PRIVACY NOTICE

Version: June 2024

Russin & Vecchi Law Company (Vietnam) is a legal services provider (hereinafter referred to as “we”, “us”, “Russin & Vecchi”) and your privacy matters to us. We are committed to using your data responsibly, following all applicable data privacy laws when collecting and processing personal data provided to us, or which we have obtained from your visits to our websites and use of our online services.

This Privacy Notice explains our information practices in relation to personal information. This Privacy Notice also describes certain choices you have on how we use your personal data. We reserve the right to modify this Privacy Notice at all time. We will reflect such modifications to this Privacy Notice on our site. If you have any inquiries or wish to exercise any of your rights as a data subject, you can contact us using the information in Section 8 below. If you are a client of Russin & Vecchi, you should review this notice in addition to our terms of business.

1. WHEN THIS NOTICE APPLIES

This Privacy Notice explains how we manage personal data that we obtain:

• As part of our business onboarding procedures;
• from or about individuals who are our clients;
• from or about individuals in the course of providing legal services to our clients;
• from or about individuals in the course of our other business activities, including but not limited to marketing data and data from digital initiatives.

If you are a partner of or work for Russin & Vecchi or are applying for a position at Russin & Vecchi, you should consult the data privacy information provided to you in connection with your role.

2. TYPES OF PERSONAL DATA COLLECTED

The personal data we may directly collect from you will depend on the nature of your interactions with Russin & Vecchi and whether you:

• have engaged our legal services;
• are recipient of our marketing communications or attend events;
• have interacted with our websites or our other similar technologies;
• have a connection to a member of our personnel; or
• have a vendor relationship or similar with Russin & Vecchi.

In addition, we may collect data about you from third parties, which may include but not limited to instructing clients (where your information forms part of a client matter) and providers of verification services for client onboarding. We may monitor your activity on our websites, your interactions with marketing materials we send and communications between you and Russin & Vecchi.

Depending on the circumstances, the types of personal information collected by Russin & Vecchi may include:

• Basic personal information, such as your name, gender, nationalities, contact details, job title, license plate and other basic personal information as categorized under applicable data privacy regulations;
• Sensitive personal information, such as information about health or information about your political, religious or philosophical beliefs, customers’ information at financial institutes, intermediary payment service provider, including KYC information and account information, assets, transactions, guarantees/guarantors for business acceptance purposes and anti-money laundering requirements and other sensitive personal information as categorized under applicable data privacy regulations;
• Photographic, audio and video content (which can include CCTV footage if you visit our premises);
• Information that you have provided in relation to marketing preferences, registering for events and meetings (which may include access and dietary requirements);
• Information relating to your interactions with our website and technical data that is collected through tracking technologies and relationship insight tools; and
• And any other information relating to you that you or others may provide.

3. PURPOSES FOR WHICH WE USE YOUR PERSONAL INFORMATION

We will only use your personal information when the law allows us to do so. Most commonly we will use your personal information in the following circumstances, where permitted:

• when we need to perform a contract we are about to or have entered into with you;
• when we need to do so to comply with a legal obligation;
• when it is necessary to establish, exercise or defend legal claims;
• if you have already made the information public; or
• if you have given your consent.

Your personal information will be used solely for the purposes we originally disclosed. In the limited circumstance where we believe a new purpose aligns with the original one, we may use it for that purpose. Otherwise, we will only use your information for a new purpose with legal justification and appropriate notice (including consent if legally required).

If you wish to understand more about the basis upon we are using your data please contact us as set out below.

4. TRANSFERRING AND SHARING YOUR DATA

Your personal data is stored electronically on servers, either in Vietnam or internationally. Any hard copies of your information are kept securely, either on-site or at a separate secure facility.

During the course of our business, we may provide personal information to third parties such as operational service providers (such as data storage services or notarization services). We will only transfer your personal information in these circumstances where we are satisfied that it will be subject to an appropriate level of protection and in accordance with any safeguards that may be legally required. Russin & Vecchi may be legally required to disclose personal information by a regulator, court or authority. Where necessary and with appropriate safeguards, Russin & Vecchi may also need to disclose information to its professional advisors (e.g. legal and financial advisors), bankers, auditors, insurers and insurance brokers.

5. CONFIDENTIALITY AND SECURITY

We take reasonable precautions to ensure that your personal information remains confidential and have put in place appropriate security measures to protect our data, which includes your personal information. Access to your personal information is limited to only authorized personnel on a strict need-to-know basis. They will only process your personal information on our instructions and are bound by strict confidentiality agreements.

We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

6. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

Except as otherwise permitted or required by Vietnamese law, the Company may retain the Personal Data but only for as long as it is necessary to fulfill the purposes for which the Personal Data was collected (including, for the purpose of meeting any legal, accounting, reporting, retention and other requirements or obligations) and for IT archival purposes, if any.

The data subjects may request that the Company delete the Personal Data that the Company hold. However, regulatory requirements may require us to refuse to delete such Personal Data. In such case, the Company will inform the data subjects of the reasons in writing, subject to any legal restrictions..

7. RIGHTS OF DATA SUBJECTS

In accordance with applicable law and with respect to the data we process and control, you have the following rights:

• Right to be informedof processing activities and third parties with which your personal data has been shared;
• Right to accessor to request access to view or edit your personal data.
• Right to withdraw consentto our processing of your personal data. Kindly note that if you refrain from providing personal data or withdraw your consent to our processing of your personal data, we may not be able to perform certain obligations to you.
• Right to erasure: you have the right to delete your personal data or to request that your personal data be deleted. Kindly note that regulatory requirements may require us to retain the your Personal Data. If the Company cannot delete your Personal Data, the Company will inform you of the reasons in writing, subject to any legal restrictions.
• Right to object/restrict: data processing activities.
• Right to data portability: You have the right to request and receive a copy of your personal data that you have provided us.
• Other rights: the data subject also has the right to claim for damages, to initiate legal proceedings and to implement measures for self-protection.

If you would like to exercise any of these rights, please contact us as set forth in Section 8 below. We will process such requests in accordance with applicable laws.

8. DATA PRIVACY ENQUIRIES

This Privacy Notice was drafted with brevity and clarity in mind. We are very happy to assist with any further queries. You may contact our team directly by emailing lawyers@russinvecchi.com.vn