensitive personal data, the consent request states that the data is sensitive; and
• consent remains effective until it is changed, withdrawn or terminated in accordance with the law.

LEXDATA keeps evidence of consent as required by law, including the information needed to verify that the data subject consented, when they consented, the content and scope of consent and the relevant version of the notice or policy. In the event of a dispute, LEXDATA bears the burden of proving consent to the extent required by law.

VIII. LEXDATA’S ROLE IN PROCESSING

1. Where LEXDATA determines the purposes and means of processing

For data that LEXDATA collects and processes for the Company’s own operations, LEXDATA is the personal data controller or the personal data controller and processor, depending on how processing is actually carried out.

LEXDATA’s details:

• Company name: LEXDATA CONSULTING CO., LTD. (CÔNG TY TNHH LEXDATA CONSULTING)
• Registered office: 14th Floor, HM Town Building, 412 Nguyen Thi Minh Khai Street, Ban Co Ward, Ho Chi Minh City, Vietnam
• Website: https://lexdata.vn
• Email: contact@lexdata.vn
• Telephone: +84 348 573 267

2. Where LEXDATA processes data on a client’s instructions

In some services, the client determines the purposes and means of processing and LEXDATA processes data on the client’s lawful instructions and under the contract or agreement with the client. The parties’ roles and responsibilities are then determined by law and the applicable agreement. The client is responsible for ensuring that providing or transferring data to LEXDATA has an appropriate legal basis, and for fulfilling the notification, consent and other obligations that are its responsibility.

IX. SOURCES OF PERSONAL DATA

LEXDATA may receive personal data:

1. directly from data subjects through forms, email, telephone, meetings or other channels;
2. from contracts, records and documents provided by clients, partners or suppliers;
3. from the website, IT systems, cookies or similar technologies and online platforms;
4. from lawfully public sources; or
5. from other sources permitted by law.

The fact that data has been made public does not in itself mean that the data subject consents to every processing purpose. LEXDATA uses data from public sources only where there is an appropriate legal basis and in line with the defined purpose.

X. PROVIDING DATA: REQUIRED AND OPTIONAL

Some data is necessary for LEXDATA to receive requests, verify contact persons or provide services. If a data subject does not provide the necessary data, LEXDATA may be unable to respond to or fulfil all or part of the request.

For the consultation form on the website, full name, company and work email are required to identify and respond to the request. Telephone number and a description of your needs are optional. Not providing a telephone number does not prevent you from submitting a request by email.

XI. SHARING, PROVIDING AND TRANSFERRING PERSONAL DATA

LEXDATA does not buy or sell personal data.

To the extent necessary and consistent with the purpose of processing, data may be shared with, provided or transferred to:

• staff, collaborators or persons authorised by LEXDATA on a need-to-know, need-to-use basis;
• providers of IT, email, forms, storage, security, analytics or operational support;
• professional firms that support the provision of services;
• clients, partners or third parties where sharing or transfer is necessary for an established purpose and permitted by law;
• competent state authorities or other parties where required or permitted by law.

Where required by law, LEXDATA puts in place a data transfer or processing agreement with the recipient setting out the purpose, data categories, processing period, deletion and destruction requirements, data protection responsibilities, the handling of data subject rights and cooperation in the event of a breach.

XII. TECHNOLOGY PROVIDERS ON THE WEBSITE

As at the date of this Policy, the website may use the following providers:

LEXDATA may change providers where needed for operations or security. Where a change materially affects how data is processed, LEXDATA will update this Policy or give appropriate notice.

XIII. CROSS-BORDER TRANSFER OF PERSONAL DATA

Using providers whose servers, infrastructure or processing are located outside Vietnam may constitute a cross-border transfer of personal data under the law. For example, Web3Forms’ public documentation states that its servers are located in the US-East region of the United States; Google’s infrastructure may also process data outside Vietnam.

Where an activity falls within the scope of cross-border transfer of personal data, LEXDATA is responsible for implementing safeguards, preparing and updating the impact assessment dossier and fulfilling related obligations under the law, unless an exemption applies.

