Personal Data Protection Policy – Applicable to the MobiWork DMS System

1. Introduction and Scope

This Personal Data Protection Policy (“Policy”) is issued by MobiWork Vietnam Technology Joint Stock Company (“MBW”) to provide transparent information regarding the processing of personal data during the provision, operation, and use of the MobiWork DMS Software System (“System”), in accordance with the provisions of Vietnamese law on personal data protection.

This Policy applies only to personal data processing activities arising within the scope of using the MobiWork DMS System and does not govern personal data collection or processing activities performed independently by the Customer outside the System or for other MBW purposes unrelated to the System.

2. Roles and Legal Status

In the personal data processing activities related to the MobiWork DMS System:

• The Customer (the organization/individual using the System) is the Personal Data Controller, who has the right to decide the purpose, scope, processing methods, and retention period of personal data of users under their management.
• MBW is the Personal Data Processor, performing data processing according to the lawful instructions of the Customer, based on the Contract, Data Processing Agreement, and System configurations established by the Customer.
• End-users (employees, laborers, collaborators of the Customer) are the Personal Data Subjects.

MBW is not the employer, does not decide the purposes of personnel management, and is not responsible for the Customer’s management, supervision, or evaluation decisions regarding personnel.

3. Scope of Application

This Policy applies to:

• Individuals who are representatives, contact persons, or end-users of the Customer;
• Personal data arising during the process of:
  • Providing and deploying the System;
  • Operating, administering, and providing technical support for the System;
  • Using the professional functions of the System according to the scope configured by the Customer.

4. Types of Personal Data Processed

Depending on the configuration and scope of use established by the Customer, MBW may process the following types of personal data:

4.1. Basic Personal Data Includes identification information, internal contact information, work information, and data arising during the use of the System’s professional functions.

4.2. Sensitive Personal Data The System only processes sensitive personal data in cases where:

• The Customer activates the corresponding functions;
• The processing directly serves management and operational activities according to the Customer’s organizational model;
• There is a valid legal basis in accordance with statutory regulations.

MBW does not proactively request the collection of sensitive personal data and only processes it within the extent necessary to provide the System according to the Customer’s lawful instructions.

5. Purposes of Processing Personal Data

Personal data is processed for the following purposes:

• Providing, operating, and maintaining the System;
• Performing professional functions according to the Customer’s configuration;
• Managing accounts and user permissions;
• Maintenance, technical support, and troubleshooting;
• Fulfilling obligations under the Contract, Agreement, and legal regulations;
• Resolving complaints and disputes related to the provision of the System.

MBW does not use the System to track or monitor users outside the professional scope defined by the Customer and does not use personal data for MBW’s own purposes.

6. Legal Grounds for Processing Personal Data

The processing of personal data is carried out based on one or more of the following grounds:

• Performance of the Contract and agreements between MBW and the Customer;
• Lawful instructions from the Data Controller;
• Lawful consent of the Data Subject (where required by law);
• Legal obligations under statutory regulations.

7. Data Retention and Deletion

Personal data is stored for the period necessary to fulfill the processing purposes and perform the Contract and Agreement between MBW and the Customer.

When the Contract terminates or upon a valid request from the Customer, MBW shall perform the deletion, destruction, or anonymization of personal data in accordance with the agreement and legal regulations, except where otherwise provided by law.

8. Sharing and Transferring Personal Data

Personal data is only shared in the following cases:

• Under the lawful designation of the Customer;
• At the request of competent state authorities;
• Other cases as prescribed by law.

9. Overseas Data Transfer

In cases where personal data is stored or processed on systems located outside the territory of Vietnam, the transfer of data abroad shall be carried out under the lawful designation of the Customer and in compliance with legal regulations on personal data protection.

10. Security Measures

MBW applies appropriate technical and organizational measures to protect personal data, including:

• Assigning access permissions based on roles and functions;
• Recording and controlling system access;
• Applying necessary technical security measures;
• Preventing and responding to incidents related to personal data;
• Training and raising awareness for relevant personnel.

11. Data Subject Rights and Implementation Mechanisms

Data Subjects have rights as prescribed by law on personal data protection, including the right:

• To be informed;
• To give consent, or withdraw consent;
• To access, correct, or delete data;
• To object to processing;
• To complain and claim compensation.

The exercise of these rights is conducted through the Customer as the Data Controller. MBW coordinates technical support within its role as the Data Processor and according to the Contract and Agreement with the Customer.

12. Contact Information

MobiWork Vietnam Technology Joint Stock Company

• Address: 3rd Floor, CT1 Building, Ministry of Public Security Housing Area, Pham Van Dong Street, Dong Ngac Ward, Hanoi.
• Email: phapche@mbw.vn
• Hotline: 1900 400 008

13. Effectiveness and Updates

This Policy is effective from the date of announcement by MBW and may be updated as necessary to comply with legal regulations and the operations of the MobiWork DMS System.