In this Terms and Conditions, “JIVF” refers to the JACCS International Vietnam Finance Company Limited; and “you” or “your” refers to Customer.

1.What types of personal data do we collect?

Personal data is information that either identifies you or is about you, and we may collect it from a few different sources. This includes collecting personal data directly from you, third parties acting for you or who are related to you, from companies, businesses or organisations who are our Customers that you represent or are related to you, and from other organisations, or publicly available sources.

If you give us someone else’s personal data, you must have their permission, explain to them and make sure they understand how we’ll use it. We may collect different types of personal data as follows:

• Identification data – information that identifies you. For example, your name, your date of birth, place of birth, registered place of birth, your photographs, CCTV and video recordings of you and other identifiers, including official/government identifiers such as national identification number, passport number, tax identification number, driver’s license number, license plate, social security number and health insurance card number.

• Contact data – information that allows addressing, sending or communicating a message to you. For example, your email address, your phone or mobile number and your residential or business address, place of permanent residence, place of temporary residence, current place of residence, hometown, contact address.

• Professional data – information about your educational or professional background.

• Behavioural data – information relating to your behavior, activities or actions, both online and off-line. For example, your browsing behavior and how you interact with our online products and services, or those provided by third-party organizations, such as our advertising partners and social media companies or any social network that you have permitted to use your behavioral data.

• Personal relationship data – information about associations or close connections between individuals or entities that can determine your identity. For example, spouse or employer relationships, marital status, parents, children according to the regulation of Law.

• Communications data – information relating to you contained in voice, messaging, email and other communications we have with you. For example, service requests, and digital account information, such as personal data that reflects activities and activity history in cyberspace.

We may sometimes need to collect more sensitive personal data from you or where allowed by law. This sensitive personal data (sometimes known as special category personal data) may include things like:

• Financial and commercial data – information that identifies your financial position, financial history, credit history. For example, information on Customers of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including customer identification as prescribed by law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service provider, debit or credit card details, source of funds, financial and credit rating history.

• Geo-location data – information that provides or contains a device’s location. For example, your internet protocol (IP) address or your cookies identifier.

• Racial or ethnic origin data – information which reveals your racial or ethnic origin.

• Political data – information which reveals your political opinions

• Religious or philosophical data – information which reveals religious or philosophical beliefs

• Biometric data – information that identifies you physically. For example, facial recognition information, your fingerprint or voice recognition information

• Health data – information relating to your health status. For example, disability information relevant to use JIVF’s products and services

• Criminal convictions, proceedings or allegations data – information about criminal convictions or related information that we identify in relation to our financial crime prevention obligations, for example, details about any criminal convictions or related information. This includes details of offences or alleged offences or convictions.

2.Sources that we get your personal data

We shall get your personal data directly from you, but we may also obtain your personal data from elsewhere as follows:

• People you know – such as:

– Parents or guardians of children, guarantor..

– Your joint -lending account holders o your referees; and

– Other people you appoint or authority to act on your behalf

• Businesses and other organizations – such as:

– Your employer and/or company, business or organization you represent or work for that is related to you.

– Other financial institutions and financial service providers credit reference and fraud prevention agencies.

– Regulatory and other entities with authority over the business operation of JIVF, such as State Bank of Vietnam, tax authorities, law enforcement or authorities as stated by competent law.

• Our corporate and business Customers – where you use services or related to the Dealers where providing products, services that JIVF is a party of that transaction, such as the disbursement for a loan to you or such Dealers.

• Publicly available resources – such as online registers or directories or online publications, social media posts and other information that is publicly available

• Cookies – when you visit, browse, or use our websites, online banking or mobile applications, we may use cookies to automatically collect certain information from your device. We may use such information, where relevant, for internal analysis and troubleshooting, to recognise you and remember your preferences, to improve the quality of and to personalise our content and to determine the security status of your account.

3. Why do we collect your personal data?

We collect your personal data so that we can provide our products and services, manage our relationship with our Customers and operate our business. This is necessary when you have transaction or card issuance in JIVF.

If you have or are associated with more than one loan account or your family relationship also has loan account in JIVF, we may link all your accounts and personal data to enable us to have an overall picture of our Customer relationships.

What we use your personal data for is often referred to as our purposes of data. We may not be able to offer or provide our products and services if you do not provide us with or want us to process the personal data that we consider is necessary and/or is required to meet our legal and regulatory obligations.

We generally process your personal data with your consent where required by law or where otherwise permitted or required by applicable law including for the following lawful reasons:

• Contract – when we’re performing contractual obligations under a contract to which you are a party

• Legal Obligation – when we’re required to comply with laws and regulations

• When JIVF processes personal data to protect rights and benefit of an individual or organization in accordance with regulation of law.

