Personal Data Protection Policy

Personal Data: means digital data or information in any other form that identifies or helps identify a specific individual, including Basic Personal Data and Sensitive Personal Data. Personal Data that has been anonymized shall no longer be considered Personal Data.

Basic Personal Data includes: Full name, middle name and given name as stated on the birth certificate, and any other name (if any); Date, month and year of birth; date, month and year of death or disappearance; Gender; Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address; Nationality; Personal images; Telephone number, personal identification number, passport number, driver's license number, vehicle registration plate number; Marital status; Information relating to family relationships (parents, children, spouse); Information relating to an individual's digital accounts; Vehicle-related information, including Vehicle Identification Number (VIN), brand, model, year of manufacture, colour, place and date of purchase of the vehicle, vehicle performance data, vehicle registration plate number, information regarding driving conditions and driving behaviour, vehicle condition (engine status, temperature, fuel consumption, battery voltage, etc.), trip logs, mileage, remote vehicle operation activities, vehicle registration information; and other information associated with or capable of identifying a specific individual that does not fall within Section 1.3 of this Policy.

Sensitive Personal Data: means Personal Data associated with an individual's privacy, the infringement of which may directly affect the lawful rights and interests of such individual, including: Data revealing racial origin or ethnic origin; Political opinions, religious beliefs or faith; Information relating to private life, personal secrets or family secrets; Health status; Biometric data and genetic characteristics; Data revealing an individual's sex life or sexual orientation; Data concerning crimes or legal violations collected and stored by law enforcement authorities; An individual's location identified through positioning services; Usernames and passwords for accessing an individual's electronic identification account; Images of identity cards, citizen identity cards or other identification documents; Usernames and passwords for accessing bank accounts; Bank card information and transaction history data of bank accounts; Financial and credit information and information relating to customers' financial, securities and insurance activities and transaction histories maintained by credit institutions, foreign bank branches, payment intermediary service providers, securities institutions, insurance institutions and other authorized organizations; Data monitoring behaviour and activities relating to the use of telecommunications services, social networks, online communication services and other services in cyberspace; and other Personal Data required by law to be kept confidential or protected by enhanced security measures.

Data Subject: means an individual to whom Personal Data relates, including all individual customers using the Company's products and services, the Company's employees, shareholders and/or other individuals having a legal relationship with the Company.

Processing of Personal Data: means any operation performed on Personal Data, including one or more of the following activities: collection, analysis, aggregation, encryption, decryption, modification, deletion, destruction, anonymization, provision, disclosure, transfer of Personal Data, and any other activity affecting Personal Data.

Consent of the Data Subject: means the permission granted by a Data Subject for the Processing of his/her Personal Data, except where otherwise provided by applicable law.

Cases of Cross-Border Transfer of Personal Data: Includes:

1. Transfer of Personal Data stored in Vietnam to a data storage system located outside the territory of the Socialist Republic of Vietnam.
2. Transfer of Personal Data by agencies, organizations or individuals in Vietnam to organizations or individuals located overseas.
3. Use by agencies, organizations or individuals in Vietnam or overseas of platforms located outside the territory of the Socialist Republic of Vietnam to process Personal Data collected in Vietnam.

Where Personal Data of persons related to a Data Subject (including but not limited to information relating to dependents, related persons as prescribed by law, spouse, children and/or parents and/or guardians, friends, beneficiaries, authorized representatives, business partners, emergency contacts, or other individuals related to the Data Subject) is provided to the Company, the Data Subject and such related persons represent, warrant and undertake that all required information has been fully disclosed and that valid and lawful consent/approval has been obtained for the processing of such Personal Data for the purposes set out in this Policy. The Data Subject and such related persons agree that the Company shall have no obligation to verify the legality or validity of such consent/approval, and the responsibility for retaining documentary evidence thereof shall rest solely with the related persons and the Data Subject. The Company shall be released from liability and shall be entitled to indemnification for any losses, damages, costs and expenses incurred where the Data Subject and/or such related persons fail to comply with the obligations set out herein.

By registering for, using the Company's products and services, entering into contracts and/or permitting the Company to Process Personal Data, the Data Subject acknowledges that he/she has been informed of, has read, understood, accepted and unconditionally agreed to this Policy and any amendments thereto from time to time.

This Policy may be updated, amended, supplemented or replaced by the Company from time to time and published on the Company's official website at https://icaur.vn/en/privacy.html. You are encouraged to access and review our website regularly to stay informed of the latest updates. In certain circumstances, we may also proactively notify you of specific Personal Data Processing activities or material changes to this Policy and obtain your consent to such changes where required by applicable law.

The Company undertakes to comply with the following principles when Processing Personal Data:

1. The Company shall process and protect Personal Data in accordance with the laws of Vietnam and fully comply with contracts, agreements and other documents entered into with the Data Subject;
2. The Company shall collect Personal Data for specific, explicit and lawful purposes, within the scope of the purposes set out in Section 2 of this Policy and in accordance with the laws of Vietnam;
3. The Company shall ensure the accuracy of Personal Data and that such Personal Data is amended, updated or supplemented where necessary; Personal Data shall be retained for a period appropriate to the purposes of Processing Personal Data, unless otherwise required by law;
4. The Company shall effectively implement institutional, technical and organizational measures appropriate for the protection of Personal Data;
5. The Company shall proactively prevent, detect, stop, combat and strictly handle violations of laws relating to the protection of Personal Data in a timely manner;
6. The protection of Personal Data shall be associated with the protection of national and public interests, socio-economic development, national defense, security and foreign affairs, while ensuring a balance between the protection of Personal Data and the lawful rights and interests of agencies, organizations and individuals.

To assess the possibility of providing products and services and/or entering into contracts with the Data Subject, including but not limited to the following purposes:

1. Identifying and verifying information relating to the Data Subject;
2. Assessing, reviewing and approving the provision of products and services pursuant to registration forms, applications, contracts or other documents submitted by the Data Subject and/or persons related to the Data Subject;
3. Considering whether to provide or continue providing any products or services of the Company to the Data Subject.

To perform obligations under contracts, agreements, terms and conditions and other documents between the Company and the Data Subject and to provide customer support, including but not limited to the following purposes:

1. Performing contractual obligations and providing products and services to the Data Subject;
2. Updating and processing information relating to the Data Subject;
3. Providing customer care services and handling complaints, claims and disputes raised by the Data Subject;
4. Using and transferring Personal Data and relevant information to partners for the purpose of identifying and resolving product or service issues and carrying out product repair activities;
5. Contacting and notifying the Data Subject;
6. Implementing promotional programs, gift redemption programs, reward programs and gift delivery activities;
7. Carrying out other customer care and support activities.

To manage, operate and develop vehicle-related products and services. With respect to vehicles, devices, applications or connected systems provided or operated by the Company, the Company may Process Personal Data, including but not limited to the following purposes:

1. Monitoring, managing and supporting vehicle operations;
2. Diagnosing technical faults and carrying out maintenance, servicing, repairs, warranty services and after-sales services;
3. Monitoring product quality, operational safety and usage performance;
4. Supporting connectivity features, remote control functions, positioning services, navigation services, over-the-air (OTA) software updates and other digital services;
5. Conducting research, analysis and improvements to product quality, services and user experience;
6. Implementing product recalls, safety alerts, technical corrective actions and other necessary measures to ensure the safety of customers and vehicles.

To improve the quality of the Company's products and services, including but not limited to:

1. Providing information requested by customers or information that the Company believes may be useful to customers;
2. Improving technologies, website interfaces, social media platforms and applications to enhance customer convenience;
3. Managing customer accounts and loyalty programs implemented by the Company;
4. Conducting statistical analysis and data analytics for the purposes of researching, developing and improving products and services and enhancing customer experience;
5. Developing and providing new products and services tailored to customers' needs and actual circumstances;
6. Recommending products and services that may be of interest to customers based on identified preferences;
7. Creating customer profiles to improve service quality and customer experience;
8. Personalizing content displayed on the Company's website, applications, digital platforms and other interaction channels.

