1. Introduction

Intage Vietnam Co., Ltd. (hereinafter referred to as “Intage” or the “Company”) is committed to respecting the privacy and protecting the personal data of relevant individuals in accordance with the laws of Vietnam.

This Privacy and Personal Data Protection Notice (the “Notice”) is issued to provide individuals with information on how the Company collects, records, stores, uses, analyses, shares, transfers, retains and carries out other processing activities in respect of personal data in the course of providing market research services, consumer surveys, management of websites, platforms and applications, as well as other lawful business activities.

This Notice also helps individuals understand their rights and obligations relating to personal data under applicable law.

2. Scope of Application

This Notice applies to the processing of personal data of the following subjects:

a) Visitors to the Company’s website;
b) Users of platforms, applications or online services managed or operated by the Company;
c) Respondents participating in surveys, market research, consumer research or other research activities organised or conducted by the Company;
d) Members of consumer programmes (Consumer Panel) or other programmes of the Company;
e) Customers, prospective customers, partners, suppliers and individual representatives of organisations that transact or communicate with the Company;
f) Other individuals whose personal data is processed by the Company in accordance with applicable law.

Where the Company requests a data subject to confirm consent through a Personal Data Processing Consent Form or another electronic form, this Notice and the Consent Form shall be understood as documents that supplement each other. In the event of any difference concerning a specific data processing activity, the content of the Consent Form or the specific notice shall prevail in respect of that activity.

3. Definitions

3.1. “Company” means Intage Vietnam Co., Ltd., including its affiliated units (if any), being the organisation carrying out the processing of personal data in accordance with applicable law.

3.2. “Data Subject” means an individual whose personal data is processed by the Company.

3.3. “Personal Data” means information in the form of symbols, letters, numbers, images, sounds or similar forms in the electronic environment that is associated with a particular individual or helps identify a particular individual in accordance with applicable law.

3.4. “Personal Data Processing” means one or more activities affecting personal data, including but not limited to collection, recording, analysis, verification, storage, modification, combination, access, use, disclosure, sharing, transmission, provision, transfer, encryption, decryption, copying, deletion, destruction or other activities in accordance with applicable law.

3.5. “Website” means the official website and domain names owned or managed by the Company.

3.6. “Platform” means any website, application, electronic information portal, survey system, software, membership programme, online tool or any electronic platform managed or operated by the Company.

3.7. “Respondent” means an individual participating in surveys, interviews, group discussions, market research or other research activities conducted by the Company.

4. Categories of Data Processed

Depending on the purpose of personal data processing, the Company may collect and process the following categories of personal data:

4.1. Basic personal data means personal data reflecting common identity and background elements frequently used in transactions and social relations, falling within the list issued by the Government, including but not limited to:

Surname, middle name and birth name, other names (if any);
Date of birth; date of death or disappearance;
Gender;
Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current residence, hometown, contact address;
Nationality;
Personal images;
Telephone number, personal identification number, passport number, driving licence number, vehicle registration number;
Marital status;
Information on family relationships (parents, children, spouse);
Information on the individual’s digital accounts.

4.2. Sensitive personal data means personal data associated with an individual’s privacy which, if infringed, will directly affect the lawful rights and interests of agencies, organisations or individuals, falling within the list issued by the Government, including but not limited to: health status; biometric data and genetic characteristics; an individual’s location determined through location services; data on financial, credit and insurance information, and other similar data.

5. Methods of Personal Data Processing

a) Sources of collection

The Company may collect personal data from one or more of the following sources:

a) Directly from the Data Subject when the Data Subject accesses the Company’s website, uses the Company’s applications or platforms, registers an account, contacts the Company, or participates in market research programmes, surveys, interviews, group discussions and other activities organised by the Company;
b) From customers, partners or lawful third parties who provide such data to the Company for the performance of services or for personal data processing purposes in accordance with applicable law;
c) From the Data Subject’s use of the Company’s website, applications or platforms, including through cookies, system logs, device information and similar technologies in accordance with applicable law;
d) From security cameras installed at the Company’s head office, offices and research locations;
e) From public sources or other lawful sources in accordance with applicable law.

b) Processing methods

Personal data is processed by the Company by manual means, electronic means, or a combination of manual and electronic means. In the course of conducting research activities, the Company may use information technology systems, software, applications and platforms owned by the Company or provided by other suppliers and licensed to the Company, depending on the requirements and implementation methods of each research programme.

Where systems, software, applications or platforms provided by other suppliers are used, personal data may be entered, stored, transmitted or processed on the systems of such suppliers to the extent necessary to carry out the research programme.

c) Individuals and organisations carrying out personal data processing

The Company (including employees and personnel of Intage who are engaged, assigned or tasked with processing respondents’ personal data);
Companies providing services related to Intage’s operations, including but not limited to providers of postal, telecommunications, information technology, technical support and data centre services;
Companies providing payment services and services related to payment transactions through electronic information pages and applications;
Companies providing accounting, auditing, valuation and appraisal services, law firms and other advisory units;
Individuals, organisations, competent state authorities or other third parties to whom Intage is permitted or required to disclose data in accordance with applicable law and/or lawful agreements.

6. Purposes of Processing

The Company processes personal data for one or more of the following purposes:

Managing registration for, access to and use of the website, applications or platforms;
Improving the quality of services, the website, applications and platforms, and enhancing user experience;
Inviting Data Subjects to participate in survey projects, market research and consumer research, and managing the respondent database;
Contacting Data Subjects to verify information, screen respondents, provide guidance on survey participation, or resolve matters arising during survey participation;
Providing gifts or other incentives to respondents who have participated in survey projects;
Conducting surveys, market research, consumer research and other research projects;
Analysing data, consolidating research results and preparing reports for customers in the form of statistics or anonymised and aggregated data in accordance with applicable law and agreements with customers;
Preventing fraud, verifying survey validity, controlling respondent quality, and ensuring the accuracy and reliability of research data;
Ensuring information safety and system security, and preventing and detecting unauthorised or unlawful access or use;
Performing the Company’s legal obligations in accordance with applicable law;
Resolving disputes, complaints, or requests from competent state authorities;
Other lawful purposes in accordance with applicable law.

7. Processing of Children’s Personal Data

7.1. The Company processes children’s personal data only in accordance with applicable law and on the basis of safeguarding the lawful rights and interests of children.

7.2. Where a research programme involves the collection and processing of children’s personal data, the Company will provide notification, seek opinions or obtain the consent of the child’s parents, guardian or legal representative in accordance with applicable law and appropriate to the child’s age and level of maturity.

7.3. The Company applies appropriate technical and managerial measures to protect children’s personal data and limits the collection and processing of personal data beyond the scope necessary for the purposes of the research project.

7.4. The Company does not process children’s personal data for purposes contrary to applicable law or that adversely affect the lawful rights and interests of children.

8. Sharing of Personal Data

The Company may share the personal data of Data Subjects with the following organisations and individuals to the extent necessary to fulfil the data processing purposes and in accordance with applicable law:

a) The Company’s parent company, subsidiaries, affiliates or member units (if any);
b) The Company’s customers, to the extent necessary to perform market research services;
c) Service providers and partners supporting the Company in providing services or operating systems;
d) Third parties to whom the Data Subject has consented or for whom there is a legal basis for sharing personal data;
e) Competent state authorities in accordance with applicable law.

9. Transfer of Personal Data

9.1. The Company may transfer personal data to organisations and individuals inside or outside the territory of Vietnam where such transfer is necessary to fulfil the personal data processing purposes set out in this Notice or as required by applicable law.

9.2. The transfer of personal data, including cross-border transfers of personal data outside the territory of Vietnam, is carried out by the Company in accordance with applicable law.

9.3. The Company applies appropriate technical and managerial measures to ensure the safety and security of personal data during transfer, and to prevent unauthorised access, use, disclosure, modification or destruction of data.

10. Personal Data Retention Period

The Company retains personal data for the period necessary to fulfil the personal data processing purposes set out in this Notice, unless otherwise provided by law or unless the Data Subject makes a different request consistent with applicable law.

Upon expiry of the retention period, or when personal data is no longer necessary for the processing purposes, the Company will delete or destroy such data, or apply appropriate measures so that the personal data can no longer identify the Data Subject, unless otherwise provided by law.

11. Protection of Personal Data

The Company undertakes to apply appropriate technical and managerial measures to ensure the safety and security of personal data throughout the personal data processing process in accordance with applicable law.

The personal data protection measures applied by the Company are intended to prevent unauthorised access to, collection, use, disclosure, modification, transmission or destruction of personal data, as well as other violations that may affect the confidentiality, integrity and availability of personal data.

The Company regularly reviews, assesses and updates its personal data protection measures to remain appropriate to its data processing activities and to legal requirements.

12. Rights of Data Subjects

The Company respects and ensures the full exercise of Data Subjects’ rights under the law on personal data protection, including but not limited to:

The right to be informed about personal data processing activities: the Data Subject has the right to be fully informed of the processing of their personal data before giving consent or before their personal data is processed in accordance with applicable law.
The right to consent and to withdraw consent to personal data processing: where personal data is processed on the basis of consent, the Data Subject may withdraw such consent to the processing at any time.
The right to access, view, correct or request updates to personal data: the Data Subject may request information about the personal data relating to them that has been stored, how such data was collected, and the purposes of processing. If the personal data is inaccurate or incomplete, the Data Subject has the right to request correction or supplementation.
The right to request deletion, destruction or de-identification of personal data in accordance with applicable law: the Data Subject has the right to request the Company to delete, destroy or de-identify the personal data previously provided.
The right to request restriction of, or to object to, personal data processing: the Data Subject has the right to request restriction of, or to object to, the processing of their data, and this right must be considered where their interests require protection outweighing those of the data controller due to particular personal circumstances. This right does not apply where the data processing is mandatory under applicable law.
The right to request the provision of personal data in accordance with applicable law: the Data Subject may request the Company to provide them with their own personal data that the Company is processing or retaining in accordance with applicable law.
The right to complain, denounce or initiate legal proceedings in accordance with applicable law: the Data Subject has the right to complain, denounce or initiate legal proceedings in accordance with applicable law where there are grounds to believe that the processing of their personal data violates the law or infringes their lawful rights and interests. The Company will cooperate with competent authorities and provide necessary information in accordance with applicable law during the resolution of the matter.
The right to claim compensation for damages in accordance with applicable law where there is a violation relating to personal data: the Data Subject has the right to claim compensation for damages in accordance with applicable law where there are grounds to believe that the processing of personal data violates the law and causes damage to their lawful rights and interests. The determination of liability for compensation, the amount of compensation and the resolution procedures shall be carried out in accordance with applicable law.
Other rights of Data Subjects in accordance with applicable law.

13. Contact Details of the Personal Data Protection Officer

Email: baovedulieucanhan@intage.com.vn

Telephone: (+84) 28 3820 5558

Address: Citilight Tower, 45 Vo Thi Sau, Tan Dinh Ward, Ho Chi Minh City, Vietnam

14. Amendments to this Notice

The Company reserves the right to amend and update this Notice to reflect changes in its business operations or in applicable law.

The latest version of this Notice will be published on the Company’s website, applications or official information channels and takes effect from the time of publication, unless otherwise provided.

Version 1.0 — Effective from 29/09/2026

This is an English translation for reference only. In case of any discrepancy, the Vietnamese version shall prevail.

Privacy Notice and Personal Data Protection