4. Purposes of Processing

We process your personal data for the following purposes:

4.1 Assessing and providing products and services to our Customers

This includes:

• Assessing eligibility and suitability of product and service applications for Customers; we may retain a record of the application if our eligibility criteria are not met

• Assessing your suitability and relevant parties

• Conducting know-your-customer (KYC) checks as required by applicable law

• Conducting credit checks and loan repayment assessments

• Setting loan amounts, card issuance, setting credit limits for Customers, confirming consent for activating and activating cards without regard to the form of automatic or manual.

• Obtaining quotations for Customers from third-party product providers, such as insurance products from insurance providers or other service providers we partner with or deems appropriate to the needs, and consumption behaviors of customers to provide products, and services with better prices and higher benefits and support.

4.2 Managing relationships between Customer and JIVF

This includes:

• Establishing, continuing and managing relationships between JIVF and Customers via online tools or mobile applications.

• Providing Customers with appropriate access to JIVF’s products and services, such as JIVF online and mobile platforms

• Operating, providing and evaluating the products and services for Customers

• Perform providing personal data as a basis for establishing loan and lending relationships, card issuance, manual or automatic card activation by online methods or mobile applications, including any payment to a third party

• Administering, for example, credit facilities or loans for Customers

• Maintaining contact information

• Responding to questions or managing any complaints, including monitoring social media conversations and posts to identify conversations, sentiments, and complaints

• Issuing notifications about changes to the terms and conditions of our products and services

• Recording our communications for record-keeping and evidential purposes including online messages, email and telephone

• Contacting Customers relating to the products and services we are providing

4.3 Operating our business

This includes:

• Managing authentication and user access controls for Customers, for example, for online and mobile means to evaluate the effectiveness of the operation and satisfaction of users

• Creating and maintaining our credit scoring models relating to Customers

• Conducting credit management activities, which includes maintaining Customer credit history and ensuring ongoing creditworthiness

• Engaging in business operational management, such as performing administrative tasks relating to the products and services we provide, risk management activities, audits and ensuring operation and security of our communications and processing systems, systems development and testing, business planning and decision-making.

4.4 Improving our products and services to JIVF’s Customers

This includes:

• Developing, testing and analysing our systems, products and services

• Monitoring and recording our communications with you, for example, phone calls, for training and quality purposes

• Conducting customer satisfaction surveys

• Gathering insights by aggregating data from the use of our products and services and our applications to provide you with more tailored products and services.

4.5 Detecting, investigating and preventing crimes

This includes:

• Conducting identity verification security checks against government and other official centralized databases, as required by law

• Monitoring and recording our communications and screening applications and transactions in connection with actual or suspected fraud, financial crime or other criminal activities

• Recording and monitoring your electronic communications with us, to the extent permitted by applicable law, to ensure compliance with our legal and regulatory obligations and internal policies

• Conducting checks against government and non-government third parties’ fraud prevention and other financial crime prevention databases to prevent money laundering, terrorism, fraud and other financial crimes, to protect you, our Customers and the integrity of the financial market. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies and may result in others refusing to provide services or employment to you.

4.6 Exercising our legal rights and conducting legal proceedings

This includes:

• Tracing and exercising our rights and protecting ourselves against harm to our rights and interests

• Retaining records as may be necessary as evidence for any potential litigation or investigation

• Recovering debts and arrears

• Obtaining professional advice

• Investigating or making an insurance claim

• Responding to any insurance-related matter, action or proceeding

• Defending or responding to any current or prospective legal, regulatory, or industry bodies or association-related matter, action or proceeding.

5. When do we conduct direct marketing?

JIVF may sometimes, use your contact details to send relevant marketing communications (such as by post, email, telephone, SMS, secure messages, mobile app or social media) which is made in the forms and with the frequency as provided under applicable regulations (for example: Law on Advertising, regulation on anti-spam).

We may send the following communications:

• News, offers and promotions about our products and services

• Competitions and lucky draws

• Other events or opportunities.

To the extent permitted by applicable law, we may share limited information about you with social media and advertising companies we engage with for the purpose of online advertising. For example, to check whether you have an account with social media companies, so we can ask them to display more relevant marketing messages to you about our products and services or to exclude you from receiving advertisements for our products and services which you already use.

6. When do we use automated decision-making?

We may use the personal data we collect to conduct data analytics, including profiling and behavioural analysis, to make quicker automated decisions in our business operations and to evaluate your personal characteristics to predict outcomes and risks. We require that rules followed by such automated systems are designed to make fair and objective decisions. We may use artificial intelligence to help improve our communications and Customer experience, make our business operational processes safer and more efficient and enable us to provide faster responses and improve turnaround time. For example, we may use automated decision-making for the following:

• Customer digital onboarding processes – account opening approval processes using electronic Know-Your-Customer (eKYC) checks by verifying the authenticity of scanned identification documents and a photo through biometric facial recognition and liveliness check

• Operational efficiency – voicebots for call centre identification verification

• Customer marketing campaigns and communications to recommend more tailored products and services based on insights from your personal data and interactions with robo advisors and chatbots.