XIV. RETENTION, DELETION AND DESTRUCTION

LEXDATA retains data for as long as necessary to fulfil the purposes of processing, contractual relationships and legal obligations, to resolve complaints and disputes and to give effect to data subject rights.

As a general rule:

• data and correspondence from consultation requests and prospective clients may be kept by LEXDATA for up to 24 months from the most recent interaction, unless the user asks for earlier deletion, or a contractual relationship, dispute or legal obligation requires longer retention;
• data in contract, accounting, tax and other records is kept for the period required by law or the applicable agreement;
• evidence of consent is kept for as long as necessary to prove consent and resolve related requests or disputes;
• Google Analytics user- and event-level data is retained according to the Analytics settings chosen by LEXDATA, up to 14 months for a standard GA4 property if LEXDATA selects that maximum.

When the purpose of processing has been fulfilled, the retention period has ended or the law requires deletion or destruction, LEXDATA deletes, destroys or de-identifies the data by appropriate means, unless the law or lawful rights and interests permit or require continued retention.

XV. SECURITY MEASURES

LEXDATA applies governance, organisational and technical measures appropriate to the type of data, its sensitivity and the risk, which may include:

1. access control on a need-to-know, need-to-use basis;
2. authentication and account protection; management of system access rights;
3. protection of systems, data in transit and data at rest;
4. backup, recovery and business continuity management;
5. controls on sharing, providing and transferring data;
6. confidentiality undertakings and training for staff with access to data;
7. monitoring, assessment, testing and improvement of safeguards;
8. procedures for receiving, assessing and handling data breaches and incidents;
9. for sensitive personal data, restricted access rules, handling procedures and enhanced security measures.

XVI. RIGHTS OF DATA SUBJECTS

Under current law, data subjects have the following rights, among others:

1. to be informed about the processing of their personal data;
2. to give or refuse consent, and to withdraw consent to the processing of their personal data;
3. to access, correct or request correction of their personal data;
4. to request provision, deletion or restriction of processing of their personal data;
5. to object to the processing of their personal data;
6. to complain, denounce, bring legal proceedings and claim damages in accordance with the law;
7. to request competent authorities or the agencies, organisations or individuals involved in processing to take measures and solutions to protect their personal data;
8. other rights provided by law.

The exercise of these rights is subject to the conditions, limits and exceptions provided by law and must not infringe the lawful rights and interests of the State, agencies, organisations or other individuals.

XVII. OBLIGATIONS OF DATA SUBJECTS

Data subjects have the obligation to:

1. protect their own personal data;
2. respect and protect the personal data of others;
3. provide complete and accurate personal data as required by law or contract or when consenting to processing;
4. comply with personal data protection law and help prevent and combat personal data violations; and
5. not provide LEXDATA with other people’s personal data without an appropriate basis or authority.

XVIII. HOW TO EXERCISE YOUR RIGHTS AND RESPONSE TIMES

Data subjects may send requests to exercise their rights to LEXDATA via:

• Email: contact@lexdata.vn
• Address: 14th Floor, HM Town Building, 412 Nguyen Thi Minh Khai Street, Ban Co Ward, Ho Chi Minh City, Vietnam
• Telephone: +84 348 573 267

A request should state your full name, contact details, the right you wish to exercise, the data concerned and the information or documents reasonably needed for LEXDATA to verify your identity. LEXDATA does not ask for more verification data than is necessary to protect data from unauthorised requests.

Under Decree 356/2025/ND-CP, response times depend on the type of request. In summary:

These deadlines apply within the conditions set by law and may not apply to processing without consent or other exceptions. If an extension is needed, LEXDATA will give the reasons as required.

XIX. WITHDRAWING CONSENT

Where processing is based on consent, data subjects may request withdrawal of consent in writing, including in electronic or other verifiable form. Withdrawal does not affect processing lawfully carried out before the request.

After receiving a valid request, LEXDATA stops processing, or asks the processor or third party to stop, within the scope provided by law. Withdrawal may mean LEXDATA can no longer provide certain functions or services where the data is needed for the corresponding purpose.

XX. COOKIES, GOOGLE ANALYTICS AND ONLINE TRACKING DATA

The website may use cookies or similar technologies for essential purposes, remembering preferences and analytics. Non-essential cookies and analytics are activated only after the user has made an appropriate consent choice, where required by law.

Google Analytics is loaded only after the user selects “Accept analytics”. Users can refuse or withdraw their choice via “Cookie settings”; refusing does not reduce the essential functions of the website.

Because data tracking behaviour and use of online services may be sensitive personal data under Vietnamese law, the consent request for analytics cookies must state this clearly. LEXDATA does not treat silence or default settings as consent to analytics cookies.

XXI. MARKETING AND PROFESSIONAL CONTENT

Consent given in the consultation request form covers only receiving and responding to that request; it is not consent to receive marketing.

LEXDATA sends marketing or product and service information only with separate consent or another appropriate legal basis. Where consent applies, recipients can withdraw or opt out using the mechanism provided in the message or by contacting LEXDATA.

XXII. DATA OF CHILDREN AND PERSONS REQUIRING REPRESENTATION

LEXDATA’s website and consulting services are aimed mainly at organisations and adults. LEXDATA does not actively collect children’s personal data unless necessary.

Where LEXDATA processes data of children, persons who have lost or have limited civil act capacity, or persons with difficulties in cognition or behavioural control, it complies with the representation, consent and specific protection requirements of the law. Disclosure of information about the private life or personal secrets of children aged 7 or older is carried out subject to the consent conditions of the law.

XXIII. PERSONAL DATA BREACHES AND INCIDENTS

LEXDATA maintains mechanisms to detect, assess, contain, remedy and record breaches and incidents involving personal data. Where notification or reporting is required, LEXDATA fulfils its obligations to the specialised authority and/or data subjects within the deadlines and with the content required by law.

Data processors and providers are obliged to cooperate, notify and take remedial measures under the applicable contract or agreement and law.

XXIV. PROCESSING OF DATA IN LEXDATA’S CONSULTING WORK

In the course of consulting, compliance assessment, outsourced DPO, impact assessment dossier preparation or other professional services, clients may provide LEXDATA with personal data from their own systems or records.

For such data, LEXDATA processes within the role agreed between the parties; only for lawful purposes and instructions; with appropriate security measures; not for unauthorised purposes of its own; and returns, deletes, destroys or retains it in accordance with the contract, agreement and law. Where a sub-processor or third party is involved, LEXDATA applies appropriate management, transfer and security arrangements.

XXV. CHANGES TO THIS POLICY

LEXDATA may amend or supplement this Policy when there are changes in law, business activities, systems, providers or the way data is processed. New versions will be published on the website or another appropriate channel with the update and effective dates.

Continuing to use the website after this Policy is updated means only that the user has had the opportunity to access the updated information; it is not consent to new processing purposes where the law requires separate consent. If a change requires consent to be obtained again, LEXDATA will use an appropriate consent mechanism.

XXVI. CONTACT FOR PERSONAL DATA PROTECTION

LEXDATA CONSULTING CO., LTD.

• Address: 14th Floor, HM Town Building, 412 Nguyen Thi Minh Khai Street, Ban Co Ward, Ho Chi Minh City, Vietnam
• Website: https://lexdata.vn
• Email: contact@lexdata.vn
• Telephone: +84 348 573 267
• Responsible contact: LEXDATA’s Personal Data Protection unit/contact

LEXDATA receives and handles personal data protection requests according to its internal procedures and the applicable legal deadlines.

XXVII. EFFECTIVENESS

This Policy takes effect on 10 September 2026 and applies to personal data processing within its scope from the effective date.

If any part of this Policy is no longer appropriate because of a change in the law, the law in force prevails and LEXDATA will update the relevant content within a reasonable time.