Terms and Conditions on Personal Data Protection

These Terms and Conditions on Personal Data Protection, hereinafter referred to as the “Terms and Conditions”, form an integral part of the Transaction Agreements entered into between PVcomBank and the Data Provider. These Terms and Conditions govern the relationship between PVcomBank and the Data Provider in relation to, or arising from, the Processing of Personal Data and the protection of Personal Data when the Data Provider conducts Transactions with PVcomBank through Vietpass or other services provided by PVcomBank.

The Data Provider is responsible for carefully reading these Terms and Conditions before agreeing or refusing to agree. By agreeing to these Terms and Conditions, the Data Provider acknowledges that they have read, fully understood, and completely agreed to all contents herein. If the Data Provider does not agree to these Terms and Conditions, or agrees only to part of these Terms and Conditions, the Data Provider may submit a written notice to PVcomBank’s head office specifying the parts with which they disagree. In such case, PVcomBank shall have the right to consider whether to continue providing the Services, refuse to provide the Services, or terminate the Transaction Agreements, depending on PVcomBank’s policies and applicable laws from time to time.

Part A. Definitions

Part B. Terms and Conditions on Personal Data Protection

1. Types of Personal Data Processed by PVcomBank

1.1 Personal Data provided by the Data Provider

PVcomBank may Process any Personal Data provided by the Data Provider when registering, logging in, interacting through PVcomBank’s available interaction channels or third-party channels, using PVcomBank’s Services, using Vietpass, or performing Transaction Agreements. Such activities may include, without limitation, conducting transactions, participating in contests, games, programs or events, using biometric features for personal identification or transaction authentication, making contact, submitting complaints, completing surveys, or participating in investigations.

Where the Data Provider is not the Data Subject, the Data Provider shall be responsible for ensuring that all necessary consents and approvals from the Data Subject have been duly obtained in accordance with applicable laws. This includes, without limitation, circumstances involving children, persons who have lost or have limited civil act capacity, or persons with difficulties in cognition or behavior control, where legal representatives shall exercise the Data Subject’s rights unless otherwise prescribed by law. The Data Provider undertakes to provide evidence proving the authenticity and accuracy of the declared Personal Data upon PVcomBank’s request.

1.2 Personal Data automatically collected by PVcomBank

PVcomBank may automatically Process Personal Data when the Data Provider uses the Services, uses Vietpass, performs Transaction Agreements, or conducts activities during the use of the Services. Such data may include, without limitation, information on service providers, transaction information such as product or service type, location and time of transaction, payment method, application and device information, IP address, software, operating system, location, browser type, referring or visited website, mobile applications, access frequency, feedback, versions, advertising formats, and other related information.

Personal Data may also be automatically collected where such information or data has been publicly disclosed through mass media or other sources accessible to the public.

1.3 Data generated through the Data Provider’s activities

PVcomBank may Process Personal Data generated through the Data Provider’s activities during the use of the Services or performance of Transaction Agreements. Such data may include utility usage, searches, videos viewed, interaction with advertising content, third parties contacted or shared with, purchase activities, and similar data.

PVcomBank may also Process Personal Data through cookies used on PVcomBank’s websites, online services, interactive applications, Vietpass, and third-party services.

1.4 Information and data from other lawful sources

In certain cases, PVcomBank may Process Personal Data from publicly accessible sources, including information available on websites and social networks. Personal Data may also be collected from Data Processors, third parties, competent state authorities, commercial partners, service providers, referral partners, anti-fraud or crime-prevention partners, advertising service providers, and other lawful sources.

When collecting Personal Data from other sources, PVcomBank shall ensure that such data is transferred to PVcomBank in accordance with applicable laws.

2. Purposes of Personal Data Processing

PVcomBank Processes Personal Data for purposes including, without limitation:

  1. Ensuring the provision and operation of the Services, including Vietpass, and the performance of Transaction Agreements in compliance with applicable laws.
  2. Providing, personalizing, maintaining, and improving the Services.
  3. Providing Services to the Data Provider and introducing new services of PVcomBank or PVcomBank’s partners based on the Data Provider’s needs and habits.
  4. Processing transactions and requests, creating, administering, and updating accounts, verifying information, authenticating identity, and performing customer identification procedures as required by law.
  5. Managing, operating, providing, and administering the Data Provider’s use of the Services.
  6. Confirming transactions and performing payments.
  7. Processing and managing rewards, prizes, and incentives.
  8. Performing necessary activities to provide the Services, including fixing software errors and operational incidents.
  9. Conducting data analysis, testing, research, monitoring, and analysis of usage trends and activities on PVcomBank platforms or Personal Data Processor platforms.
  10. Displaying personalized experience features, identifying preferences and interests, suggesting Services, and enabling interaction between Data Providers, PVcomBank, and linked partners.
  11. Conducting surveys, market research, service analysis, usage measurement, performance analysis, and service improvement and development.
  12. Supporting the processing of requests and assistance for the Data Provider, including storing calls, messages, recordings, videos, or other forms of communication to improve service quality.
  13. Conducting research and development, including data analysis, surveys, product and service development, profiling, and improvement of security, safety, and confidentiality.
  14. Marketing and promotion, including contacting the Data Provider by email, telephone, messaging services, online messages, or other lawful means regarding PVcomBank’s Services or partner products and services.
  15. Ensuring and enhancing safety and security, including fraud prevention, crime prevention, system security, storage, management, backup, disaster recovery, and similar purposes.
  16. Preventing money laundering, terrorist financing, corruption, fraud, and managing risk, including detecting and preventing identity fraud, illegal activities, misconduct, deception, or omissions related to the Services.
  17. Complying with legal and regulatory obligations, including statutory reporting and transaction data retention.
  18. Other lawful purposes consistent with the objectives of the Services, Transaction Agreements, and applicable laws.

Where specific Services or purposes require separate Consent from the Data Subject, PVcomBank shall request such Consent and shall only Process Personal Data after such Consent has been obtained, unless otherwise permitted by law.

3. Organizations and Individuals Permitted to Process Personal Data; Retention Period

Personal Data Processing may be conducted directly by PVcomBank or through permitted Data Processors in accordance with applicable laws and PVcomBank’s regulations. PVcomBank has the right to select Data Processors and enter into contracts or agreements on Personal Data Processing without requiring any further approval from the Data Provider.

The Data Provider agrees that Data Processors shall have corresponding rights and obligations within the scope of PVcomBank’s rights and obligations under these Terms and Conditions and applicable laws.

Personal Data shall be stored from the time PVcomBank Processes the Data Subject’s Personal Data until PVcomBank deletes or destroys such Personal Data, or for such other period as prescribed by law.

3A. Specific Third-Party Service Providers

To deliver certain features within Vietpass, PVcomBank engages the following third-party service providers who may process Personal Data on behalf of PVcomBank or as independent controllers:

a) Customer Support Chat Service (South Telecom)

Vietpass provides 24/7 customer support through a chat service operated by South Telecom Joint Stock Company (“South Telecom”). When the Data Provider accesses the chat support feature, the following data is shared with South Telecom:

South Telecom processes this data to provide real-time customer support, including AI-assisted responses and routing to human support agents. South Telecom is contractually required to protect Personal Data in accordance with applicable data protection laws and may not use the data for purposes other than providing customer support services to Vietpass users.

The Data Provider is informed and agrees that by using the chat support feature, the above-listed data will be shared with South Telecom for the purpose of providing customer support services.

b) Application Stability and Diagnostics (Google Firebase)

Vietpass uses Google Firebase Crashlytics to monitor application stability and diagnose technical issues. The following data is collected:

This data is processed by Google LLC in accordance with Google’s data processing terms and is used solely for improving application stability and performance.

c) Push Notifications (Google Firebase Cloud Messaging)

Vietpass uses Google Firebase Cloud Messaging to deliver push notifications. Device tokens are shared with Google LLC to route notifications to the correct device. No personal content is exposed to Google through this service.

d) Identity Verification and Liveness Detection (Amazon Web Services)

During the account opening process (KYC), Vietpass uses Amazon Web Services (AWS) Rekognition for face liveness verification. A live video stream of the Data Provider’s face is processed by AWS to confirm the person is physically present. AWS processes this data in accordance with the AWS Data Processing Addendum and does not retain biometric data beyond the duration of the verification session.

4. Withdrawal of Consent; Restriction and Objection to Processing; Correction, Deletion, Destruction, and De-identification

After agreeing to these Terms and Conditions, the Data Subject has the right, during the use of the Services or performance of Transaction Agreements, to withdraw Consent, request restriction of or object to Personal Data Processing, and request correction of Personal Data. PVcomBank shall carry out necessary procedures to terminate, restrict, or correct Personal Data Processing within the scope and timeframe requested, provided that the Data Subject has properly completed the procedures for initiating a valid request.

A request shall be considered valid if all of the following conditions are satisfied:

  1. It is made at PVcomBank’s head office, branch, transaction office, or through other channels deployed by PVcomBank from time to time.
  2. It is made during PVcomBank’s prescribed transaction hours and working days.
  3. It is made by the Data Subject or their lawful representative.
  4. It is not intended for purposes contrary to law, including harming national defense, national security, social order, or the health or safety of another person.
  5. It is made in writing using PVcomBank’s prescribed form, or in another verifiable electronic or lawful format.
  6. All relevant fees and costs have been fully and timely paid in accordance with PVcomBank’s fee schedule.
  7. Other conditions prescribed by PVcomBank from time to time are satisfied.

PVcomBank may refuse to implement any request that does not meet the valid-request conditions. Where the request is valid, PVcomBank shall perform the necessary procedures to terminate, restrict, or correct Personal Data Processing in accordance with applicable laws. Where PVcomBank is not the direct Personal Data Processor, PVcomBank shall notify the relevant Personal Data Processor to perform the requested actions and shall notify the Data Provider of the result after completion.

The Data Subject agrees that implementation by a Personal Data Processor other than PVcomBank depends on the necessary and appropriate actions of such processor. The Data Subject releases PVcomBank from disputes or liabilities relating to such processor’s failure to perform, incomplete performance, or delayed performance of valid requests, except where PVcomBank fails to timely and properly transmit the valid request.

Withdrawal of Consent, restriction or objection to Processing, or correction of Personal Data shall not affect the lawfulness of Personal Data Processing conducted before PVcomBank or the relevant Data Processor completed the termination, restriction, or correction.

The Data Subject shall understand the legal consequences of withdrawal, restriction, objection, or correction requests. Such requests may result in legal consequences or damages for PVcomBank, including violation of law if Services continue, breach of agreements with processors, economic loss, compensation, penalties, or termination of contracts. PVcomBank may, upon reasonable assessment, unilaterally terminate one, several, or all Services or Transaction Agreements where necessary. The Data Subject shall reimburse PVcomBank for damages arising under this provision immediately and unconditionally upon PVcomBank’s request.

4.1 Deletion and destruction of Personal Data

Personal Data may be deleted or destroyed in the following cases:

  1. The Data Subject requests deletion and accepts the risks and damages that may arise.
  2. The purpose of Personal Data Processing has been completed.
  3. The statutory retention period has expired.
  4. A competent state authority issues a decision requiring deletion or destruction.
  5. Deletion or destruction is carried out pursuant to an agreement.
  6. Other cases prescribed by law.

Deletion or destruction shall not apply where:

  1. The law does not permit deletion of Personal Data.
  2. Processing is necessary to protect life, health, honor, dignity, rights, or lawful interests of the Data Subject or another person in urgent circumstances.
  3. Processing is necessary to resolve emergencies, protect national security, prevent riots, terrorism, crimes, or legal violations.
  4. Processing serves state agency operations or state management activities as prescribed by law.
  5. Processing is required to perform an agreement between the Data Subject and PVcomBank or relevant parties.
  6. Other cases prescribed by law.

4.2 De-identification of Personal Data

  1. The Personal Data Processor shall strictly control and supervise the de-identification process and prevent unauthorized access, copying, appropriation, disclosure, or loss of Personal Data.
  2. Personal Data that has been de-identified shall not be re-identified, unless otherwise prescribed by law.
  3. De-identification shall comply with the Personal Data Protection Law and other relevant laws.

5. Provision of Personal Data

The Data Subject has the right to request, and PVcomBank undertakes to provide, Personal Data to the Data Subject once the Data Subject has properly completed the procedures for initiating a valid request.

A request for provision of Personal Data shall be considered valid if:

  1. The form of request complies with applicable laws and PVcomBank’s regulations.
  2. The request is made during PVcomBank’s transaction hours and working days.
  3. The request is made by the Data Subject or their lawful representative.
  4. The request is made in writing using PVcomBank’s prescribed form.
  5. The request is not intended for unlawful purposes.
  6. The Data Subject has fully and timely paid all relevant fees under PVcomBank’s fee schedule.
  7. Other conditions prescribed by PVcomBank from time to time are satisfied.

PVcomBank may refuse to provide Personal Data where the request is invalid or where provision may be prohibited by law, harm national defense or security, disrupt social order, or infringe upon the life, health, or property of another person.

6. Undertakings of the Data Provider

  1. The Data Provider agrees to permit PVcomBank to conduct one or more Personal Data Processing activities with respect to the Personal Data specified herein, including Basic Data and Sensitive Data, for the purposes stated herein.
  2. The Data Provider unconditionally and irrevocably agrees that PVcomBank may provide Personal Data to Personal Data Controllers and other Personal Data Processors where legally permitted, necessary for service provision, required for transactions, or where such data has been publicly disclosed.
  3. The Data Provider unconditionally and irrevocably authorizes PVcomBank to perform necessary procedures on behalf of the Data Provider where Personal Data Processing is conducted through a Data Processor.
  4. The Data Provider accepts that PVcomBank may determine appropriate forms of Personal Data Processing, including automated Processing by electronic means and Cross-Border Transfer of Personal Data, in accordance with applicable laws and these Terms and Conditions.
  5. The Data Provider acknowledges that Processing conducted before the effective date of these Terms and Conditions, if any, was lawful, undisputed, and releases PVcomBank from related claims or disputes.
  6. Consent to Personal Data Processing shall remain effective from the effective date of these Terms and Conditions until Processing is terminated or restricted in accordance with these Terms and Conditions, by competent authority request, or as otherwise prescribed by law.
  7. The Data Provider acknowledges that Personal Data may be Processed at any time after agreement to these Terms and Conditions without further approval, including Sensitive Data where permitted by law.
  8. The Data Provider acknowledges that although PVcomBank applies necessary security measures, Personal Data Processing may still involve risks beyond PVcomBank’s reasonable control, including force majeure events, system incidents, technical infrastructure incidents, or Data Processor errors.
  9. The Data Provider understands that Personal Data may be used not only for a specific Service but also for multiple Services, including future Services.
  10. The Data Provider undertakes that all Personal Data declared or provided to PVcomBank is truthful and accurate and shall bear full responsibility for such data.
  11. The Data Provider shall cooperate with PVcomBank in verifying compliance with these Terms and Conditions and supporting PVcomBank’s legal obligations.
  12. The Data Provider shall properly and fully perform all other rights and obligations under applicable laws and these Terms and Conditions.

7. Undertakings of PVcomBank

  1. PVcomBank shall notify and obtain the Data Subject’s approval or Consent before Processing Personal Data in cases not covered by these Terms and Conditions, unless notification and Consent are not required by law.
  2. PVcomBank is not required to notify or obtain Consent where Processing is necessary to protect life, health, honor, dignity, rights, or lawful interests in urgent cases; resolve emergencies; protect national security; prevent crimes; serve state management activities; perform agreements; or in other cases prescribed by law.
  3. Within its reasonable capability, PVcomBank shall apply organizational, technical, and storage measures to ensure safety and confidentiality and protect Personal Data against unauthorized collection, loss, destruction, or damage.
  4. PVcomBank shall require Data Processors to enter into contracts or agreements committing to comply with data protection obligations, including appropriate storage, protection against unauthorized collection, timely notification of violations, remedial measures, and deletion or return of Personal Data upon termination of the relevant agreement.
  5. PVcomBank shall properly and fully perform all other rights and obligations under applicable laws and these Terms and Conditions.

8. Costs and Payment of Costs

The Data Provider shall be responsible for paying all costs arising from Personal Data Processing requested by the Data Provider or required by law or competent state authorities, including fees listed by PVcomBank, costs for providing, correcting, printing, copying, sending, deleting, destroying, or de-identifying Personal Data, postal charges, courier fees, fax fees, message fees, and other related expenses, unless otherwise provided by law or PVcomBank’s regulations.

Fees, payment methods, and payment times shall be determined by PVcomBank in accordance with PVcomBank’s regulations and applicable laws from time to time.

Part C. General Terms and Conditions

1. Force Majeure

A force majeure event means an event occurring objectively to PVcomBank or the Data Provider that could not be foreseen and could not be prevented or remedied despite the application of all necessary and permissible measures, and that affects the performance of responsibilities under these Terms and Conditions.

Force majeure events include:

  1. War, invasion, armed conflict, foreign enemies, revolution, or terrorism.
  2. Natural disasters, fire, flooding, or satellite signal transmission incidents within the geographic area where the Services are performed.
  3. Internet-related incidents, including interruption, transmission failure, power failure, network or equipment failure, viruses, technical errors, fraud, or other incidents.
  4. Any other event beyond PVcomBank’s control that could not be predicted or prevented despite necessary measures.

PVcomBank shall not be liable for any delay or breach in performing obligations under these Terms and Conditions caused by a force majeure event. Where force majeure prevents PVcomBank from providing Services, PVcomBank shall, within its capability, notify the Data Provider of the event, its expected duration, affected obligations, expected consequences, and remedial measures, if any. PVcomBank may appoint a third party to remedy or assist in remedying the consequences.

2. Notices and Provision of Information

Notices from the Data Provider to PVcomBank shall only be deemed received by PVcomBank if sent in writing during working hours and working days and confirmed as received by PVcomBank. Notices sent outside working hours shall be deemed received on the next working day.

Unless otherwise expressly provided, PVcomBank may send notices and information to the Data Provider by post, hand delivery, fax, telephone, SMS to the registered phone number, email to the registered email address, public posting on PVcomBank’s website at http://www.pvcombank.com.vn, or any other lawful method determined by PVcomBank. Notices by SMS, email, fax, or other electronic means under the Law on Electronic Transactions shall be deemed written notices.

PVcomBank’s notices shall be deemed received as follows:

  1. By post: when the postal or delivery service completes delivery.
  2. By telephone: at the time of notification.
  3. By email or SMS: when sending is completed.
  4. By fax: when fax transmission is completed.
  5. By hand delivery: when the Data Provider receives the notice at the Data Provider’s address.
  6. By website posting or counter posting: when PVcomBank completes the posting.

The Data Provider shall notify PVcomBank of any change to information previously provided. Failure or delay in notifying PVcomBank shall result in such information remaining effective, and the Data Provider shall bear all consequences arising therefrom.

3. Termination of Use of Services

Where the Data Provider performs acts causing PVcomBank to terminate one, several, or all Services or Transaction Agreements under these Terms and Conditions, the Data Provider agrees and acknowledges that such acts constitute a breach allowing PVcomBank to unilaterally terminate the relevant Transaction Agreements, regardless of whether such breach has been expressly stated in those Transaction Agreements.

4. Effectiveness and Amendment of Terms and Conditions

  1. These Terms and Conditions shall take effect from the date on which the Data Provider agrees to them by any method.
  2. Upon taking effect, these Terms and Conditions constitute a unified and inseparable agreement with legal validity equivalent to the Transaction Agreements entered into between PVcomBank and the Data Provider.
  3. Where changes in law, guidance of the State Bank of Vietnam, or PVcomBank’s internal regulations result in differences from these Terms and Conditions, the Data Provider agrees that PVcomBank may automatically apply such changes and publish the adjusted terms on its website.
  4. Amendments and supplements shall take effect from the date on which the amended Terms and Conditions are successfully posted and notified on PVcomBank’s website.
  5. If the Data Provider does not agree with amendments or supplements, the Data Provider shall notify PVcomBank to agree on termination of the relevant Services.
  6. Continued use of the Services after amended Terms and Conditions are posted and notified shall constitute the Data Provider’s full acceptance of such amendments and supplements.

5. Governing Law and Dispute Resolution

These Terms and Conditions shall be governed by the laws of Vietnam. If any provision is declared invalid by a competent state authority or due to a change in law, the remaining provisions shall remain valid and binding upon the parties.

Any dispute arising out of or relating to these Terms and Conditions shall first be resolved through negotiation between the Data Provider and PVcomBank. If negotiation or mediation fails, the parties agree that PVcomBank may choose either:

  1. Dispute resolution by a competent court; or
  2. Dispute resolution by any commercial arbitration center selected by PVcomBank.

Where PVcomBank selects arbitration, the parties agree to comply with the arbitration rules of the selected arbitration center. The arbitral tribunal shall consist of one sole arbitrator appointed by the chairperson of such arbitration center.

6. Implementation Provisions

  1. Matters not provided for in these Terms and Conditions shall be implemented in accordance with relevant contracts, agreements on the provision of Services entered into between PVcomBank and the Data Provider, PVcomBank’s regulations, and applicable laws.
  2. These Terms and Conditions may be made in Vietnamese and foreign-language versions. In the event of any inconsistency between the Vietnamese version and any foreign-language version, the Vietnamese version shall prevail.