Personal Data Protection Policy (VN)

Revised 12/2025

This Personal Data Protection Policy (“Policy”) is issued in accordance with Decree No. 13/2023/ND-CP dated 17 April 2023 on Personal Data Protection (“Decree 13”), the Law on Cybersecurity 2018, the Law on Information Technology 2006, and other relevant laws of the Socialist Republic of Vietnam. By using our Products and/or Services, entering into transactions with us, or providing your personal data to us, you acknowledge that you have read, understood, and agreed to the contents of this Policy.

1. Notice Of Collection

   1. In providing our Products and/or Services and for the purposes of our lawful business operations, we may have collected, may be collecting, or may collect, process, and store your personal data manually or electronically in the course of your present or future dealings with us.

   1. The personal data collected includes but is not limited to the following ("Personal Data"):

      1. Full name, date of birth, gender, nationality, designation, company name, and contact details including address, telephone number, and email address;

      1. Identification information such as Citizen Identification Card/ID number, passport number, and relevant copies;

      1. Vehicle-related information including vehicle registration, ownership certificates, vehicle images, and license plate numbers;

      1. Images, photographs, audio or video recordings;

      1. Financial information including bank account details, payment information, and credit information (sensitive personal data);

      1. Any other personal data required for the Purposes.

1. Purposes of Processing

   1. Your personal data may be processed for the following purposes (the "Purposes"):

      1. Internal record keeping;

      1. Providing our Products and/or Services;

      1. Performing transactions,contracts, payments, and related obligations;

      1. Improving Products and/or Services;

      1. Research, data analysis, and statistical purposes;

      1. Marketing and customerengagement activities in compliance with law;

      1. Security, system integrity, and fraud prevention;

      1. Compliance withlegal obligations and lawful requests of Vietnamese authorities.

1. Obligations Of Data Subject

   1. You are required to provide accurate, complete, and up-to-date personal data for the Purposes.

   1. Where you provide personaldata of a third party, you represent that lawful consent has been obtained and you shall be responsiblefor any claims arising therefrom.

1. Disclosure Of Personal Data

   1. We may disclosePersonal Data to the following parties for the Purposes:

      1. Our parent, subsidiary, and affiliated companies in Vietnam and overseas;

      1. Business partners, service providers, agents, and contractors;

      1. Professional advisers including lawyers, auditors, and bankers;

      1. Competent state authorities asrequired by law.

      1. Any credit reporting agencies for the purpose of conducting orcontinuing credit checks for credit review, credit evaluation, debt recovery purposes, and legaldocumentation consequent to contract(s) or facility(ies) granted by financial institution(s);

      1. Any parties authorised and/or consented by you;

      1. In the event of your default, any debt collection or recovery agencies;

      1. Any insurance companies for the purpose of applying for, obtaining, and/or maintaining insurancepolicy(ies);

      1. Any person connected to the enforcement or preservation of any of our rights under the Products and/or Services;

      1. Any third parties for research anddevelopment purposes;

      1. Banks, financial institutions, regulatory bodies, and insurance companies; and/or

      1. Any other persons which we may think fit or necessary.

1. Retention And Destruction

   1. Personal data shall be retained as long as necessary for the Purposes or as required by law

   1. When no longer necessary for the Purposes and/or asrequired by law, personal data will be deleted, destroyed, or anonymized in accordance with our retentionpolicy and internal procedures. Such deletion and destruction methods may include but are not limited to:

      1. Permanent deletion from electronic systems, servers, databases, and backup storage devices;

      1. Data overwriting rendering the datairrecoverable;

      1. Physical destruction of paper records through shredding, pulverizing, or incineration inaccordance with applicable regulations; and/or

      1. Other technical and organizational measures toensure that personal data cannot be accessed, restored, or used in any manner.

1. Rights Of Data Subject

   1. Data Subjects have rights under Decree 13including the right to be informed, consent, access, correct, withdraw consent, delete data, restrictprocessing, and lodge complaints.

1. Contact

   1. Any requests, enquiries, or complaints relating to this Policy may be directed to: Personal Data Protection Officer Legal & Compliance Department Address: 33-35 Phạm Văn Ngôn, khu phố 7, Thủ Đức, Thành phố Hồ Chí Minh 700000, Vietnam Email: legal@imotorbike.com