PERSONAL DATA PROTECTION

This Policy applies to individuals who access, register for or use ROVELA; individuals whose Personal Data is processed in the course of providing the Services; representatives and contact persons of partners, suppliers or organizations having a relationship with the Company; and other individuals related to the Company’s processing of Personal Data.

ROVELA serves Customers within and outside the territory of Vietnam. The processing of Personal Data under this Policy is carried out in accordance with the provisions and conditions applicable to VIFC, Vietnamese law and the personal data protection or privacy regulations of the relevant country or territory.

This Policy applies together with the ROVELA Terms of Service and the ROVELA Security and Privacy Policy. The ROVELA Terms of Service govern access to and use of the Services, and transactions; the Security and Privacy Policy focuses on platform, account and device security and privacy during use; this Policy separately governs the processing and protection of Personal Data. Where the same matter is addressed in multiple documents, the more specific content shall take precedence with respect to that matter, unless otherwise provided by law.

Depending on the processing activity, the Company may act as a Personal Data Controller, Personal Data Processor, Personal Data Controller and Processor, or an equivalent role under applicable law. The roles of the Company and the parties participating in processing are determined according to which party determines the purposes and means of processing and/or carries out processing under instructions.

By accessing, registering for and/or using ROVELA, the Data Subject confirms that he or she has read, understood, accepted and agreed to be bound by this Policy throughout the use of the Services. Acceptance of the Policy constitutes confirmation that the Data Subject has been informed of the Personal Data processing activities; such acceptance does not automatically replace separate consent for a processing activity for which consent is a mandatory legal basis under applicable law.

When a Data Subject provides another person’s Personal Data to the Company, the Data Subject is responsible for ensuring that such provision has a lawful basis, is within the necessary scope and that the obligation to notify or obtain permission from the relevant person has been fulfilled to the extent required by law. The Company has the right to require the Data Subject to provide information, documents or evidence necessary to demonstrate the right to provide another person’s Personal Data. Where the Data Subject is unable to provide appropriate evidence, the Company has the right to refuse receipt, restrict the use of the data or apply other necessary measures to protect the relevant person and ensure compliance with law.

“Company” means ROVELA PAY SINGLE-MEMBER LIMITED LIABILITY COMPANY. “ROVELA” means the brand, platform, application, website and other electronic channels owned, managed or operated by the Company to provide or coordinate the Services.

“VIFC” means the Vietnam International Financial Center, established and operating under the laws and applicable legal framework of Vietnam.

“Services” means the products, features and utilities provided or coordinated by the Company through ROVELA from time to time in accordance with the ROVELA Terms of Service.

“Data Subject” means the individual to whom the Personal Data relates. In this Policy, Data Subjects include Customers, users, representatives or contact persons, individuals whose information is lawfully provided to the Company, and other individuals whose Personal Data is processed by the Company.

“Personal Data” means information in digital or other form relating to an identified or identifiable individual, including data provided by the Data Subject, data arising from use of the Services, data received from other sources and data created, inferred or analyzed from such data by the Company or a party participating in processing. Information that has been de-identified in an irreversible manner such that an individual cannot be identified is not considered Personal Data to the extent applicable law so provides.

“Sensitive Personal Data” means Personal Data for which applicable law requires a higher level of protection due to its nature or the risk of impact on an individual’s rights or interests. Depending on the country, this category of data may include biometric data used for identification; financial, account or transaction information; identification documents; precise location; data concerning health, racial or ethnic origin, religion, political opinions, sex life or sexual orientation; information concerning criminal conduct; the content of private communications; and other data determined by law to be sensitive.

“Processing of Personal Data” means one or more activities performed on Personal Data, including collection, receipt, recording, organization, classification, analysis, comparison, aggregation, storage, use, modification, retrieval, provision, sharing, transfer, transmission, restriction, encryption, de-identification, deletion, destruction or other activities under applicable law.

“Data Processor” means an organization or individual that processes Personal Data under the instructions of the party determining the purposes and means of processing; “Third Party” means another organization or individual participating in or receiving Personal Data on a lawful basis. The naming and scope of responsibilities of these roles may differ under the laws of each country or territory.

