Privacy Policy

1. Purpose

1.1. This Personal Data Protection Policy (“Policy”) establishes the framework and requirements for the collection, processing, use, storage, disclosure, transfer and protection of Personal Data by the Company.

1.2. The Policy is established to ensure that Personal Data processed by the Company is handled in a lawful, fair, transparent, secure and accountable manner, in compliance with the Applicable Laws.
1.3. The objectives of this Policy are to:

protect the lawful rights and interests of Data Subjects;
establish principles and requirements governing the processing of Personal Data throughout its lifecycle;
ensure that Personal Data is processed for specific, clear and lawful purposes and only to the extent necessary for such purposes;
establish appropriate organizational, technical and human measures to protect Personal Data against unauthorized access, collection, use, disclosure, alteration, loss, destruction or other unlawful processing;
establish appropriate mechanisms for identifying, assessing and managing Personal Data protection risks, including risks arising from third-party service providers and cross-border transfers;
ensure that the Company fulfils its legal obligations relating to consent, notification, Data Subject rights, impact assessments, Personal Data Breaches, records, retention and other applicable requirements;
establish clear responsibilities and accountability for employees, departments, contractors, Personal Data Processors and other persons involved in the processing of Personal Data.

1.4. This Policy is a general framework and shall be implemented together with applicable consent forms, procedures, guidelines, contractual requirements, information security policies and other internal documents governing specific Personal Data processing activities promulgated by the Company from time to time.

2. Scope of Application

2.1. This Policy applies to:

The Company, and all departments, business units and functions of the Company;
all employees, secondees, temporary staff and interns of the Company;
contractors, consultants and other persons acting on behalf of the Company to the extent they process Personal Data for or on behalf of the Company; and
Personal Data Processors, service providers and other third parties engaged by the Company where their activities involve the processing of Personal Data on behalf of or in connection with the Company.

2.2. This Policy applies to all Personal Data processed by the Company, regardless of the form or medium in which such data is collected or stored, including electronic and physical records. The Personal Data may relate to, among others:

casino patrons, guests, customers and visitors;
Hoiana Premier Rewards members or other membership programme members;
employees, former employees and job applicants;
suppliers, contractors, business partners and their representatives;
emergency contacts and persons connected with Data Subjects; and
other individuals whose Personal Data is processed by Company in connection with its business activities.

3. Definitions

For the purpose of this Policy, the following terms shall be construed as follows:

‍
3.1. “Applicable Laws” means all applicable laws, statutes, codes, regulations, decrees, circulars, directives, decisions, guidelines, standards, orders, judgments, and other legally binding requirements issued by any competent authorities from time to time, including those relating to personal data protection, cybersecurity, information security, privacy, and any other laws applicable to the Company’s business operations and processing of Personal Data.
3.2. “Basic Personal Data” means personal data reflecting common personal details and background information, frequently used in transactions and social relations, including: Full name, another name; Date of birth, date of death or disappearance; Gender; Place of birth, place of origin, permanent address, temporary residence address, current address, contact address; Nationality; Personal picture/photo; Phone number, personal identification number, passport number, driving permit number, vehicle registration number; Marital status; Information on family relationships (parents, children, spouse); Information on an individual’s digital accounts.
3.3. “Company” means Hoi An South Development Ltd, a company duly established and operating under the laws of Vietnam with its Enterprise Registration Certificate No. 4000789705 issued by the Department of Finance of Da Nang City on 10 December 2010, as amended from time to time.
3.4. “Competent Authority” means any governmental, regulatory, judicial, administrative, or law enforcement authority having jurisdiction under Applicable Laws, including the authority responsible for personal data protection and cybersecurity matters in Vietnam.
3.5. “Data Protection Officer” or “DPO” means qualified individual appointed by the Company from time to time who is responsible for overseeing and monitoring the Company’s compliance with applicable personal data protection laws and regulations, advising the Company on personal data protection matters, coordinating the implementation of data protection policies and procedures, handling personal data breach incidents, serving as the contact point for competent authorities and data subjects where required, and performing such other duties relating to personal data protection as may be assigned by the Company in accordance with applicable laws and internal regulations.
3.6. “Data Subject” refers to person reflected in the Personal Data.
3.7. “Personal Data” means digital data or information in other forms that identifies or assists the identification of a specific individual, including Basic Personal Data and Sensitive Personal Data.
3.8. “Personal Data Protection” refers to when agencies, organizations, and individuals use specific forces, equipment, and measures to prevent and combat infringement on personal data.
3.9. “Personal Data Controller” refers to an agency, organization, or individual that decides on the purposes and means of personal data processing.
3.10. “Personal Data Controller and Processor” refers to an agency, organization, or individual that decides on the purposes and means of personal data processing and directly processes personal data.
3.11. “Personal Data Processing” refers to activities impacting Personal Data, including one or more of the following: collection, analysis, summary, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities impacting Personal Data.
3.12. “Personal Data Processor” refers to an agency, organization, or individual processing Personal Data as requested by the Personal Data Controller or Personal Data Controller and Processor under a contract.
3.13. “Policy” means this Personal Data Protection Policy and its appendixes, amendments and supplementations from time to time.
3.14. “Products” means the products, services, facilities, programmes, activities and experiences provided, operated or managed by the Company from time to time, including hotel accommodation, food and beverage, entertainment, gaming and casino, golf, membership programmes, events, promotions and other products or services provided by or on behalf of the Company.
3.15. “Sensitive Personal Data” means personal data associated with individuals’ privacy rights that, if infringed on, directly affect legitimate rights and benefits of agencies, organizations, and individuals, including: Data concerning racial or ethnic origin; Information relating to private life, personal secrets, and family secrets; Health status; Biometric data and genetic characteristic; Data concerning an individual’s sexual life or sexual orientation; Data relating to criminal offences or legal violations collected and stored by law enforcement authorities; An individual’s location as determined through location-based services; Bank account information, bank cards and transaction history; Usernames and passwords for electronic identification accounts; images of identity cards, citizen identity cards, and identity documents; Data on the monitoring of behavior and activities in the use of telecommunications services, social networks, online communication services, and other services in cyberspace.

