1. Introduction

VAON Viet Nam Co., Ltd. ("VAON," "we," "us," or "our") is committed to protecting the personal data of our customers, partners, and website visitors. This Customer Data Protection Policy explains how we collect, use, store, share, and protect your personal information when you interact with our website (vaon.com.vn) and services.

This policy is designed to comply with applicable data protection laws, including:

• Decree 13/2023/NĐ-CP — Vietnam's Personal Data Protection Decree (effective July 1, 2023)
• Act on the Protection of Personal Information (APPI) — Japan's personal information protection law (amended 2022)
• International best practices aligned with GDPR principles

By submitting your personal information through our contact form or any other means on our website, you acknowledge that you have read and understood this policy.

2. Data Controller

The entity responsible for processing your personal data is:

3. Personal Data We Collect

We collect only the minimum amount of personal data necessary to respond to your inquiry and provide our services. The types of data we collect include:

Data You Provide Directly

Data Collected Automatically

4. Purpose of Data Processing

We process your personal data for the following specific purposes:

We will not use your personal data for purposes other than those stated above without obtaining your prior consent.

5. Legal Basis for Processing

We process personal data based on the following legal grounds, as required by Decree 13/2023/NĐ-CP and APPI:

• Consent (Điều 11, Nghị định 13): When you submit the contact form and check the consent checkbox, you explicitly agree to allow us to process your personal data for the stated purposes. You may withdraw your consent at any time.
• Contractual necessity: When processing is necessary to perform a contract with you or to take pre-contractual steps at your request (e.g., preparing a project proposal).
• Legitimate interest: When processing is necessary for our legitimate business interests, such as improving our services or ensuring website security, provided these interests do not override your rights and freedoms.
• Legal obligation: When processing is required to comply with applicable laws and regulations in Vietnam or Japan.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:

When personal data is no longer needed, we will securely delete or anonymize it so that it can no longer be associated with you.

7. Data Sharing & Third-Party Services

We do not sell, rent, or trade your personal data to third parties. We may share your data only in the following limited circumstances:

7.1 Service Providers

We use trusted third-party services to operate our business. These providers process data on our behalf and are contractually bound to protect your information:

7.2 Legal Requirements

We may disclose your data if required to do so by law, regulation, or valid legal process in Vietnam or Japan.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. You will be notified of any such change.

8. International Data Transfers

As an IT services company based in Vietnam serving clients primarily in Japan, your personal data may be transferred to and processed in countries outside of your country of residence, including Vietnam, Japan, the United States, and Singapore.

In accordance with Article 25 of Decree 13/2023/NĐ-CP (cross-border transfer of personal data) and APPI Article 28 (provision of personal data to third parties in foreign countries), we ensure that:

• All international transfers are carried out with appropriate safeguards in place
• Third-party processors in foreign countries are contractually bound to maintain equivalent data protection standards
• Data transferred to the United States is processed by service providers that maintain comprehensive security certifications (SOC 2, ISO 27001)
• Upon request, we will provide information about the data protection framework of the countries where your data is processed

9. Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption: All data transmitted through our website is encrypted via TLS/SSL (HTTPS)
• Access control: Personal data is accessible only to authorized personnel who need it for their work
• Infrastructure security: Our hosting infrastructure (AWS) employs industry-standard security controls, including firewalls, intrusion detection, and regular security audits
• Employee training: All team members receive training on data protection responsibilities
• Incident response: We maintain procedures to detect, report, and respond to data breaches. In the event of a breach affecting your data, we will notify you and the relevant authorities as required by law

While we take every reasonable precaution, no method of data transmission or storage is 100% secure. If you have concerns about the security of your data, please contact us immediately.

10. Your Rights

Under Decree 13/2023/NĐ-CP (Articles 9–16) and APPI, you have the following rights regarding your personal data:

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

• Vietnam: Ministry of Public Security — Department of Cybersecurity and High-Tech Crime Prevention (Cục An ninh mạng và phòng, chống tội phạm sử dụng công nghệ cao)
• Japan: Personal Information Protection Commission (個人情報保護委員会) — www.ppc.go.jp

11. Cookies & Analytics

Our website may use cookies and similar technologies for the following purposes:

We do not use advertising or tracking cookies. You can control cookie preferences through your browser settings. Disabling essential cookies may affect website functionality.

12. Children's Privacy

Our website and services are intended for business professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take immediate steps to delete it.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, legal requirements, or services. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• For significant changes, we will provide a prominent notice on our website
• If required by law, we will obtain your consent before applying changes that affect how your data is processed

We encourage you to review this policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this policy or our data protection practices, please contact us: