Personal Data Protection Policy

1. DEFINITIONS

The terms used in this Personal Data Protection Policy (the “Policy”) are understood as follows:

• BONBON: BONBON Mobility Joint Stock Company.
• Personal Data (“PD”): digital data or information in other forms that identifies or helps identify a specific person, including basic personal data and sensitive personal data. Personal data that has been de-identified is no longer personal data.
• Data Subject: the person reflected by the personal data.
• Customer: includes individual customers using applications, products and services provided by BONBON.
• Products and Services (“P&S”): the products and services provided by BONBON on the Car Wash Miniapp integrated into the VETC application.
• PD Processing: any operation affecting personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, amendment, deletion, destruction, de-identification, provision, disclosure, transfer of personal data and other operations affecting personal data.
• PD Controller: the agency, organisation or individual that decides the purposes and means of processing personal data.
• PD Processor: the agency, organisation or individual that processes personal data at the request of the PD Controller or the PD Controller and Processor under a contract.
• PD Controller and Processor: the agency, organisation or individual that decides the purposes and means of, and directly processes, personal data.
• Third Party: any organisation or individual other than the Data Subject, PD Controller, PD Controller and Processor or PD Processor that participates in the processing of personal data in accordance with the law.

2. EFFECTIVENESS OF THE POLICY

• By researching and registering to use, using the P&S, entering into contracts and/or providing PD to BONBON on any platform and/or in any form, the Data Subject/Customer has read, understood and accepted the contents set out in this Policy and any changes (if any) from time to time.
• This Policy forms an inseparable part of the contracts, agreements, terms, conditions and other documents established between the Data Subject/Customer and BONBON. This Policy shall prevail in the event of any conflict or inconsistency with the contracts, agreements, terms, conditions and other documents.
• This Policy may be updated, amended, supplemented or replaced by BONBON from time to time. Before a revised version takes effect, BONBON must notify the Data Subject/Customer at least 05 (five) days in advance by one of the following means: a text message to the mobile phone number, a letter (or email) sent directly to the address of the Data Subject/Customer, publication on the website https://bonbon.com.vn, posting at BONBON’s transaction points, or another method consistent with the law. If it does not agree with the amendment or supplement, the Data Subject/Customer should contact BONBON for further explanation or has the right to terminate the use of BONBON’s services.

3. CATEGORIES OF PERSONAL DATA PROCESSED

So that BONBON can process PD for the purposes set out in Section 5 of this Policy, BONBON may collect and process the categories of PD listed below, and these categories may vary depending on the relationship between the Data Subject/Customer and BONBON, the Data Subject/Customer’s interactions with BONBON, and the law at any given time, specifically including:

• Full name, middle name and birth name, and other names (if any);
• Date, month and year of birth; date, month and year of death or disappearance;
• Gender;
• Place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence, hometown and contact address;
• Nationality;
• Personal images;
• Phone number, personal identification number, passport number, driving licence number and vehicle registration number;
• Marital status;
• Information about family relationships (parents, children, spouse);
• Information about personal account numbers;
• Occupation;

In some cases, BONBON may need to collect sensitive PD of the Data Subject/Customer, or where permitted by law. Such sensitive personal data may include:

• Data revealing racial or ethnic origin;
• Political views, religion or belief;
• Information about private life, personal secrets or family secrets;
• Health status;
• Biometric data and genetic characteristics;
• Data revealing a person’s sex life or sexual orientation;
• Data on crimes or legal violations collected and stored by law enforcement agencies;
• A person’s location determined through location services;
• Login name and password for a person’s electronic identification account; images of identity cards, citizen identity cards or people’s identity cards;
• Login name and password for bank accounts; bank card information, data on bank account transaction history; financial and credit information and information on the financial, securities and insurance activities and transaction history of customers at credit institutions, foreign bank branches, payment intermediary service providers, securities and insurance organisations and other permitted organisations;
• Data tracking behaviour and activities in the use of telecommunications services, social networks, online media services and other services in cyberspace.

4. HOW BONBON COLLECTS PD

BONBON, as a PD Controller, PD Controller and Processor, or PD Processor, may collect the PD set out in Section 3 of this Policy from the following sources:

• Directly from the Data Subject: when the Data Subject registers and/or uses the P&S; interacts with individuals/units authorised by BONBON; interacts with BONBON’s/its PD Processor’s call centre, website, application, fanpage, social networks and other digital platforms; or when the Data Subject/Customer visits BONBON’s transaction points, headquarters or offices.
• Through a PD Provider:

PD Providers include:

• Individual Customers providing information about another person who is a Data Subject in emergencies or other individuals related to the Customer, where BONBON must collect information to fulfil requests and provide P&S to the Customer in accordance with BONBON’s regulations and the law;
• Organisational Customers providing information about another person who is a Data Subject, including information about: persons related to the organisation, legal representatives, authorised representatives and other individuals whose information BONBON must collect to fulfil requests and provide P&S to the Customer in accordance with BONBON’s regulations and the law.
• BONBON’s service providers, partners and consultants, including but not limited to organisations and individuals carrying out surveys, social media communications, fraud prevention, data aggregation, and support for BONBON’s infrastructure, systems, technology services and media; brokers and other third parties related to BONBON’s business activities;
• Third parties having a relationship with the Data Subject, including but not limited to the Data Subject’s service providers and third parties that the Data Subject permits to collect and provide PD to BONBON;
• Other competent authorities in Vietnam.

When providing another person’s PD to BONBON, the PD Provider represents, warrants and is responsible to BONBON that:

• The information provided to BONBON is accurate and complete, and it will notify BONBON of any changes or errors in the PD provided;
• It has notified the Data Subject (unless otherwise provided by law), understood and obtained that person’s lawful consent/agreement or valid authorisation for: (i) providing PD to BONBON (ii) permitting BONBON to process PD for the purposes set out in this Policy. The PD Provider agrees that BONBON is not obliged to verify the legality or validity of such consent/agreement/authorisation, and that storing evidence rests with the PD Provider. The PD Provider must provide evidence at BONBON’s request. BONBON is released from liability and may claim compensation for related damage and costs where the PD Provider fails to comply with this Section;
• Regarding PD of children: BONBON does not provide services to Customers who are children.

Publicly available sources: for example, social media posts, online publications and other publicly available information.

5. PURPOSES OF PD PROCESSING

PD may be processed by BONBON/the PD Processor/a Third Party for one or more of the following purposes:

• Providing P&S to Customers and supporting Customers in using BONBON’s products and services.
• Fulfilling the requests of the Data Subject/Customer and the obligations under the Policy, contracts, agreements and other documents between BONBON and the Data Subject/Customer.
• Analysing, evaluating and improving products and services (including websites), technology and processes.
• Conducting marketing, promotion, advertising and loyalty programmes.
• Operating BONBON’s internal activities, business operations and internal risk management.
• Providing customer care services for partners, including but not limited to Tasco Insurance, VETC, VETC RSA, etc.
• Complying with current legal regulations.
• Protecting BONBON’s lawful rights and interests, exercising legal rights and conducting litigation procedures.

6. ORGANISATIONS AND INDIVIDUALS PROCESSING PD AND METHODS OF PD PROCESSING

To carry out the purposes and PD processing activities in Section 5 of this Policy, BONBON may provide PD to the following PD Processors and Third Parties, on the basis that the receiving party only processes the PD necessary for the purposes of performing the functions and work that BONBON designates or engages, in accordance with this Policy, the contracts, agreements and other documents established with the Data Subject/Customer, the law and/or other regulations BONBON must comply with, specifically as follows:

1. BONBON’s employees, branches, representative offices and parent company.
2. Third parties representing the Data Subject/Customer, such as legal guardians, authorised persons, or any organisation/individual that BONBON is permitted or authorised by the Data Subject/Customer to share information with, or for which BONBON has a legal basis to share the Data Subject/Customer’s PD.
3. Service providers to BONBON and parties cooperating with BONBON to provide services, including:
4. Business partners and related partners cooperating with BONBON to develop, provide or in connection with developing or providing P&S to the Data Subject/Customer and/or serving BONBON’s business operations.
5. Competent State authorities.

• Contractors, agents, sellers, service providers, consultants or other parties cooperating with BONBON, including but not limited to:
• Individuals/organisations providing services supporting BONBON’s business activities such as: administrative, delivery, postal, telemarketing, direct selling, call centre, data processing, information technology, market research, data modelling, rewards, records storage and management, data entry, social media, telecommunications, messaging or email, network and telephone connectivity, technology infrastructure and support, information security, software maintenance and licensing, data centre, conversation and conferences, training, consulting services, and other activities supporting the operation of BONBON’s business;
• Insurance companies, insurance brokerage companies and insurance agents;
• Organisations involved in processing the Data Subject/Customer’s transactions, such as commercial banks, payment service providers and payment intermediary services.

Depending on the purpose of PD processing, BONBON or BONBON’s PD Processor or a Third Party may apply appropriate processing methods, including but not limited to automatic, manual or other methods of PD processing consistent with the law and BONBON’s regulations from time to time.

7. UNINTENDED CONSEQUENCES AND DAMAGE THAT MAY OCCUR

7.1. When BONBON processes PD

PD processing always carries the risk of data leakage or inappropriate data processing. BONBON is aware of the importance of, and its responsibility for, protecting PD and undertakes to apply protection measures appropriate under current law and to regularly review and update optimal technical measures to ensure safety in PD processing, making maximum efforts to prevent risks and limit unintended consequences and damage that may occur, and to protect the lawful rights and interests of the Data Subject and BONBON.

7.2. When BONBON handles requests regarding the Data Subject’s rights

• The Data Subject withdrawing their consent, requesting deletion of data, restriction of processing, objection to PD processing and/or exercising other related rights with respect to any or all of the PD may affect the ability to provide/maintain the P&S for the Data Subject/Customer. Depending on the nature of the Data Subject’s request, BONBON may consider and decide to refuse, or to stop providing the P&S to the Data Subject/Customer. Actions taken by the Data Subject under this provision will be regarded as a unilateral termination of the agreement by the Data Subject/Customer for any relationship between the Data Subject/Customer and BONBON and may lead to a breach of obligations or commitments under contracts, agreements or other documents between the Data Subject/Customer and BONBON. Accordingly, the Data Subject/Customer will be responsible for any resulting losses, and BONBON’s lawful rights are expressly reserved with respect to limiting, restricting, suspending, cancelling or preventing requests relating to such PD.
• Requests to delete data, withdraw consent, restrict processing or object to data processing will not affect the lawfulness of BONBON’s prior data processing activities.
• For requests to view or amend PD, the Data Subject understands and agrees that in some cases, for technical reasons, the response capability of the system or BONBON’s infrastructure, the requirement to verify PD before amendment under the law, or other reasons, the scope of PD categories and the manner in which the Data Subject can access, view and amend may be affected and limited.

8. START AND END TIME OF PD PROCESSING

Unless otherwise provided by current law, BONBON begins PD processing when it receives PD with the consent of the Data Subject/Customer and/or the PD Provider’s commitment regarding the Data Subject’s consent in relation to PD processing under this Policy.

BONBON will end PD processing when (whichever occurs later):

• Requested in writing by the Data Subject;
• The legal agreements between the Data Subject/Customer and BONBON terminate, or the parties have completed all obligations related to the agreement;
• A dispute or complaint is concluded by agreement/judgment/decision of a competent state authority that has legal effect;
• The purpose of processing consented to by the Data Subject has been completed;
• The retention obligation under the law has been completed;
• As provided by law.