“De-identification” means the application of technical or organizational measures to remove or reduce the ability to link data to a specific individual. Data that has been fully anonymized and cannot reasonably be re-identified is processed in accordance with the provisions applicable to anonymous data.

Depending on the Services, features, transactions, country and the specific relationship with the Data Subject, the Company processes only the types of Personal Data necessary and appropriate to the Purposes and legal basis for processing set out in this Policy. Not all of the types of data below are collected for every Customer or in every transaction.

Identification, contact and personal information data: full name; date of birth; nationality; country of residence; address; email; telephone number; passport or identification document information; images; signature; information on residence, travel or immigration status where necessary to determine eligibility to use the Services; and similar information provided by the Data Subject or lawfully received.

Identity verification and biometric data: images of identification documents; selfies; images or videos used for liveness checks; facial matching data or results; results of reading and comparing information on documents; identity verification results; and other biometric data if used in accordance with applicable law. The processing of this category of data is carried out in accordance with Article 10 of the Policy.

Account and Service usage data: customer code, login and authentication information, Account status, Customer settings and choices, feature usage history, notifications, support requests and data necessary to maintain, authenticate and manage the Account.

Funding, payment and transaction data: funding or payment method; amount; currency; relevant exchange rate or quotation; time; status; reference code; information on the payment acceptance entity or recipient; transaction history; reconciliation, inquiry, refund, chargeback or adjustment data. For card transactions, the Company does not store the full card number on ROVELA’s core system where card data is entered and processed in the card processor’s environment; the Company only receives a token, the last four digits and necessary transaction data to the extent permitted.

Compliance, fraud prevention and risk management data: customer identification and verification results; screening results against embargo, sanctions, politically exposed persons and watchlists; information on source of funds, source of wealth or transaction purpose where necessary; indicators, alerts and risk analysis results; information on suspicious conduct, fraud, abuse or unauthorized access; and data necessary to perform anti-money laundering, counter-terrorist financing and other compliance obligations.

Device, network and technical data: device type; operating system; application or browser version; Internet Protocol address; device identifier; access time and session; system logs; error information; authentication data; location or location-related information where lawfully collected and necessary; and other technical information arising from access to or use of ROVELA. The use of cookies and similar technologies is set out in greater detail in the ROVELA Security and Privacy Policy.

Communications and support data: the contents of emails, chats, feedback, complaints, inquiries, support requests, attachments, call recordings or other communications where such recording is notified and carried out lawfully.

Third-party and generated data: information the Company receives from affiliates, banks, card organizations, payment processors, identity verification providers, fraud prevention organizations, competent authorities, lawful public sources or other service providers; and also including assessment, classification, inference, risk profile or indicator results generated from analysis of the above data.

The Company processes Personal Data for one or more of the following purposes (the “Purposes”), depending on the Services, features, transactions and the legal basis for processing applicable to each case.

Provision and operation of the Services: receiving registrations; creating, maintaining and managing Accounts; verifying identity and eligibility for use; receiving and processing Customer requests; recording balances and changes; carrying out or coordinating funding, currency conversion, payment, refunds, reconciliation, inquiries and other functions provided by the Company from time to time.

Performance of contractual relationships and transactions: performing the ROVELA Terms of Service, agreements or transaction requests; authenticating Customer instructions; sending transaction confirmations and notifications; supporting and resolving errors, complaints or disputes; recovering or handling amounts payable; and protecting lawful rights and interests arising from the relationship among the Company, Customers and relevant parties.

Customer identification, compliance and prevention of financial crime: verifying identity; conducting customer due diligence; screening sanctions, embargoes and politically exposed persons; monitoring transactions; assessing and investigating unusual indicators; preventing and combating money laundering, terrorist financing, fraud, impersonation, Account takeover and other unlawful acts; and providing records and information pursuant to reporting obligations or lawful requests of competent authorities.

Ensuring security, risk management and protection of rights and interests: authenticating access rights; detecting and preventing unusual conduct; assessing transaction, account or device risks; applying necessary control measures; protecting Personal Data, assets, systems and the lawful rights and interests of Customers, the Company and relevant parties.

Internal operations, governance and compliance: accounting, finance, tax, audit, internal control, risk management, vendor management, record retention, reporting, corporate governance, handling legal requests, and establishing, exercising or defending the Company’s lawful rights and claims.

Improvement and development of the Services: analyzing the effectiveness, quality and manner of use of the Services; detecting errors; testing, maintaining and upgrading systems; researching and developing features; improving experience, stability and operational efficiency. The Company gives priority to using aggregated or de-identified data for these purposes.

Communications with Customers: sending notices regarding Accounts, transactions, security, operations, legal matters or changes to the Services; receiving and responding to requests, inquiries and complaints; and contacting Customers in situations necessary to protect Customers or perform the Company’s obligations.

Marketing, introduction and personalization: sending or displaying information about Services, features, promotional programs or content appropriate to Customer needs; measuring marketing effectiveness; and managing communication preferences. This activity is carried out on an appropriate legal basis for processing and accompanied by mechanisms to opt out, withdraw consent or change preferences as required by applicable law.

The Company and/or a party participating in the Services may analyze Personal Data to verify identity, detect fraud, conduct compliance screening, assess risk, monitor transactions, protect Accounts, determine additional verification requirements or support operational decision-making. Based on the results of analysis, risk assessments or alerts generated, the Company has the right to require additional verification, delay processing, limit functions, refuse transactions or apply other control measures in accordance with the ROVELA Terms of Service.

The Company determines the appropriate legal basis for processing for each Personal Data processing activity in accordance with applicable law. A processing activity may be based on one or more different legal bases depending on the country, purpose and specific circumstances.

The legal basis for processing may include: (i) processing necessary to enter into or perform a contract, to respond to a Customer’s request before entering into a contract or carrying out a transaction; (ii) processing necessary to perform a legal obligation or a requirement of a competent authority; (iii) processing necessary to protect the lawful rights and interests of the Company or a relevant party to the extent recognized by law and after taking into account the rights and interests of the Data Subject; (iv) consent or the consent of the Data Subject; and (v) other legal bases permitted by applicable law.

The Company does not automatically regard all Personal Data processing activities as being based on consent. Where the Services cannot be provided without certain data due to requirements of a contract, transaction, law, security or fraud prevention, where Personal Data is necessary to provide the Services, carry out a transaction, verify identity, ensure security, prevent fraud or perform a legal obligation, the Data Subject is responsible for providing such Personal Data at the Company’s request. If the Data Subject does not provide, or does not ensure the completeness and accuracy of, the necessary data, the Company has the right to refuse, restrict, suspend or terminate the provision of the relevant Services.

Where consent is the mandatory legal basis for a processing activity, the Company records consent in a form appropriate to the nature of the processing activity and applicable law before carrying out such activity. Consent must be linked to the notified purpose; refusal or withdrawal of consent affects only the processing activity based on such consent and does not invalidate processing activities lawfully carried out before withdrawal.

For Sensitive Personal Data, the Company processes such data only where there is both a clear Purpose and a legal basis appropriate to the enhanced requirements of applicable law. Acceptance of this Policy may replace separate consent or a separate form of confirmation unless applicable law requires separate consent or a separate form of confirmation for the specific type of data or processing activity.

The Data Subject may withdraw consent through a channel provided by the Company. Where the relevant Personal Data is necessary to provide the Services or perform a specific function, withdrawal of consent may result in the Company restricting, suspending or terminating the provision of the corresponding function or Services. The Data Subject bears the consequences arising directly from the withdrawal of consent. However, the Company may continue to store or process the data on another basis permitted or required by law.

ROVELA Services are designed for individuals who are at least 18 years old and satisfy the conditions of use under the ROVELA Terms of Service. The Company does not actively provide the Services to persons under 18 years old or collect their Personal Data to open or maintain an Account for use of the Services.

Where the Company determines or has a basis to determine that a user does not satisfy the age requirements under the ROVELA Terms of Service, the Company has the right to refuse, restrict, suspend or terminate the provision of the Services and process the relevant Personal Data in accordance with law.

The Company may collect Personal Data directly from the Data Subject when registering, verifying identity, using the Services, carrying out transactions, contacting support, submitting documents or performing actions on ROVELA.

The Company may automatically collect Personal Data while Customers access and use ROVELA, including device, network, log, access session, action, alert and other technical data. The use of cookies, analytics tools, device permissions and similar technologies is described in the ROVELA Security and Privacy Policy.

The Company may receive Personal Data from affiliates, banks, card organizations, payment processors, identity verification providers, fraud prevention providers, technology providers, payment acceptance entities, competent authorities and other organizations and individuals lawfully participating in the provision of the Services or processing of transactions.

The Company may receive information from databases, lists, public sources or official sources that the Company is entitled to access or is required to check, including sources used for identity verification, compliance screening, fraud prevention and fulfillment of legal requirements.

The Company may create new data from analysis, comparison or inference based on lawfully collected data, such as verification results, risk indicators, fraud alerts, usage segmentation or results of assessment of transaction conditions. Generated data remains protected as Personal Data if it can be linked to a specific individual.

The Company shares, provides or permits access to Personal Data only to the extent necessary for the identified Purposes, on an appropriate legal basis for processing and in accordance with the principle of limited access rights. The fact that a party participating in the Services is mentioned in the ROVELA Terms of Service does not mean that such party has access to all of a Customer’s Personal Data.

Depending on the Services and transactions, recipients may include: (i) parent companies, subsidiaries, affiliates or entities within the same group having relevant functions; (ii) banks, credit institutions, card organizations, card processors, payment entities, foreign exchange providers and financial institutions related to the transaction; (iii) identity, verification, biometric, compliance screening and fraud prevention providers; (iv) infrastructure, storage, cloud computing, technology, software, communications, customer care, audit, accounting, legal advisory and other support service providers; (v) payment acceptance entities, recipients of funds or parties directly related to the transaction to the necessary extent; (vi) representatives or persons lawfully authorized by the Data Subject; and (vii) state authorities, regulatory authorities, law enforcement authorities or other organizations to which the Company is obligated or permitted by law to provide data.

Some recipients may process Personal Data as processors under the Company’s instructions; some recipients may independently determine the purposes and means of processing within the scope of law and their functions. Where a recipient is an independent controller, that recipient’s separate processing activities may also be subject to its own privacy policy or separate legal obligations.

The Company applies appropriate selection, authorization, contractual and monitoring measures to data processors and service providers, including requirements concerning purpose, scope of processing, security, retention, deletion of data, support for the exercise of Data Subject rights and incident handling, to the extent required by applicable law.

The Company may provide Personal Data in a corporate restructuring, merger, sale and purchase, transfer or similar transaction if such provision is necessary and lawful and the recipient is bound by confidentiality or appropriate data protection obligations.

In the course of providing the Services to Customers within and outside the territory of Vietnam, Personal Data may be transferred, stored or processed in Vietnam and/or another country or territory in connection with the provision of the Services, transaction processing, verification, support, storage, fraud prevention or performance of legal obligations.

For transfers of Personal Data falling within the scope of Vietnamese law or regulations applicable to VIFC, the Company performs the corresponding obligations, procedures and protective measures in accordance with the applicable provisions from time to time.

Where the law of a relevant country or territory imposes mandatory requirements on the transfer of Personal Data, the Company will consider, assess and implement the necessary requirements and measures to the extent such law applies.

To verify identity, prevent impersonation and satisfy compliance obligations, the Company and/or an identity verification provider may process selfies, images or videos, liveness check data, facial matching results and related technical data. Depending on applicable law and the manner of processing, some of this data may be considered biometric data or sensitive data.

Biometric data is processed to the extent necessary to verify identity, protect Accounts, prevent fraud and perform relevant legal obligations. The Company does not use biometric data for behavioral advertising purposes, does not sell biometric data or build marketing profiles unrelated to the Purposes above.

The Company may use specialist providers to perform liveness checks, image matching, document verification or other technical processing. A provider’s access to and processing of data is limited according to its functions, agreements and applicable law; where the provider independently determines separate processing purposes, the Data Subject may also be subject to that provider’s privacy policy.

Where applicable law requires a separate notice, explicit consent, written approval or a separate form of confirmation before biometric data is collected or processed, the Company fulfills that requirement before the corresponding processing activity begins. Accessing, registering for or using ROVELA and accepting this Policy do not replace such separate requirement.

The Company applies criteria for retention and destruction of biometric data based on the verification purpose, legal obligations and maximum retention periods prescribed by applicable law. When the data is no longer necessary and there is no longer a lawful basis to retain it, the Company deletes or destroys the data or requires the processor to take the corresponding measure.

The Company retains Personal Data only for the period necessary for the corresponding Purposes, the period necessary to provide the Services and the period for which the Company is obligated or permitted by law to retain it. The period may vary according to the type of data, transaction, country, anti-money laundering requirements, accounting, tax, dispute resolution, limitation periods for claims, fraud prevention and requirements of competent authorities.

Closing an Account, terminating use of the Services or terminating the relationship with the Company does not mean that all Personal Data is immediately deleted. The Company continues to retain Personal Data for the period necessary to perform legal obligations, reconciliation, audit, fraud prevention, dispute resolution, exercise or protect lawful rights and interests and other lawful purposes under this Policy.

For support, communications and complaint data, the Company retains the data for the period necessary to handle the request and for a reasonable period thereafter to demonstrate handling, resolve disputes or comply with legal obligations. For marketing data based on Customer consent or choice, the Company ceases using the data for marketing purposes after receiving an opt-out request or withdrawal of consent, but may retain the minimum information necessary to record and respect that choice.

When Personal Data is no longer necessary and there is no longer a lawful basis to continue retaining it, the Company deletes, destroys or de-identifies it in accordance with an appropriate process. Data in backup systems may be removed in accordance with normal backup and recovery cycles, provided that such data is not restored for use for a purpose that is no longer lawful.

The Company may defer deletion or continue to retain part of the Personal Data where there is a requirement to preserve evidence, a dispute, an investigation, a retention obligation, a requirement of a competent authority or another lawful basis. When that basis ceases, the data is processed in accordance with the applicable provisions.

Depending on applicable law and the Company’s role in the processing activity, a Data Subject may have one or more of the following rights: to be notified of and informed about processing activities; to request confirmation of processing; to access and receive a copy of Personal Data; to request correction or updating of inaccurate data; to request deletion of data; to request restriction of processing; to object to certain processing activities; to withdraw consent; to request data portability; to object to or request human review of certain automated decisions; to opt out of direct marketing; to lodge complaints or denunciations, initiate legal proceedings and claim compensation; and other rights provided by applicable law.

Data Subject rights are exercised within the scope and subject to the conditions prescribed by applicable law and are not absolute rights. The Company has the right to refuse, limit or delay a request, or require additional information, where the request does not satisfy legal conditions, including where necessary to verify identity; protect the rights of others; maintain security and prevent fraud; carry out transactions; comply with retention obligations, anti-money laundering requirements or requirements of competent authorities; establish, exercise or protect legal rights; or where the request shows signs of fraud, abuse, excessive repetition or failure to satisfy statutory conditions.

The Data Subject may exercise rights through functions provided on ROVELA or contact the Company in accordance with Article 15 of the Policy. The Company has the right to require information to verify the identity and authority of the requester and the relationship between the requester and the data, in order to prevent data from being provided or altered for a person without authority.

The Company responds to requests within the period prescribed by applicable law. The Company may extend the period and provide notice as required by law. Where a request is submitted to the Company in respect of data that the Company processes only under the instructions of another controller, the Company may forward the request or instruct the Data Subject to contact the controller having authority to handle the request.

Withdrawal of consent, or a request for deletion, restriction or objection to processing, does not affect the lawfulness of processing activities carried out before the request takes effect. If the relevant data is necessary to provide a Service or perform a legal obligation, exercise of the right may result in the Company being unable to continue providing part or all of the corresponding Services.

The Data Subject is responsible for providing accurate, complete and lawful information to the extent required by the Services; updating information when changes occur; not providing forged documents, data or information; and bearing responsibility for consequences arising from intentionally providing incorrect information or unlawfully using another person’s Personal Data.

The Data Subject must respect other persons’ Personal Data, provide another person’s Personal Data to the Company only where there is a lawful basis, and reasonably cooperate with the Company where necessary to verify the right to provide such data, handle requests or resolve related incidents.

The Data Subject is responsible for taking reasonable measures to protect his or her Account, device and authentication methods. Detailed provisions on security when using ROVELA are set out in the ROVELA Security and Privacy Policy and Terms of Service.

The Company applies administrative, organizational, technical and physical measures appropriate to the nature of the data, scope of processing and level of risk to protect Personal Data against unauthorized access, use, alteration, loss, disclosure or destruction. The measures are reviewed and adjusted as appropriate to changes in systems, risks and legal requirements.

When using a data processor or service provider, the Company applies appropriate requirements regarding security, authorization, data protection, incident handling and deletion or return of data according to that party’s role and scope of processing. Detailed provisions on security measures for the platform, Account and device and Customers’ security responsibilities are set out in the ROVELA Security and Privacy Policy.

When a Personal Data breach occurs or there is a basis to suspect that one has occurred, the Company takes necessary measures to assess, isolate, remediate, limit damage, preserve necessary information and perform reporting or notification obligations to competent authorities and/or Data Subjects within the scope and time limits prescribed by applicable law.

A Data Subject may contact the Company to submit a request to exercise rights, a question, feedback or a complaint relating to the processing of Personal Data through the following official channels: email [email protected]; the support channel on the ROVELA Application; or channels published at www.rovelapay.com.

To protect Personal Data and prevent fraudulent requests, the Company has the right to require the requester to provide information or documents necessary to verify identity, authority and the validity of the request. The Company has the right to refuse to process the request until the verification has been fully completed.

Where the law of a country or territory requires the Company to appoint a data protection officer, local representative or another specialized point of contact, the contact information of such point of contact will be published by the Company or provided to the Data Subject as required by applicable law.

The Company has the right to amend, update, supplement or replace this Policy from time to time to align with the business situation, ROVELA’s operations, changes to the Services, technology, methods of Personal Data processing, requirements of competent authorities, the VIFC framework and/or applicable legal provisions. The updated version and its effective time are published by the Company on ROVELA and/or notified to Data Subjects by an appropriate method.

The Company recommends that Data Subjects regularly access, review and monitor ROVELA to stay updated on the latest changes to the Policy. A Data Subject’s continued access to, registration for and/or use of ROVELA after amendments, updates, supplements or replacements to the Policy take effect is understood to mean that the Data Subject has read, understood, accepted and agreed to be bound by all such amendments, updates, supplements or replacements.

Continued use of ROVELA does not replace separate consent, a separate notice or a separate choice mechanism where a change gives rise to a processing activity for which applicable law requires the Data Subject’s consent or a separate form of confirmation before processing.

Effective amendments, updates, supplements or replacements form an integral part of this Policy from the effective time published by the Company, unless the Company notifies a different application of time or otherwise provided by law.

This Policy takes effect from the date Application launching and is published on www.rovelapay.com, the ROVELA Application and/or another appropriate channel of the Company.

To the extent the Services are provided under the VIFC framework, the specific provisions and conditions applicable to VIFC apply to the corresponding content. For matters not separately provided for, this Policy is governed by and construed in accordance with Vietnamese law. Where mandatory personal data protection or privacy provisions of another country or territory apply to a specific Data Subject or processing activity, the Company fulfills those mandatory requirements to the extent applicable; the remaining matters continue to be governed by the provisions applicable to VIFC and Vietnamese law.

If any provision of this Policy is determined to be invalid, unlawful or unenforceable under applicable law, such provision is limited or severed to the extent necessary without affecting the validity of the remaining provisions.

This Policy applies from the time the Company begins processing Personal Data within its scope and continues to apply for as long as the Company has a lawful basis to process, retain or perform obligations relating to such Personal Data.