Coway Vina Company Limited ("Coway" or "we" or "the Company") attaches great importance to the protection of Personal Data ("PD"). Accordingly, data protection and information security are an integral part of the operating policy of our Company.

In this PD Processing and Protection Policy ("Policy"), we will provide information on how we process PD if and when we collect PD for the purpose of providing our products and/or services or carrying out business transactions/operational activities with You or when You use our online services.

In the course of processing PD, depending on the specific circumstances and the purposes of data processing, we may act as a PD Controller, a PD Processor, or a PD Controller-Processor or a Third Party in accordance with applicable law.

General process for collecting and processing PD at Coway

The process for collecting and processing PD at Coway is applied under general principles to all groups of Data Subjects and may be summarized in the following steps: (i) giving notice of the collection and processing of PD and/or requesting the Data Subject's consent, where required by law or internal regulations; (ii) collecting PD; (iii) using and processing PD within the defined purposes; (iv) sharing, providing or transferring PD to relevant parties, if any; (v) applying security and protection measures for PD throughout the processing; (vi) updating, adjusting or amending PD where necessary; (vii) continuing to store and manage PD for a period consistent with the processing purposes and applicable law; and (viii) deleting, destroying or anonymizing PD when it is no longer necessary or when there are appropriate grounds to delete, destroy or anonymize it in accordance with law and Coway's internal regulations.

"Data Subject" means the individual reflected by the PD.

"You" means the data subject to whom this Policy applies, including all potential and existing customers, service users, recruitment candidates, representatives of partners, suppliers, or other individuals whose PD is processed by the Company.

"Personal Data" ("PD") means digital data or information in other forms that identifies or helps identify a specific individual, including: basic PD and sensitive PD.

"Basic PD" means personal data reflecting common personal identity and background factors that are frequently used in transactions and social relations, within the list issued by the Government.

"Sensitive PD" means personal data closely associated with an individual's privacy which, when infringed, will directly affect the lawful rights and interests of agencies, organizations and individuals, within the list issued by the Government.

"Processing of PD" means any activity affecting PD, including one or more of the following activities: collection, analysis, compilation, encryption, decryption, editing, deletion, destruction, de-identification, provision, disclosure, transfer of PD and other activities affecting PD.

"Consent" means the clear, verifiable and voluntary expression by the data subject of permission to process his/her PD. Consent must be expressed through an affirmative action and cannot be inferred from silence or inaction. In addition, Consent must comply with the principles set out in this Policy and with the law on PD protection.

"PD Controller" means an agency, organization or individual that determines the purposes and means of processing PD.

"PD Processor" means an agency, organization or individual that processes PD on behalf of a PD controller or a PD controller-processor through a contract.

"PD Controller-Processor" means an agency, organization or individual that determines the purposes and means of, and directly processes, PD.

"Third Party" means an organization or individual, other than the Data Subject, the PD controller, the PD controller-processor or the PD processor, that participates in the processing of PD in accordance with law.

"DPO/DPD" means the PD protection personnel/department of the Company.

Our processing of PD is carried out based on the following principles:

• Lawfulness, fairness and transparency: PD is processed only when there is a valid legal basis; we always clearly notify the purposes and manner in which data is used.
• Purpose limitation: PD is collected for specific purposes and is not processed for other incompatible purposes without new consent.
• Data minimization: Only data that is necessary and genuinely relevant to the purposes is collected.
• Accuracy: PD is kept accurate and up to date; a mechanism is provided for You to make corrections when needed.
• Storage limitation: Data is kept only for the minimum necessary period.
• Integrity and confidentiality: Appropriate technical and organizational measures are applied against unauthorized access, loss and destruction.
• Accountability: Compliance can be demonstrated, and responsibility is borne for all PD processing activities.