9. BONBON’S RIGHTS AND OBLIGATIONS:

• Implementing measures to ensure information security and protect the PD of the Data Subject/Customer.
• Processing the Customer’s personal data for the right purposes and scope, with a valid legal basis and in accordance with the law on personal data protection.
• Applying, maintaining and regularly reviewing management, technical and organisational measures to protect personal data against unlawful access, use, disclosure, alteration or destruction.
• Fully and clearly notifying Customers about personal data processing in accordance with the law and BONBON’s personal data protection policy.
• Ensuring and facilitating Customers’ exercise of data subject rights under the law, including but not limited to the right to be informed, the right to consent, the right of access, the right to amendment, the right to withdraw consent and other rights under the law.
• Being responsible to Customers and before the law for damage arising from personal data processing due to BONBON’s fault, in accordance with the law.
• Cooperating with competent state authorities in personal data protection and providing necessary information and documents at the lawful request of a competent authority.
• Other obligations as provided by law.

10. RIGHTS AND OBLIGATIONS OF THE DATA SUBJECT

10.1. Rights of the Data Subject

BONBON respects and protects the lawful rights of the Data Subject, including: (1) to be informed about personal data processing activities; (2) to consent or not consent, and to request withdrawal of consent for personal data processing; (3) to view, amend or request amendment of personal data; (4) to request the provision, deletion or restriction of processing of personal data, and to submit a request objecting to personal data processing; (5) to complain, denounce, initiate a lawsuit and claim damages in accordance with the law; (6) to request a competent authority, or an agency, organisation or individual involved in personal data processing, to take measures and solutions to protect their personal data in accordance with the law. Within the scope permitted by law, the Data Subject may exercise their rights by contacting BONBON using the information detailed in Section 12 below.

When exercising their rights, the Data Subject understands and agrees that:

• BONBON maintains measures to protect against unauthorised or unlawful access to and/or destruction, loss or damage of PD, and considers the legitimate interests of the Data Subject and BONBON’s capabilities and systems at any given time. With reasonable efforts, BONBON will act on lawful and valid requests from the Data Subject within capabilities and timeframes consistent with the law;
• Requests of the Data Subject must be made following the processes, procedures and costs set by BONBON and are received at BONBON’s transaction points or through other methods BONBON sets from time to time;
• For security purposes, the Data Subject may need to submit their request in writing or use another method to prove and authenticate their identity. BONBON may require the Data Subject to verify and authenticate their identity before handling the request;
• BONBON has the right to refuse the Data Subject’s request in certain cases: (i) the Data Subject does not follow the sequence and procedures instructed by BONBON; or (ii) BONBON cannot determine the Data Subject’s identity or cannot verify the accuracy and completeness of the PD, and/or the Data Subject does not provide or provides insufficient documents and papers to verify identity and the accuracy and completeness of the PD; or (iii) BONBON assesses that there are signs of forgery, fraud or breach of PD protection; or (iv) there is a dispute (including where there are only signs of one) between the PD Provider and the Data Subject; or (v) the Data Subject does not accept the consequences and damage arising under Section 7.2 of this Policy; or (vi) the law does not permit the Data Subject’s request to be carried out.

BONBON will continue to store and will not delete PD in the following cases:

• The law does not permit deletion of the data (such as legal retention-period requirements and regulations on the safety and security of information systems under the law);
• The PD is processed by a competent state authority for the purposes of serving the operation of the state authority in accordance with the law;
• The PD has been disclosed in accordance with the law.

10.2. Obligations of the Data Subject/Customer

• To comply with the law, the Policy and BONBON’s regulations and instructions relating to the processing of the Data Subject/Customer’s PD.
• To provide complete, truthful and accurate PD and other information and documents at BONBON’s request when registering and using the P&S; to be responsible for information, data and consents it creates or provides in the online environment; to promptly notify and update all changes and errors in the PD provided to BONBON together with documents evidencing the amendment or change of PD; and to bear full responsibility for losses and damage arising because the Data Subject/Customer provided inaccurate information, failed to notify changes in a timely manner, or committed fraudulent, forged, abusive or unlawful acts due to the Data Subject/Customer’s fault.
• To protect their own PD; to proactively apply measures to protect their PD while using the P&S; not to share, provide, facilitate or allow others to access or use the login name and/or password issued by BONBON to the Data Subject/Customer, and to sign in to the account only on trusted devices; to be responsible where PD is leaked or infringed due to their own fault; and to promptly notify BONBON upon discovering or suspecting that their PD has been infringed or may be infringed, or any breach of PD protection under this Policy of which the Data Subject/Customer may become aware.
• If the Data Subject/Customer provides another person’s PD to BONBON, the Data Subject/Customer must obtain that person’s permission and must explain and ensure that the person understands how BONBON uses their PD.
• To regularly keep up to date with BONBON’s PD processing regulations and policies notified to the Data Subject/Customer from time to time or published on BONBON’s official website (https://bonbon.com.vn/ or BONBON’s mobile application). To take actions per BONBON’s instructions to clearly express full consent, partial consent, conditional consent or non-consent with respect to the PD processing purposes that BONBON notifies to the Data Subject/Customer from time to time.
• To respect and protect the PD of others; to participate in disseminating and popularising PD protection skills; and to participate in preventing and combating acts violating PD protection regulations.
• To cooperate with BONBON, competent state authorities or third parties where issues arise affecting the PD of the Data Subject/Customer.
• To comply with the law on personal data protection and to participate in preventing and combating personal data infringement.
• Other obligations as provided by law.

10.3. When exercising their rights and obligations, the Data Subject must fully comply with the following principles:

• a) To act in accordance with the law and comply with the obligations of the data subject under contract. The exercise of the data subject’s rights and obligations must aim to protect the lawful rights and interests of that data subject;
• b) Not to cause difficulty or obstruction to the exercise of the legal rights and obligations of the personal data controller, the personal data controller and processor, or the personal data processor;
• c) Not to infringe the lawful rights and interests of the State, agencies, organisations or other individuals.

11. MEASURES TO ENSURE INFORMATION SECURITY AND PROTECT CUSTOMER PD

• Implementing, reviewing and updating management, physical and electronic measures to protect the Data Subject/Customer’s PD from unauthorised access, processing, destruction or deletion.
• Recording and storing system logs of the PD processing process;
• Notifying violations of PD protection regulations in accordance with the law;
• Selecting PD Processors appropriate to clear tasks and working only with PD Processors that have signed confidentiality agreements/commitments regarding information (including PD) with BONBON.
• Cooperating with the Ministry of Public Security and competent state authorities in PD protection, and providing information for the investigation and handling of acts violating the law on PD protection.

12. HOW TO CONTACT BONBON

If the Data Subject/Customer has any request or question relating to this Policy, please contact BONBON by any of the following means:

• Contact directly at the head office or by post to the following address: 68 Nam Ky Khoi Nghia, Xuan Hoa Ward, Ho Chi Minh City, Vietnam;
• Contact by email: support@bonbon.com.vn.

After receiving a request, BONBON will guide the Data Subject/Customer to complete the dossier and procedures in accordance with BONBON’s regulations and the law.

13. ACKNOWLEDGEMENT BY THE DATA SUBJECT/CUSTOMER

The Data Subject/Customer understands and agrees that, by accepting this Policy, they have been fully notified and explained by BONBON about BONBON’s PD processing activities (including but not limited to notification of the categories of PD; sensitive PD processed; the purposes and methods of PD processing; the organisations and individuals processing PD; the consequences and damage that may occur; and the rights and obligations of the Data Subject), and they understand and agree to all the contents set out in this Policy. The Data Subject/Customer agrees that BONBON does not need to notify again before processing PD or handling a request to withdraw the Data Subject’s consent.

This Personal Data Protection Policy takes effect from 25 October 2026.