For marketing and communications purposes, including but not limited to:

1. Introducing and offering promotions and incentives relating to the Company's products and services and products and services jointly offered by the Company and its partners;
2. Conducting advertising, direct marketing and electronic marketing activities in accordance with applicable laws;
3. Conducting customer surveys, assessing customer satisfaction levels and improving service quality;
4. Organizing communication programs, customer conferences, events and brand promotion activities.

To manage, operate, maintain, secure and improve the Company's websites, applications, digital platforms and information technology systems, including but not limited to:

1. Operating, managing and ensuring the security of the Company's websites, applications and digital platforms;
2. Managing login activities, account authentication and system security;
3. Analysing traffic, usage performance and user experience;
4. Managing cookies, device identifiers, tracking technologies and similar technologies in accordance with applicable laws.

To ensure safety, security and fraud prevention:

1. Detecting, preventing and handling fraudulent, abusive or unlawful activities;
2. Protecting the lawful rights, interests, assets, systems and business operations of the Company;
3. Ensuring cybersecurity, information security and data protection;
4. Investigating and handling incidents, disputes, complaints and activities showing signs of violations;
5. Conducting risk management, internal control, internal audit, internal investigations and compliance assurance activities.

Restructuring and transfer of projects/businesses: In the course of business operations, the Company may sell or acquire businesses, undertake corporate restructuring activities, transfer projects or provide other services in accordance with applicable laws. Accordingly, Personal Data and rights to use information may constitute part of the assets transferred in such transactions. In all circumstances, any transfer and Processing of Personal Data shall be carried out in accordance with applicable laws and this Policy.

Compliance with legal obligations, including but not limited to:

1. Complying with the laws of Vietnam, international treaties and requests from competent state authorities;
2. Fulfilling obligations relating to accounting, auditing, taxation, finance, corporate governance, compliance control and record retention;
3. Supporting inspection, examination, investigation, litigation and other lawful requests from competent authorities.

Anonymized Data: The Company may use anonymized data or data that can no longer identify or be linked to a specific individual for research, statistical analysis, product development, technology development, artificial intelligence (AI), machine learning, service quality enhancement and other lawful purposes in accordance with applicable laws.

Other lawful purposes: The Company may Process Personal Data for other purposes where:

1. the Data Subject has provided consent in accordance with applicable laws;
2. such Processing is permitted or required by applicable laws; or
3. such Processing is necessary to protect the lawful rights and interests of the Data Subject, the Company or a third party in accordance with applicable laws.

Personal Data is collected through the following methods:

1. From the Company's websites and applications: Personal Data is collected when the Data Subject completes forms available on the Company's websites and applications.
2. Through the provision of products and services and the performance of contractual obligations by the Company: Personal Data is collected when the Data Subject purchases, registers for, uses any products or services, or enters into contracts with the Company.
3. Through communications and interactions with the Data Subject: Personal Data is collected through interactions between the Company and the Data Subject (whether in person, by mail, telephone, online, via call center systems, electronic communications or any other means), including customer surveys.
4. From social media platforms: including the Company's social media platforms and/or social media platforms operated in cooperation with the Company's partners.
5. From audio and video recording devices: installed at stores, business locations or premises where part or all of the Company's business activities are conducted and where the Data Subject encounters, appears before, or interacts with the Company.
6. Through interactions or automated data collection technologies: The Company may collect information automatically recorded through connections, including: (i) Cookies; Pixel Tags; Software Development Kits (SDKs); Web Beacons and similar tracking technologies; analytics and performance measurement tools; device identifiers; browser information, operating system information, IP addresses, login information, access log data; and other similar technologies; (ii) Any technology capable of tracking personal activities across devices or websites; (iii) Other information provided by a device; (iv) Information collected through third-party account login features (Social Login), social media platforms, applications, websites or third-party systems integrated with the Company's products and services; (v) Information generated or collected during the Data Subject's use of products, services, applications or digital platforms connected with the Company.
7. From vehicles, devices or connected systems: Personal Data may be collected from vehicles, devices, applications or connected systems provided or operated by the Company, including vehicle operation data, diagnostic data, location data, connected-feature usage data, over-the-air (OTA) software update data and other technical data required for the provision of products and services.
8. Other sources: The Company may collect Personal Data from publicly available and legitimate sources of information or through the receipt of necessary data shared by its parent companies, subsidiaries, affiliates and business partners in the course of cooperation with the Company in accordance with applicable laws.

Personal Data shall be stored in Vietnam within the Company's database systems or within the systems of the Company's branches, subsidiaries, affiliates, or service providers engaged by the Company, as appropriate for the purposes of data processing and in compliance with applicable laws.

The retention period of Personal Data shall be determined based on the purposes of use set out in this Policy and in accordance with applicable laws.

The Company shall not sell Personal Data to any third party. The Company implements appropriate security measures to ensure that the transfer and sharing of Personal Data is conducted securely. Personal Data may be shared by the Company with: (i) the Company's parent companies, subsidiaries and affiliates; (ii) individuals and organizations participating in the Processing of Personal Data as described in this Policy, including but not limited to information technology service providers, data hosting service providers, customer service call center operators, agents, distributors, warranty service centers, logistics service providers, payment service providers, customer survey service providers, marketing and communications partners, auditors, consultants and legal advisors; or (iii) competent state authorities or other recipients as permitted or required by applicable laws.

Where the recipient of Personal Data is located outside Vietnam, the Company shall, when transferring or disclosing Personal Data overseas (including but not limited to activities involving cyberspace, electronic devices, electronic means or other methods of transferring Personal Data outside the territory of Vietnam), require the recipient to implement appropriate measures to ensure the safety and confidentiality of the transferred Personal Data. The Company undertakes to comply fully with the requirements of Vietnamese law relating to the protection and security of Personal Data.

Personal Data may be analysed, compared, aggregated, classified, assessed or otherwise processed through manual or automated means for the purposes specified in Section 2 of this Policy, subject to compliance with applicable Personal Data protection principles and information security requirements under applicable laws.

Where necessary, collected Personal Data shall be encrypted in accordance with appropriate encryption standards during storage, transfer and processing to ensure that such data remains protected at all times.

Where appropriate for the processing purposes and as permitted by applicable laws, the Company may anonymize, encrypt, aggregate or apply other technical measures to render data incapable of identifying a specific individual. Anonymized data may be used by the Company for research, statistical analysis, product development, service development, technology development and other lawful purposes in accordance with applicable laws.

In accordance with applicable laws or upon a valid request from a Data Subject, the Company shall delete stored Personal Data, except in the following circumstances:

1. Applicable laws prohibit deletion or require mandatory retention of such data;
2. Personal Data is processed by competent state authorities for the performance of their statutory functions in accordance with applicable laws;
3. Personal Data has been lawfully disclosed to the public in accordance with applicable laws;
4. Personal Data is processed for legal compliance, scientific research or statistical purposes in accordance with applicable laws;
5. In cases of national defense emergencies, national security emergencies, public order and safety emergencies, major disasters, dangerous epidemics; where there are threats to national security or defense that have not yet reached the threshold for declaration of a state of emergency; or for the prevention and suppression of riots, terrorism, crimes and legal violations;
6. For responding to emergency situations threatening the life, health or safety of the Data Subject or another individual.

Throughout the Processing of Personal Data, security remains the Company's highest priority. The Company implements appropriate technical measures to prevent unauthorized access to or use of Personal Data. The Company also regularly cooperates with cybersecurity and information security experts to update and apply the latest security technologies in order to ensure the protection of Personal Data. Payment card information issued by financial institutions is protected by the Company on the principle that sensitive payment card information (including card number, cardholder name and CVV code) is not stored on the Company's systems. Payment transactions are processed through the systems of the relevant banking institutions.

The Company shall Process Children's Personal Data in accordance with the principle of protecting children's rights and acting in the best interests of children, and in compliance with applicable laws.

The Company shall only Process Children's Personal Data and provide products and services to children where the child's parent or legal guardian has consented to the child's use of the Company's products and services, consented to the Company's Processing of the child's Personal Data, agreed to this Policy and complied with the requirements of applicable laws.

For the avoidance of doubt, where a child is seven (7) years of age or older and uses the Company's products or services, in addition to the requirements set out herein, the Company shall only Process such child's Personal Data upon obtaining the consent of the child. The parent or legal guardian shall be responsible for obtaining the child's consent before providing the child's Personal Data to the Company. The Company reserves the right to require the Data Subject, parent or legal guardian to provide information, documents or undertake verification measures necessary to determine the age of the child and the legal authority of the person providing such consent.

Where the Company discovers that the collection, provision or Processing of a child's Personal Data has been conducted in violation of applicable laws or without the valid consent of the parent, legal guardian or child as required by law, the Company reserves the right to suspend or terminate the provision of products and services and take necessary measures to protect the child in accordance with applicable laws.

The Company employs various information security technologies, including firewall systems, access control measures, encryption technologies and other security measures, to protect Personal Data and prevent unauthorized access, use or disclosure thereof. However, the Company cannot guarantee the absolute security of Personal Data in certain circumstances, including:

1. Hardware or software failures occurring during data processing resulting in the loss of the Data Subject's data;
2. Security vulnerabilities beyond the Company's reasonable control or cyberattacks by hackers resulting in the unauthorized disclosure, leakage or loss of data.

The Company recommends that Data Subjects keep information relating to account passwords, OTP codes and other authentication credentials confidential and refrain from disclosing such information to any third party.

Data Subjects should be aware that whenever they voluntarily disclose or make their Personal Data publicly available, such data may be collected and used by others for purposes beyond the control of the Data Subject and the Company.

The Company recommends that Data Subjects properly safeguard their personal devices (including mobile phones, tablets, personal computers and similar devices) while using the Company's products and services. Data Subjects should log out of their accounts when such accounts are not in use.

In the event that the data storage server is subject to a cyberattack resulting in the loss, leakage or unauthorized disclosure of Personal Data, the Company shall notify the competent authorities for timely investigation and handling and shall notify the affected Data Subjects in accordance with applicable laws.

Cyberspace is not a completely secure environment and the Company cannot guarantee that Personal Data transmitted through cyberspace will always remain secure. When transmitting Personal Data through cyberspace, Data Subjects should only use secure systems to access websites, applications or devices. Data Subjects are responsible for maintaining the confidentiality and security of their authentication credentials used to access each website, application or device.

Personal Data shall be Processed from the time the Company lawfully collects or receives such Personal Data and has an appropriate legal basis for Processing such data in accordance with applicable laws.

Personal Data shall continue to be Processed until the purposes of Processing have been fulfilled, unless otherwise required by the laws of Vietnam.

Upon expiry of the applicable retention period, or at such time as the Company deems appropriate, the Company may, at its sole discretion and in accordance with applicable laws, take steps to permanently delete Personal Data or retain such Personal Data in anonymized form, unless otherwise required by the laws of Vietnam.

The Company may be required to retain Personal Data even after the termination of contractual relationships between the parties in order to comply with applicable legal obligations and/or requests from competent state authorities.

Depending on the circumstances, the Company may act as a Personal Data Controller or a Personal Data Controller and Processor.

To the extent permitted by applicable laws, the Data Subject acknowledges and understands that the Company may share Personal Data for the purposes set out in this Policy with the following organizations and individuals:

1. The Company's parent companies, subsidiaries and affiliated companies;
2. Organizations and individuals providing services to and/or cooperating with the Company, including but not limited to agents, auditors, lawyers, business partners, providers of information technology solutions, software and applications, and providers of operational, management, incident response and infrastructure development services;
3. Any individual or organization acting as the representative or authorized person of the Data Subject or otherwise acting on behalf of the Data Subject.

Any sharing of Personal Data shall be carried out in accordance with applicable laws and prescribed procedures. Recipients of Personal Data shall be obligated to maintain the confidentiality and security of Personal Data in accordance with this Policy, the Company's internal regulations and standards relating to Personal Data protection, and applicable laws.

The Company may be required to disclose or share Personal Data with competent state authorities in accordance with applicable laws.

The right to be informed of the Processing of his/her Personal Data, except where otherwise provided by law.

The right to give or withhold consent and to request withdrawal of consent for the Processing of his/her Personal Data, except where otherwise provided by law.

The right to access, review, amend or request amendment of his/her Personal Data, except where otherwise provided by law.

The right to request the provision, deletion or restriction of the Processing of Personal Data and to object to the Processing of Personal Data in accordance with applicable laws.

The right to lodge complaints, denunciations, initiate legal proceedings and claim compensation for damages in accordance with applicable laws.

The right to request competent authorities or organizations and individuals involved in the Processing of Personal Data to implement measures for the protection of his/her Personal Data in accordance with applicable laws.

The Data Subject may exercise these rights by submitting a request to the Company. The request form must be sent to the Company and contain basic information including the requestor's details, a detailed description of the request (for example, the type of data requested, data to be deleted, names of relevant documents or records (if any)), the reasons and purposes for the request, and any other information relevant to the specific request (for example, whether requested documents should be provided in electronic or hard-copy form, the delivery address, etc.). Any costs (if any) arising from the processing of such requests, including but not limited to printing costs, photocopying costs, postal charges and courier fees for delivering data, shall be borne by the requestor and must be paid no later than upon receipt of the requested data or within such period as may be specified by the Company.

The Company shall process requests submitted by Data Subjects in accordance with applicable laws and with due consideration of the legitimate interests of the Data Subject. However, where the Data Subject withdraws consent, requests deletion of data and/or exercises any other rights relating to any or all of his/her Personal Data in a manner that affects the Company's ability to provide or maintain products or services for the Data Subject or to maintain the contractual relationship between the Company and the Data Subject, the Company may, depending on the nature of the request, consider and decide to discontinue the provision of products or services to the Data Subject and/or terminate the contractual relationship between the Company and the Data Subject. Any action taken by the Data Subject pursuant to this provision shall be deemed a unilateral termination by the Data Subject of any relationship between the Data Subject and the Company. Accordingly, the Company shall not be liable for any losses arising therefrom, and all lawful rights and remedies of the Company shall be fully reserved. Using reasonable efforts, the Company shall process lawful and valid requests from the Data Subject within the timeframes prescribed by applicable laws. However, for security purposes, the Company may require the Data Subject to verify his/her identity before processing any request.

The Company reserves the right to refuse a request from a Data Subject in certain circumstances, including but not limited to where: (i) the Data Subject fails to comply with the procedures instructed by the Company, including where the request is incomplete or invalid; (ii) the Data Subject fails to provide, or fails to provide sufficient, documents or information required for identity verification; (iii) the Company determines that there are indications of fraud or violations relating to the protection of Personal Data; or (iv) applicable laws do not permit the requested action.

To protect his/her own Personal Data and require other relevant organizations and individuals to protect such Personal Data. The Data Subject shall promptly notify the Company upon discovering any errors, inaccuracies, leakage of Personal Data or any suspicion that Personal Data has been compromised.

To respect and protect the Personal Data of other individuals.

To provide complete and accurate Personal Data in accordance with applicable laws, contractual requirements or when consenting to the Processing of his/her Personal Data. The Data Subject shall bear all costs and consequences arising from any inaccurate information where such inaccuracy affects or limits the Data Subject's rights and interests.

To comply with laws relating to Personal Data protection and participate in the prevention and combat of violations of Personal Data protection regulations.

Other obligations as prescribed by applicable laws.

The Data Subject acknowledges that, by accepting this Policy, the Data Subject has consented to the Processing of Personal Data by the Company and by organizations and individuals participating in the Processing of Personal Data as set out in this Policy, and fully understands the categories of data being Processed, the purposes of Processing, the organizations and individuals involved in the Processing of Personal Data, and his/her rights and obligations relating to Personal Data. The Data Subject further acknowledges that the Company has provided all information required to be notified prior to the Processing of Personal Data and that the Data Subject has read, understood and agreed to all such information. The Data Subject agrees that the Company and organizations and individuals participating in the Processing of Personal Data shall not be required to provide any further notice prior to Processing Personal Data.

If you have any questions or concerns regarding this Policy, please contact us using the details below, and we will endeavor to respond as soon as reasonably practicable:

1. Contact Address: 12A Floor, Geleximco Building, No. 36 Hoang Cau Street, O Cho Dua Ward, Hanoi City, Vietnam
2. Email Address: office@omodaglobal.com
3. Telephone: 0972175005