7. Who may JIVF share your personal data with?

We may share your personal data within JIVF. JIVF may share your personal data for the purposes of processing as set out in this Terms and Conditions, including with our service providers, our business partners, other third parties and as required by law or requested by any authority..

We limit how, and with whom, we share your personal data, and take steps to ensure your personal data is kept confidential and protected when we share it. We may share your personal data for our purposes of processing with the following, where relevant and allowed by law:

• Relevant Divisions within JIVF

• Authorised third parties

– Legal guardians, joint loan account holders, actual or intended guarantors, any actual or potential participants or sub-participants in relation to any of our obligations in respect of any agreement

– Any other person you have authorised us by your consent to share your personal data with wherther manual or automatic.

• Third parties that can verify your information

– Credit bureaus or credit reference agencies (including the operator of any centralised database used by credit reference agencies), credit protection providers, rating agencies, debt collection agencies, fraud prevention agencies and organisations

– Other non-government third parties’ that conduct financial crime prevention databases checks to prevent money laundering, terrorism, fraud and other financial crimes.

• Our service partners

– Professional advisers such as auditors, legal counsel, conveyancers and asset valuation specialists

– Insurers or insurance brokers

– Service providers (such as operational, administrative, data processing and technology service providers), including anyone engaged or partnered with to analyse and facilitate improvements or enhancements JIVF’s operations or provision of products and services

– Providers of professional services, such as market researchers, forensic investigators

– Third-party product providers including insurance companies and/or other related companies.

• Strategic referral partners

– Business alliance, co-branding partners or other companies or organisations that JIVF cooperates with based on contractual arrangements or other joint ventures

– Social media and advertising companies

• Other financial services organisations

– Other financial institutions, such as merchant banks, correspondent banks or national banks

– Market infrastructure providers

– Payment service providers, including merchants, payment processors and card association members, payment-initiation and card-based payment instrument service providers such as VISA and Mastercard

– Account Information Service Providers (AISP).

• Government and law enforcement agencies

as required by law or requested by any authority, which includes regulator, administrative, regulatory or supervisory agency, court, tribunal, enforcement agency.

• Other third parties

– The individual, company, business or organisation, as applicable, that you represent or is related to you

– Third parties in case of a merger, acquisition or divestment: if we transfer (or plan to transfer) any part of our business or assets. If the transaction goes ahead, the interested party may use or disclose your personal information in the same way as set out in this Terms and Conditions, and subsequently notify you of any changes they may make in terms with how they process your personal data.

8. Where do we transfer personal data?

Your personal data may be stored, shared and transferred by us within JIVF or with other third parties for the purposes described in this Terms and Conditions in order to operate effectively, efficiently and securely in facilitating transactions and providing products and services to our Customers, to improve and support our processes and business operations and to comply with our legal and regulatory obligations. This may involve storing, sharing and transferring your personal data cross border to other jurisdictions.

Where recipients of your personal data are in jurisdictions that are outside Vietnam, and local laws may not have similar data protection laws as the jurisdiction where you are or where we have a relationship, we will take all reasonable steps necessary to ensure that your personal data has an appropriate adequate level of protection and safeguards to comply with applicable law.

9. What are your personal data protection rights?

We respect your personal data, and you have the following rights about how we use your information:

• • Right to be informed
• • Right to give consent
• • Right to access or be provided with your data – you are entitled to access your data and can ask us for a copy of the personal data we have about you and how we’ve used it.
• • Right to correct your data – if your personal information is incorrect, you can rectify the data yourself or ask us to update it.
• • Right to delete your data – you can ask us to delete your personal data. However, we may need certain personal details to provide our products and services to you.
• • Right to restrict or object to processing – you can ask us to stop using your data or change how we use it, including but not limited to objecting to our use or disclosure of data for advertising purposes. However, we may need certain personal details to engage with you or provide our products and services to you.
• • Right to file complaints, denunciations, and lawsuits
• • Right to claim damage
• • Right to self-protection
• • Right to change or withdraw consent – if we ask for your consent to use your personal data, you can change your mind at any time. If you withdraw your consent, you acknowledge and agree that we may retain and process your personal data according to the requirements under applicable regulations or by competent authorities. In addition, you understand and acknowledge that we may not provide our products and/or services to you without processing your personal data. As a result, when you withdraw your consent, we have the right to terminate the relevant product(s) and/or service(s) and you are obliged to fulfil all your obligations owed to us upon the termination of our products and/or services.

10. What are your personal data obligations?

You shall have the following obligations as data subject:

• • Protect your own personal data, request us or other relevant organizations and individuals to protect your personal data.
• • Respect and protect personal data of others.
• • Provide complete and accurate personal data once you have consented to the processing of your personal data.
• • Participate in propaganda and dissemenation of personal data protection skills.
• • Comply with applicable laws and regulations on protection of personal data and participate in prevention of violations of such laws and regulations.
• • Other obligations as provided under applicable laws and regulations.