Depending on Your relationship with Coway, we may collect and process Your PD for different purposes, as follows:

• We process PD on the basis of one or more of the following grounds: (i) Your consent; (ii) to perform an agreement/contract with You; (iii) to perform Our legal obligations; (iv) cases in which the law permits PD to be processed without consent.
• When processing PD on the basis of consent, We ensure that Your Consent is given voluntarily, clearly and specifically, and that You are fully informed of:
  • The types of PD to be processed;
  • The purposes of PD processing;
  • The organizations and individuals to whom PD is transferred;
  • The PD storage period;
  • The rights and obligations of the Data Subject.

Your silence or failure to respond is not regarded as consent. You have the right to withdraw Your consent at any time; withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Details on how consent is expressed, how consent is withdrawn, and the alternative legal bases where consent is not required are set out in the following contents of Section 6 of this Policy.

6.1. Channels and methods of collecting PD

• Collection directly from You;
• Automatic collection through technology:
  • Cookies;
  • System access logs, including access logs;
  • IP addresses, and browser environment data;
• Collection from third parties.

6.2. Conditions for valid consent

Consent is legally valid only when all of the following conditions are met at the same time:

• Voluntary: Not coerced, and not a mandatory precondition for using a service (unless the data is truly necessary for that service);
• Fully informed: You are provided with sufficient information on the purposes, legal basis, data recipients, storage period and Your rights BEFORE You consent;
• Specific: Each processing purpose requires a separate consent; consent must not be "bundled" for multiple unrelated purposes;
• Clear and verifiable: Expressed through an affirmative action, with a timestamp and stored evidence;
• Withdrawable: You may withdraw Your consent at any time through a simple mechanism equivalent to the mechanism used to give consent.

6.3. How to withdraw consent

You have the right to withdraw any Consent previously given at any time through:

• Cookies: by changing the settings via [Cookie Settings] in the website footer, taking effect immediately;
• All other types of Consent: Submit a request to withdraw consent in accordance with the instructions in Section 8 of this Policy. The DPD will review and process the request and contact You within 02 working days.

6.4. Alternative legal bases (where consent is not required)

In certain cases, the Company may process PD without Your consent where there is an independent legal basis:

• To protect the life, health, honor, dignity, and lawful rights and interests of the Data Subject or of others in an emergency; to protect the legitimate rights or interests of oneself, of others, or the interests of the State, of agencies and organizations to the extent necessary against acts infringing those interests. The PD controller, PD processor, PD controller-processor or third party bears the responsibility of proving such cases;
• To handle emergency situations; threats to national security that have not yet reached the level of declaring a state of emergency; to prevent and combat riots, terrorism, crime and violations of law;
• To serve the operations of state agencies and state management activities in accordance with the law;
• To perform an agreement between the Data Subject and relevant agencies, organizations or individuals in accordance with the law;
• To sell or supply products, goods or services at the request of consumers and only within the scope of information that consumers have consented to;
• To transfer information that has been collected in accordance with the Consumer Rights Protection Law and other relevant laws to a third party for storage or analysis to serve the transferor's business activities, where there is a written agreement that the third party is responsible for protecting consumer information in accordance with regulations;
• Other cases in accordance with the law.

Our Company's website may contain links to third-party websites. When You click on a link and leave Our Website, You will be subject to that website's privacy policy. We do not control and are not responsible for the content or activities of third-party websites.

Cookies are small text files stored on Your device when You visit a website. We use cookies for the following purposes:

You can control and manage cookies through Your browser settings or via [Cookie Settings] on the website. However, disabling certain cookies may affect the functionality of the website.

Detailed information about the types of cookies We use and how to manage them is set out in Our Cookie Policy.

Your rights regarding PD include:

• The right to be informed about the processing of PD;
• The right to consent or not consent, and to request withdrawal of consent to allow the processing of PD;
• The right to view, correct or request correction of PD;
• The right to request provision of, deletion of, or restriction of the processing of PD; to send a request objecting to the processing of PD;
• The right to complain, denounce, bring lawsuits and claim compensation in accordance with the law;
• To request competent authorities or agencies, organizations or individuals involved in PD processing to implement measures and solutions to protect Your PD in accordance with the law.

