Personal Data Protection Policy

1. General Information

This Personal Data Protection Policy ("Policy") is issued by Indochina Link Vietnam Co., Ltd. (ICLV)(Tax Code: 0314028165; Certificate of Eligibility for Accounting Services No. 157/KDKET, Ministry of Finance of Vietnam) in compliance withLaw on Personal Data Protection (No. 91/2025/QH15) ("PDPL"), effective from January 1, 2026 and guided by Decree 356/2025/ND-CP.

This Policy regulates Indochina Link Vietnam's processing of personal data belonging to:

• Clients who engage our accounting, tax, payroll, and advisory services
• Employees of client companies whose data is processed as part of our service delivery (e.g., payroll processing, PIT filing, work permit applications)
• Third parties whose personal data is provided to us under a service agreement, where the Client represents and warrants that such data was legally collected with proper consent
• Website visitors who submit information through contact forms or newsletter subscriptions. How the website itself handles cookies, analytics and forms is described in ourPrivacy Policy.

2. Definitions

3. Our Role as Controller and Processor

In delivering our services, Indochina Link Vietnam acts in the following capacities:

• Data Controller: When we collect personal data directly from clients, website visitors and job applicants for our own business purposes (e.g., responding to inquiries, managing client relationships, recruitment)
• Data Processor: When we process employee personal data on behalf of our clients (e.g., payroll processing, PIT declarations, SHUI registration, work permit applications)

When acting as a Data Processor, we process personal data solely in accordance with the Client's instructions and the terms of the service agreement. We do not use Client employee data for our own purposes.

4. Types of Personal Data We Process

4.1 Basic Personal Data

• Full name (Vietnamese and international spelling)
• Date of birth, gender, nationality
• ID card / Passport / CCCD number
• Tax Identification Number (TIN / MST)
• Social Insurance book number
• Phone number and email address
• Residential and permanent address
• Employment information (position, department, contract type)

4.2 Sensitive Personal Data

In the course of providing accounting, payroll, and immigration services, we may process:

• Financial data: Salary details, bank account numbers, tax deductions, insurance contributions
• Health records: Health check results (for Work Permit applications)
• Criminal records: Background check documents (for Work Permit applications)
• ID document images: Images of ID cards or citizen identity cards, where provided for an application
• Online behavior data (website visitors): Data from Google Analytics 4 and Microsoft Clarity, collected only if the visitor accepts Analytics in the cookie banner (see our Privacy Policy)

Photographs of a person submitted for Work Permit or TRC applications are treated as basic personal data under Decree 356/2025/ND-CP, and we handle them with the same care.

Sensitive personal data is processed on the basis of the data subject's consent or, where Law 91/2025/QH15 allows (Article 19), without consent, for example to perform an agreement or to meet obligations under Vietnamese law. For website visitors, consent to the collection of online behavior data is given through the cookie banner. For employees of our clients, where ICLV acts as Data Processor, the client as Data Controller decides the purposes of processing, deals with the data subject (including obtaining any consent that is required and telling them the data is sensitive) and ensures their rights. ICLV processes the data under the service agreement (see Section 14).

5. Purpose of Data Processing

We process personal data for the following purposes:

• Service Delivery: Accounting, bookkeeping, payroll, tax compliance, audit support, and immigration services
• Legal Compliance: Filing tax returns, SHUI declarations, and statutory reports as required by Vietnamese law
• Client Communication: Service updates, regulatory advisories, and responding to inquiries
• Risk Management: Conflict checking, anti-money laundering compliance (Decree 19/2023/ND-CP), and internal quality control
• Record Keeping: Audit trail maintenance and dispute resolution
• Recruitment: Assessing job applications

Where ICLV is the Data Controller, we rely on the data subject's consent (for example, ticking the consent box on a website form) or on the cases in Article 19 of Law 91/2025/QH15 that do not require consent, such as performing an agreement with the data subject and meeting obligations under Vietnamese law. Where ICLV is the Data Processor, we process data for the purposes set by the client in the service agreement.

Data from website contact and quote forms is used only to respond to the request and provide advice. We do not use it for marketing unless the person subscribes to the newsletter, and we do not sell it or share it with third parties for advertising.

6. Data Collection Methods

We collect personal data through:

• Direct submission by clients via engagement letters and service agreements
• Website contact forms, quote forms, and newsletter subscriptions (name, email, phone, company, service and message; quote forms also ask for business type, industry, number of investors, capital and additional services; the newsletter form asks for email only)
• Email correspondence and telephone communications, including CVs sent to career@indochinalink.com, which we use only for recruitment
• Data transfer from client systems (payroll data, employee records)
• Public registries and government databases (for verification purposes)

7. Data Processing Methods

• Manual Processing: Physical document handling, meetings, and verbal instructions
• Automated Processing: Electronic data entry, payroll computation systems, accounting software, and e-filing with government portals

All processing methods are subject to our internal access controls. Automated processing does not involve profiling or automated decision-making that produces legal effects on data subjects.

8. Data Retention

We retain personal data only for the period needed for its purpose:

Website contact and quote requests are automatically deleted from the database after 36 months, and backups are deleted on the same cycle. To unsubscribe from the newsletter, email info@indochinalink.com; we process the request within the periods in Section 9. For other records, upon expiry of the applicable retention period, personal data is deleted or anonymized unless continued processing is required by law.

9. Data Subject Rights

Under Article 4 of the Law on Personal Data Protection (91/2025/QH15), you have the right to:

• Be informed about the processing of your personal data;
• Consent or refuse, and request withdrawal of your consent;
• View and correct, or request correction of, your personal data;
• Request provision, deletion or restriction of processing of your personal data, and object to processing;
• Make complaints or denunciations, bring legal action, and claim compensation as provided by law (complaints may be addressed to the Ministry of Public Security or other competent authorities);
• Request competent authorities or the organizations involved to apply measures to protect your personal data.

To exercise any of these rights, please submit a written request toinfo@indochinalink.com, stating your name, contact details, the right you wish to exercise, and the data concerned. We may ask you to verify your identity. We acknowledge and respond within 2 working days of receiving a valid request, with the information you need about the procedure. We then carry out the request within the period set by Article 5 of Decree 356/2025/ND-CP:

• View, correct, or be provided with your data: 10 days.
• Withdraw consent, restrict processing, object to processing, or request measures to protect your data: 15 days.
• Delete your data: 20 days.

Where a request needs a processor or third party to act, the periods are longer as set out in the Decree. We may extend once, by no more than 10, 15 or 20 days respectively, and will tell you the reason. If we cannot delete data because the law requires us to keep it or for another justified reason, we will tell you why.

10. Data Security Measures

ICLV applies management and technical measures appropriate under the Law on Personal Data Protection, including:

• Encrypted connections: HTTPS/TLS
• Bot protection and rate limiting: Cloudflare Turnstile on website forms and limits on how often a form can be submitted
• Access Controls: Role-based access limits data visibility to staff assigned to handle the data
• Infrastructure: Our infrastructure provider (Cloudflare) encrypts stored data according to its standards

Data breach notification

• Where ICLV is the Data Controller (website data, job applicants): if a violation occurs that Article 23 of Law 91/2025/QH15 requires us to report, we notify the specialized personal data protection agency no later than 72 hours after discovering it, and inform the data subjects where the law requires. For data subjects in the EU/EEA, GDPR Article 33 (notice to the supervisory authority within 72 hours) and Article 34 (communication to data subjects) also apply.
• Where ICLV is the Data Processor for a client: we notify the client, as Data Controller, promptly and without undue delay (Article 23 of Law 91/2025/QH15; GDPR Article 33(2)).

11. Cross-Border Data Transfer

We use service providers located outside Vietnam, so personal data collected in Vietnam is processed or stored abroad. ICLV carries out its obligations for cross-border transfers under the Law on Personal Data Protection (91/2025/QH15) and Decree 356/2025/ND-CP. The providers and the data they receive are:

• Cloudflare: Hosts the website form backend and database (form submissions), provides the Turnstile bot check, and delivers site content.
• Telegram: An internal notification channel that receives the content of contact requests (name, email, phone, company, service, message, source page) and newsletter signups (email, source page). Telegram's servers are outside Vietnam.
• Google: Google Analytics 4 (only if the visitor accepts Analytics) and Google Maps (only when the visitor clicks to load the map).
• Microsoft: Microsoft Clarity (only if the visitor accepts Analytics) and Microsoft 365 email.

If a transfer to a Client's overseas parent company or other recipient is needed for our services, we will do so in line with the same law, including informing the data subject of the transfer and, where required, obtaining their consent.

12. EU/EEA Data (GDPR)

Where our services involve personal data originating from the European Union (EU) or European Economic Area (EEA), Regulation (EU) 2016/679 (GDPR) applies. For website visitors in the EU/EEA, the legal bases, rights, transfer arrangements and complaint rights are set out in Section 9 of our Privacy Policy. In addition:

• Lawful Basis: Processing is conducted under Article 6(1) (consent, contract or steps prior to a contract, legal obligation and, for security and abuse prevention, legitimate interests).
• Processor Safeguards: When acting as a Data Processor under Article 28 GDPR, we process client data per the client's written instructions and keep records of processing.
• Supervisory Authority Complaints: EU data subjects have the right to lodge complaints with a supervisory authority (Article 77).

13. Other Data Protection Laws

If you are covered by another data protection law, please contact us at the address in Section 17.

14. Client Obligations

When providing personal data to Indochina Link Vietnam, Clients are obligated to:

• Ensure that all personal data provided was collected lawfully and with proper consent
• Inform data subjects that their data will be shared with Indochina Link Vietnam for service delivery
• Ensure the accuracy and completeness of the personal data provided
• Comply with their own obligations under Personal Data Protection Law (91/2025/QH15) and applicable international laws

15. Changes to This Policy

This Policy may be updated to reflect changes in Vietnamese law or our data processing practices. Material changes will be posted on this page and communicated to Clients through our regular advisory channels. The "Last updated" date at the top of this page reflects the most recent revision.

16. Governing Law and Dispute Resolution

This Policy is governed by the laws of the Socialist Republic of Vietnam, including the Personal Data Protection Law (No. 91/2025/QH15). Disputes arising from this Policy shall be resolved through negotiation, and if unsuccessful, submitted to the competent courts in Ho Chi Minh City, Vietnam.

17. Contact Information (Personal Data Protection Contact)

For any inquiries, data subject requests, or privacy questions:

• Company: Indochina Link Vietnam Co., Ltd. (ICLV)
• Registered Office: Level 3, An Phu Plaza, 117-119 Ly Chinh Thang, Xuan Hoa ward, HCMC
• Email:info@indochinalink.com
• Phone: +84-282-2468-007
• Tax Code: 0314028165
• Response time: We acknowledge and respond to valid requests within 2 working days; see Section 9 for the periods to carry them out.