4. Types of Personal Data Collected and Processed‍

Depending on how Data Subjects interact with the Company and the Products used, the Company may collect and process the following categories of Personal Data:
4.1. Identification and Contact Data: Full name; date of birth; gender; nationality; passport or identification information and picture; address; telephone number; email address; etc.
4.2. Payment and Transaction Data: credit card and bank account information; credit history and information; tax information; other information necessary for payment, accounting, tax, fraud prevention and regulatory purposes.
4.3. Image, Video and Audio Data: The Company may operate CCTV cameras and other recording systems at its premises for security, safety, operational and other lawful purposes. Accordingly, the Company may collect and process: photographs; CCTV images; video recordings; audio recordings; other visual or audio information.
4.4. Technical and Online Data: When a Data Subject visits the Company’s websites or uses its digital services, the Company may collect: IP address; device information; browser type and version; access date and time; pages viewed; referring website; cookies and similar technologies; other technical information.
4.5. Location Data: Where necessary and permitted by law, the Company may collect or process location-related information associated with a Data Subject’s device or use of the Company’s Products.
4.6. Other Information: The Company may also process information provided by Data Subjects through: enquiries; requests; complaints; feedback; surveys; communications; other interactions with the Company.

5. Purposes of Processing Personal Data

The Company may use the Data Subject’s Personal Data to operate, deliver and improve the Products. The Company’s collection purpose and use scope of Personal Data include:

‍
5.1. Provision of the Products: The Company process the Personal Data as necessary to provide, operate, manage, administer, maintain and improve the Products and to facilitate and administer transactions and interactions relating to the Products, including, without limitation to, registration, reservations, bookings, purchases, payments, participation in programmes, promotions, offers, events and activities, membership management, service requests and communications, and other activities necessary or incidental to the provision of the Products.
5.2. Safety, Security and Loss Prevention: The Company processes the Personal Data as necessary to protect the safety, security and wellbeing of guests, customers, employees, contractors, visitors and other persons, and to safeguard the Company’s property, premises, facilities, systems and operations, including through CCTV and other security measures, access control, security monitoring, incident detection and investigation, emergency response, loss prevention, and the prevention and detection of unlawful, fraudulent or prohibited activities.
5.3. Marketing and Advertising: Subject to Applicable Laws and any applicable consent or other legal requirements, the Company processes the Personal Data for direct marketing, advertising and promotional purposes, including conducting marketing campaigns, delivering targeted or personalized marketing communications, measuring the effectiveness of marketing activities, and developing and evaluating promotional strategies.
5.4. Recruitment and Employment: The Company processes the Personal Data as necessary to recruit, employ, manage and administer employees, job applicants and other personnel, including recruitment and selection, employment administration, performance management, compensation and benefits, training and development, workforce planning, workplace management and compliance with employment-related requirements.
5.5. Regulatory Compliance: The Company processes the Personal Data as necessary to comply with Applicable Laws and lawful requests or orders of competent authorities; to establish, exercise or defend legal rights and claims; to maintain corporate, financial and other required records; and to protect the rights, property, safety and legitimate interests of the Company and other persons, to the extent permitted by Applicable Laws.
5.6. Business Operations and Risk Management: The Company processes the Personal Data as necessary to manage and protect its business operations, including conducting internal audits and reviews, managing risks, detecting and preventing fraud, misconduct and other irregularities, conducting investigations, managing disputes and claims, monitoring compliance with internal policies and procedures, and supporting business continuity and corporate governance.
5.7. Analytics and Business Development: The Company may process the Personal Data, where permitted by Applicable Laws, for statistical, analytical and research purposes, including analysing trends and patterns, assessing business performance, conducting market research, developing business strategies, and supporting the development of new Products, services, technologies and business initiatives.

6. Personal Data Processing‍

6.1. Collection
The Company may collect Personal Data from various lawful sources and through various channels, depending on the nature and purpose of the relevant processing activity, including, without limitation:

Directly from Data Subjects: The Company may collect Personal Data directly from Data Subjects when they voluntarily provide information to the Company, including when registering for membership, purchasing, booking or using the Products, providing information required under a contract or agreement, making enquiries, submitting requests, feedback or complaints, participating in surveys or programmes, or otherwise communicating or interacting with the Company. Such Personal Data may be provided through written forms, electronic forms, email, telephone calls, customer service or call centre communications, messaging or other communication channels.
From the Company’s websites, applications and digital platforms: The Company may collect Personal Data when Data Subjects access, browse, register, make reservations, submit information or otherwise interact with the Company's websites, applications, online platforms and other digital services. The Company may also collect information through cookies and similar technologies, including IP addresses, device identifiers, browsing information, access logs and other technical information generated through such interactions, where applicable.
Through CCTV, access control and other security systems: The Company may collect Personal Data through CCTV cameras, access control systems, security and surveillance systems, visitor management systems and other security technologies operated at the Company’s premises, facilities and areas under its management or control, including images, video recordings, access records and other information generated by such systems.
From third parties: The Company may collect or receive Personal Data from third parties where permitted or required by Applicable Laws, including group companies, business partners, travel agents, booking platforms, service providers, contractors, suppliers, payment service providers, professional advisers and other organizations involved in providing or supporting the Products or related activities.
From competent authorities and other lawful sources: The Company may collect or receive Personal Data from competent authorities, public bodies, publicly available sources or other sources from which the Company is lawfully entitled to obtain Personal Data, where such collection is relevant and necessary for the applicable processing purpose.

The Company will collect Personal Data only by lawful and appropriate means and to the extent relevant and necessary for the applicable processing purpose. Where Personal Data is obtained from a third party, the Company may take reasonable measures, where required by Applicable Law, to verify the lawful basis and legitimacy of such collection, provision or disclosure.

‍
6.2. Storage and Use

Storage. The Company may store Personal Data in physical and electronic forms, including in the Company’s internal information systems, servers, applications, software and other information technology systems used or licensed by the Company, as well as in systems and platforms operated by or on behalf of the Company by its Personal Data Processors and service providers.
Where permitted by Applicable Laws, Personal Data may be stored, hosted or accessed in Vietnam or in other jurisdictions where the Company’s systems, licensed software, cloud services, group companies, Personal Data Processors or service providers operate, subject to applicable requirements concerning cross-border transfers of Personal Data.

Use. The Company shall use Personal Data only for the purposes specified in this Policy, the relevant privacy notices, consent forms, registration or application forms, contracts or agreements, or other applicable documents provided to or agreed with the Data Subject, and for other purposes permitted or required by Applicable Laws. Personal Data shall not be used for purposes that are incompatible with the purposes for which it was collected, unless otherwise permitted or required by law or otherwise lawfully authorized.
Retention. The Company shall retain Personal Data only for as long as necessary to fulfil the relevant processing purposes, perform or administer the relevant contractual or business relationship, comply with applicable legal, regulatory, accounting, tax, licensing or other requirements, establish, exercise or defend legal rights and claims, or for other legitimate and lawful purposes. Specific retention periods may be determined based on the type of Personal Data, the purpose of processing, the nature of the relevant records, applicable legal requirements and the Company’s applicable retention schedules or internal procedures.
Accuracy and Access. The Company shall take reasonable measures to ensure that Personal Data is accurate, complete and up to date to the extent necessary for the relevant processing purpose. Access to Personal Data shall be restricted to authorized persons who have a legitimate business or legal need to access such Personal Data and shall be subject to applicable access controls and confidentiality requirements.

6.3. Disclosure, Provision and Sharing

The Company may disclose, provide or share Personal Data with third parties where such disclosure, provision or sharing is necessary for the relevant processing purposes, permitted or required by Applicable Laws, or otherwise lawfully authorized. Depending on the nature of the relevant processing activity, Personal Data may be disclosed, provided or shared with:

Companies within the Group: Companies within the Company’s corporate group, where necessary for the provision, management, administration or support of the Products, business operations, shared systems or services, or other lawful purposes.

Personal Data Processors: Personal Data Processors engaged by or on behalf of the Company to process Personal Data for and in accordance with the Company’s instructions and for the purposes specified in the relevant arrangements or contracts.

Service providers and contractors: Service providers, contractors and other suppliers engaged by the Company to provide technology, IT, cloud, payment, security, hospitality, marketing, customer support, administrative or other services necessary to support the Company’s Products and operations.

Business partners and other relevant organizations: Business partners, travel agents, booking platforms, and other organizations involved in or supporting the provision or administration of the Products or related activities, where such disclosure, provision or sharing is necessary and lawful.

Professional advisers: Lawyers, auditors, accountants, insurers, consultants and other professional advisers where necessary for the provision of professional services, management of risks, disputes, claims or other legitimate business or legal purposes.

Competent authorities and other lawful recipients: Competent authorities and agencies, courts, and other persons or organizations where disclosure, provision or sharing is required or permitted by Applicable Laws, court order or other lawful requirement, or is necessary to protect the rights, property, safety or legitimate interests of the Company or other persons to the extent permitted by Applicable Laws.

The Company shall limit any disclosure, provision or sharing of Personal Data to the extent relevant and necessary for the applicable purpose and shall take appropriate organizational, contractual and technical measures to ensure that Personal Data is protected against unauthorized access, use, disclosure, alteration, loss or other unlawful processing. The Company shall enter into appropriate agreements or arrangements with relevant recipients and impose appropriate data protection and confidentiality requirements.

Where the disclosure, provision or sharing of Personal Data constitutes a cross-border transfer under Applicable Laws, the Company shall comply with the requirements applicable to such cross-border transfer as set out in Section 11 of this Policy.

6.4. Analysis and Profiling

The Company may analyze and profile Personal Data for lawful and specified purposes, including to understand patterns, trends, preferences and characteristics relating to Data Subjects and their use of the Products. Such activities may include statistical analysis, segmentation, personalization and other analysis necessary for the Company’s lawful business purposes.

The Company shall ensure that any analysis or profiling is conducted in accordance with Applicable Laws and shall implement appropriate measures to protect the rights and legitimate interests of Data Subjects, particularly where such activities may materially affect Data Subjects.

6.5. Cookies and Similar Technologies

The Company’s websites, applications and digital platforms may use cookies, pixels, tags and other similar technologies to collect information about how Data Subjects access and interact with such platforms, including device information, browsing activities, preferences and usage data. Such technologies may be used to enable essential functionality, maintain security, remember preferences, analyze usage and performance, personalize content and support marketing activities, where permitted by Applicable Laws.

Data Subjects may manage, accept, reject or disable certain cookies and similar technologies through their browser settings, cookie preference tools or other mechanisms made available by the Company or relevant third-party providers. Data Subjects may also delete cookies that have already been stored on their devices, subject to the applicable settings and functionality of their browser or device. However, disabling or rejecting certain cookies may affect the availability, performance or functionality of certain features of the Company’s websites and digital platforms.

6.6. Deletion and Destruction

The Company shall delete, destroy or anonymize Personal Data when:

the relevant processing purpose has been fulfilled;

the applicable retention period has expired;

the Data Subject validly requests the deletion or destruction of their Personal Data in accordance with Applicable Laws; or

deletion, destruction or anonymization is otherwise required by Applicable Laws.

Where a Data Subject requests the deletion or destruction of Personal Data, the Company shall assess and process the request in accordance with Applicable Laws and the Company’s applicable procedures. Personal Data may continue to be retained where the Company is required or permitted by law to retain such Personal Data, or where another lawful basis for continued retention applies.

Where Personal Data is no longer required to be retained, the Company shall take appropriate measures to delete, destroy or anonymize such Personal Data in accordance with its applicable retention schedules and internal procedures.

7. Processing of Sensitive Personal Data

Certain Personal Data processed by the Company may constitute Sensitive Personal Data.

The Company shall apply enhanced protection measures when processing Sensitive Personal Data and shall ensure that such processing is conducted only for lawful, specified and necessary purposes. Such measures may include identifying and documenting relevant processing activities, limiting access to authorized personnel on a need-to-know basis, applying appropriate organizational and technical safeguards, maintaining appropriate records, and carrying out any required assessment, notification, documentation or other compliance measures.

8. Processing of Children’s Personal Data

The Company shall process Children’s Personal Data in a manner that respects and protects the rights and best interests of children and in accordance with the Applicable Laws.

Where the Data Subject is a child, the Company shall obtain the consent of the child’s legal representative. Where the child is seven (7) years of age or older, the Company shall obtain the consent of both the child and the child’s legal representative.

The Company will take reasonable measures to verify the child’s age and the identity and authority of the legal representative where necessary or required by Applicable Laws. The Company shall cease processing Children’s Personal Data where the relevant consent is lawfully withdrawn or upon a request from a competent authority in circumstances prescribed by Applicable Laws, unless continued processing is otherwise permitted or required by Applicable Laws.

9. Commencement and End of Personal Data Processing

9.1. Commencement of Personal Data Processing

The processing of Personal Data shall commence when the Company lawfully collects, receives, accesses or otherwise obtains the relevant Personal Data and has an appropriate legal basis to process such Personal Data in accordance with Applicable Laws.

The Company shall not commence or continue processing Personal Data where the relevant processing is not supported by a lawful basis or otherwise does not comply with Applicable Laws.

9.2. End of Personal Data Processing

The processing of Personal Data shall end when:

the relevant processing purpose has been fulfilled or is no longer applicable;
the applicable legal basis for processing has ceased to exist, including where consent is lawfully withdrawn and no other legal basis for continued processing applies;
the applicable retention period has expired; or
processing is otherwise required to cease under Applicable Laws.

The cessation of a processing activity does not necessarily require the immediate deletion or destruction of the relevant Personal Data where the Company is required or permitted by law to retain such Personal Data for another lawful purpose.

10. Organizations and Individuals Involved in Personal Data Processing

Depending on the relevant processing activity, organizations and individuals involved in the processing of Personal Data may include:

‍The Company: The Company may act as a Personal Data Controller, Personal Data Controller and Processor or Personal Data Processor, depending on the nature of the relevant processing activity. ‍
The Company’s Employees and Personnel: Employees and personnel may access or process Personal Data only to the extent necessary for their authorized responsibilities. ‍
Personal Data Processors and Service Providers: The Company may engage Personal Data Processors and service providers to perform functions involving Personal Data. ‍
Group Companies: The Company may share Personal Data with companies within its group where necessary and lawful in compliance with this Policy and the Applicable Laws. ‍
Business Partners and Other Third Parties: The Company may disclose or provide Personal Data to its business partners, contractors, suppliers, professional advisers, competent authorities and other third parties where permitted or required by Applicable Laws.

The Company shall take appropriate measures to ensure that persons and organizations involved in Personal Data processing comply with applicable Personal Data protection requirements.

11. Cross-Border Transfer of Personal Data

The processing of Personal Data by the Company may be carried out, in whole or in part, outside Vietnam, including through the Company’s group companies, Personal Data Processors, service providers, information technology systems, cloud services or other systems or platforms located outside Vietnam. Where such processing involving the transfer of Personal Data outside Vietnam constitutes a cross-border transfer of Personal Data under Applicable Laws, the Company shall comply with all applicable requirements governing cross-border transfers of Personal Data.

The Company shall take appropriate organizational, contractual and technical measures to ensure that Personal Data transferred across borders is protected in accordance with Applicable Laws and shall carry out any required assessment, documentation, notification or other compliance measures in connection with such cross-border transfer. ‍

12. Personal Data Protection Impact Assessment

The Company shall establish, maintain and submit a Personal Data Protection Impact Assessment and Cross-Border Transfer Personal Data Protection Impact Assessment (if applicable) (collectively, “DPIA”) in accordance with Applicable Laws from the commencement of its processing of Personal Data, unless an exemption applies under Applicable Laws.

The DPIA shall assess the processing activities carried out by the Company and identify and evaluate the potential risks, impacts and harm to Data Subjects arising from such processing, together with the measures implemented or proposed to prevent, mitigate or eliminate such risks. ‍

13. Rights and Obligations of Data Subjects

13.1. Rights of Data Subjects

In respect of their Personal Data, the Data Subjects shall have the following rights:
1. To be informed about the processing of Personal Data;
2. To agree or disagree with, and request the withdrawal of consent for the processing of Personal Data;
3. To view, edit or request the correction of Personal Data;
4. To request the provision, deletion or restriction of processing of Personal Data; submit a request to object to the processing of Personal Data;
5. To lodge complaints, denunciations, lawsuits or claims for compensation for damage in accordance with the Applicable Laws;
6. To request competent agencies or agencies, organizations and individuals related to the processing of Personal Data to take measures and solutions to protect their Personal Data in accordance with the Applicable Laws.

Data Subjects may exercise their rights by submitting a request to the Company through the contact channels specified in this Policy. The Company may require reasonable information and documents to verify the identity of the requester and clarify the request before processing it. The Company shall process valid requests in accordance with Applicable Laws and within the applicable statutory timeframe.
The Company may refuse or limit a Data Subject’s request where:
1. the request is incomplete, invalid or not submitted in accordance with the Company’s applicable procedures;
2. the Data Subject fails to provide sufficient information or documents reasonably required for identity verification;
3. the Company has reasonable grounds to believe that the request involves fraud, abuse or a violation of Applicable Laws; or
4. the request is not permitted or is otherwise restricted under Applicable Laws.

Where the exercise of a Data Subject’s rights affects the Company’s ability to provide or maintain the Products or perform a contractual relationship, the Company may take appropriate measures in accordance with Applicable Laws and the relevant contractual terms.

13.2. Obligations of Data Subjects

In respect of their Personal Data, the Data Subjects shall have the following obligations:

To self-protect their Personal Data;
To respect and protect the Personal Data of others;
To provide their Personal Data lawfully, fully and accurately in accordance with the Applicable Laws, under contracts or when agreeing to allow the processing of their Personal Data;
To safeguard account credentials or other information provided to them; and
Complying with Applicable Laws and contractual requirements when interacting with the Company.

14. Personal Data Protection and Information Security Measures

The Company shall implement appropriate organizational, technical and human measures to protect Personal Data against unauthorized access, use, disclosure, alteration, loss, destruction or other unlawful processing. The measures implemented shall be appropriate to the nature, scope and purpose of the processing and the level of risk to Data Subjects.

14.1. Organizational Measures

The Company shall establish and maintain appropriate policies, procedures and internal controls for Personal Data protection, including measures for access management, confidentiality, risk assessment, management of Personal Data Processors and other third parties, personal data breach response and compliance monitoring. Personnel who are authorized to process Personal Data shall be subject to appropriate confidentiality and data protection obligations and shall receive appropriate instructions and training.

14.2. Technical Measures

The Company shall implement appropriate technical measures to protect Personal Data and information systems, which may include authentication, access controls, role-based access, encryption, network security, system monitoring and logging, backup and recovery, malware protection and other appropriate security technologies and safeguards.

14.3. Encryption

Where appropriate, having regard to the nature and risks of the processing, the Company shall implement encryption or other appropriate security technologies to protect Personal Data during transmission and/or storage, particularly Sensitive Personal Data.

14.4. Confidentiality and Access Control

Access to Personal Data shall be restricted to authorized personnel on a need-to-know basis and in accordance with their assigned responsibilities. Personnel shall not access, use, copy, disclose or otherwise process Personal Data beyond the scope of their authorized responsibilities or in violation of Applicable Laws or the Company’s internal policies and procedures.

14.5. Physical Security

The Company shall implement appropriate physical security measures to protect premises, information systems, equipment and records containing Personal Data. Such measures may include physical access controls, restricted areas, CCTV, visitor management and other appropriate safeguards.

15. Personal Data Breach Management

The Company shall establish and maintain appropriate internal policies, procedures and measures for the prevention, detection, management, control and handling of Personal Data Breaches. Such policies and procedures shall set out, as appropriate, the responsibilities and reporting lines, incident detection and assessment, containment and remediation measures, internal and external notification and reporting requirements, and other measures required to respond to and manage Personal Data Breaches in accordance with Applicable Laws.

The Company shall promptly assess and handle any Personal Data Breach in accordance with its applicable internal policies and procedures and shall take appropriate measures to mitigate potential risks and impacts on Data Subjects and comply with any applicable notification, reporting and other legal requirements.

16. Records and Documentation

The Company shall establish and maintain appropriate records and documentation relating to its Personal Data processing activities as required by Applicable Laws.

Such records may include:

Personal Data processing records;
Consent records;
privacy notices and forms;
DPIAs;
Personal Data Processor agreements;
Data Subject requests;
Personal Data Breach records;
retention and deletion records;
training records; and
other documents required by law or the Company’s internal procedures.

Records shall be retained for the applicable period and protected against unauthorized access, alteration, loss or destruction.

17. Roles and Responsibilities

17.1. Management

Management shall have overall responsibility for ensuring that the Company maintains an effective personal data protection framework and complies with Applicable Laws relating to Personal Data protection. Management shall:

provide overall oversight and direction in relation to Personal Data protection within the Company;
ensure that adequate resources, personnel, systems, and organizational and technical measures are available to support the Company’s Personal Data protection obligations;
support the implementation and enforcement of this Policy and related policies and procedures throughout the Company;
oversee significant Personal Data protection risks and compliance matters and ensure that appropriate measures are taken to address such risks;
support the implementation of appropriate governance, accountability and risk management processes for Personal Data protection;
support cooperation with competent authorities and other relevant stakeholders where required; and
promote a culture of Personal Data protection, information security and compliance throughout the Company.

17.2. Data Protection Officer

The DPO shall be responsible for advising and participating in the Company’s Personal Data protection activities in accordance with Applicable Laws. The DPO shall:

advise on the development of policies, regulations, procedures, forms to comply with the Applicable Laws on Personal Data protection;
participate in the implementation of Data Subjects’ rights;
participate in periodic assessments of the Company’s compliance with Applicable Laws and propose measures to enhance compliance and prevent and control risks arising from Personal Data processing activities;
participate in the preparation and maintenance of the DPIAs, where applicable, and the receipt and reporting of Personal Data Breaches, and implement other requests of the competent authorities in accordance with Applicable Laws;
participate in Personal Data protection training and awareness activities;
participate in the implementation of technical measures for Personal Data protection, applicable standards and technical regulations, and the Company’s emergency response plans for Personal Data protection incidents; and
perform other duties relating to Personal Data protection as required by Applicable Laws.

17.3. Legal & Compliance Department

The Legal & Compliance Department shall support the Company in ensuring legal and regulatory compliance relating to Personal Data protection. The Legal & Compliance Department shall:

develop and implement policies, regulations and procedures on Personal Data protection;
organize and coordinate the implementation of Data Subjects’ rights;
organize periodic assessments of the Company’s compliance with Applicable Laws and propose measures to enhance compliance and prevent and control risks arising from Personal Data processing activities;
organize the preparation, submission, updating and retention of the DPIA dossiers, where applicable, and the receipt and reporting of Personal Data Breaches in accordance with Applicable Laws;
organize Personal Data protection training and awareness activities;
organize and coordinate the implementation of technical and organizational measures for Personal Data protection, applicable standards and technical regulations, and the Company’s emergency response plans for Personal Data protection incidents; and
research and propose measures and decisions relating to Personal Data protection.

17.4. IT Department

The IT Department shall be responsible for supporting the Company’s Personal Data protection framework from a technical and information security perspective. The IT Department shall:

implement and maintain appropriate technical measures to protect Personal Data and information systems against unauthorized access, use, disclosure, alteration, loss, destruction and other unlawful processing;
implement appropriate access controls, authentication, encryption, monitoring, logging, backup, recovery and other technical safeguards, as appropriate to the nature and risks of the relevant processing;
support the secure storage, transmission, retention and deletion of Personal Data;
manage and monitor access to systems and applications containing Personal Data in accordance with authorized roles and responsibilities;
support the identification, assessment, containment and remediation of Personal Data Breaches and other information security incidents in accordance with applicable procedures;
provide technical support for DPIAs, and other Personal Data protection assessments where required;
cooperate with the DPO, Legal & Compliance and relevant Departments on Personal Data protection and information security matters; and
recommend and implement appropriate technical improvements to strengthen the Company’s Personal Data protection and information security controls.

17.5. Other Departments

Each Department shall be responsible for ensuring that its Personal Data processing activities comply with this Policy, applicable internal procedures and Applicable Laws. Each Department shall:

process Personal Data only for lawful, specified and legitimate purposes and within the scope of its authorized responsibilities;
ensure that Personal Data collected, accessed, used, disclosed, stored or otherwise processed by the Department is handled in accordance with this Policy and applicable internal procedures;
ensure that appropriate consent, notices, forms, contractual arrangements or other required documentation are in place where applicable;
restrict access to Personal Data to authorized personnel who have a legitimate business need to access such data;
promptly report any actual or suspected Personal Data Breach, non-compliance or other Personal Data protection concern to the DPO and relevant stakeholders;
cooperate with the DPO, Legal & Compliance and IT Department in relation to DPIA, Data Subject requests, Personal Data Breaches and other Personal Data protection matters; and
ensure that applicable retention, deletion and other Personal Data protection requirements are followed within the Department.

17.6. Employees and Personnel

All Employees and Personnel of the Company shall be responsible for protecting Personal Data and complying with this Policy, Applicable Laws and the Company’s applicable internal policies and procedures.

Employees and Personnel who are involved in the collection, processing, use, storage, disclosure or other handling of Personal Data shall:

process Personal Data only as authorized and for legitimate business purposes;
protect the confidentiality and security of Personal Data to which they have access;
not access, use, copy, disclose or otherwise process Personal Data beyond the scope of their authorized responsibilities;
comply with applicable access control, security, retention and other Personal Data protection requirements;
promptly report any actual or suspected Personal Data Breach, unauthorized access, disclosure, loss or other Personal Data protection concern; and
participate in Personal Data protection and information security training and awareness activities as required by the Company.

17.7. Personal Data Processors and Third Parties

Personal Data Processors and third parties that process or have access to Personal Data in connection with the Company’s business shall comply with Applicable Laws and the Company’s applicable data protection requirements. The Company shall take appropriate measures to ensure that such parties protect Personal Data, use it only for authorized purposes, maintain appropriate confidentiality and security measures, and cooperate with the Company in fulfilling its Personal Data protection obligations where required.

18. Training and Awareness

The Company shall conduct appropriate training and awareness activities for its personnel and other relevant individuals involved in the processing of Personal Data. Such training and awareness activities shall aim to ensure that relevant personnel understand their responsibilities and obligations relating to Personal Data protection, raise their awareness of data protection and information security risks, and comply with Applicable Laws and the Company’s internal policies and procedures.

19. Contact and Reporting

19.1. Data Subject Requests

Data Subjects may contact the Company to:
1. exercise their rights relating to their Personal Data;
2. request information about Personal Data processing;
3. raise privacy concerns.

Requests should be submitted through:

Hoi An South Development Ltd

Address: Tay Son Tay Hamlet, Duy Nghia Commune, Da Nang City, Vietnam

Email: [email protected]

Telephone number: 0235 858 7777

The Company may request information that is reasonably necessary to verify the identity and legitimacy of the requester.

19.2. Internal Reporting

Employees and personnel shall promptly report:
1. Personal Data Breaches as detailed in the applicable Personal Data Breach Policy;
2. non-compliance with this Policy, the applicable Personal Data Breach Policy or any policies/regulations related to personal data protection; or
3. other Personal Data protection concerns.

Reports shall be made through email: [email protected], Legal & Compliance Department or other internal reporting channels designated by the Company.

20. Review of Policy

This Policy shall be reviewed and updated where necessary to ensure compliance with applicable laws, regulatory guidance; operational requirements; cybersecurity risks, as per the request of the DPO.

21. Effectiveness

This Policy shall take effect from the date of issue. The Company reserves the right to amend this Policy from time to time.

This Policy is prepared by Legal & Compliance Department.

‍