Your obligations regarding PD include:

• To protect Your own PD;
• To respect and protect the PD of others;
• To provide Your PD fully and accurately in accordance with the law, under a contract, or when consenting to the processing of Your PD;
• To comply with the law on PD protection and participate in preventing and combating activities that infringe PD.

How to exercise rights

Step 1: Fill in the "Form for Exercising the Rights of the Personal Data Subject", sign it and scan it

Step 2: Send an email to: compliance@cowayvina.com.vn – Subject: "Request to exercise PD protection rights – [Full name] – [Type of right]"

Or: Send the form by post to: 16 Nguyen Truong To, Xom Chieu Ward, Ho Chi Minh City. Recipient: DP Department – Telephone: 028 2211 8001

Please note that the exercise of the rights of the Data Subject PD may affect the performance of related activities to which the Data Subject PD is a party. The Company is not liable in this case.

We apply appropriate technical, organizational and management measures to protect PD against the risks of unauthorized access, loss, disclosure or processing for improper purposes. The level and type of measures applied depend on the nature and sensitivity of the PD, the scale of processing, the technology used and the level of risk that may arise.

Technical measures

Depending on the case, we may apply one or more of the following measures:

• Encryption in transit;
• Encryption at rest;
• Multi-factor authentication (MFA);
• Access control;
• Automatic daily backups with offsite storage; quarterly restoration tests;

Organizational measures

Depending on the scale of operations and legal requirements, we apply one or more of the following measures:

• Appointing/establishing a DPO/DPD;
• Mandatory PD protection training for 100% of employees upon onboarding and annually;
• Preparing, submitting and retaining PD processing impact assessment dossiers and cross-border PD transfer dossiers in accordance with regulations;
• Signing PD processing agreements with all third parties that process PD.

PD breach incident response process

We store PD only for the period necessary to fulfill the stated processing purposes, or for the period required by law.

After the retention period expires, the Company will delete, destroy or de-identify PD by appropriate measures, unless otherwise provided by law.

In order to fulfill the purposes of processing the Data Subject's PD, Your PD may be stored or processed on servers located in countries outside the territory of Vietnam; or transferred to the parent company in Korea.

In this case, the Company undertakes to:

• Prepare, retain and submit the Cross-Border PD Transfer Impact Assessment Dossier (DTIA) in accordance with regulations (ready for inspection and submission within 60 days from the date the transfer is carried out);
• Self-assess and take responsibility for the data protection capability of the data recipient;
• Carry out procedures with competent authorities in accordance with regulations;
• Apply safety measures for PD during the transfer in accordance with the law (including the measures in Section 8 of this Policy).

• The Company will always make its best efforts to keep the PD of Data Subjects confidential and secure during the processing of PD.
• The Company cannot guarantee against unintended consequences and damages affecting the PD of Data Subjects in the following cases:
  • Hardware or software errors not caused by the Company that result in the loss or distortion of the Data Subject's PD;
  • Security vulnerabilities beyond the Company's control, or the Company's systems being attacked by other third parties, resulting in the loss or disclosure of PD;
  • The Data Subject disclosing his/her own PD through carelessness or being deceived or defrauded; or accessing websites or downloading applications that contain malicious software;
  • Other consequences that the Company cannot foresee and prevent.

This PD Protection Policy applies from the date of signing and is updated in accordance with the law on PD protection in force at the relevant time. The rights and obligations of Data Subjects are guaranteed under the corresponding legal provisions from time to time.

We have the right to change and update this Policy from time to time and will ensure that such changes and updates are consistent with relevant laws. We will announce changes on our website. The amended Policy will take effect from the time it is announced on our website.

You may contact us to learn more about this Policy, to provide comments, or to make any complaint by contacting our PD protection personnel using the following information: