Privacy Policy

1. Scope of This Policy

1.1. This Data Protection and Processing Policy (this “Policy”) governs the manner in which AI Platform One Nexus Joint Stock Company, a company incorporated and operating under Enterprise Registration Certificate No. 0402292923 issued for the first time by the Business Registration & Enterprise Finance Division – Da Nang Department of Finance on 08/08/2025 (“One Nexus”), and One Mount Group Joint Stock Company, a company incorporated and operating under Enterprise Registration Certificate No. 0108911329 issued for the first time by the Business Registration & Enterprise Finance Division – Hanoi Department of Finance on 19/9/2019 (“OM”) (One Nexus and OM are collectively referred to as the “Company” or “we”/“us”), process the personal data of customers (“you”) in accordance with law (collectively referred to as “Processing” or “Process”) when you: (i) access or use the interaction channels owned (or developed/sponsored) by the Company, including but not limited to: the products, websites and groups on social networking sites (such as Facebook, Instagram, Twitter, etc.) owned and/or managed or controlled by the Company (“Interaction Channels”). Accordingly, the Account Service is one of the Joint Services, including but not limited to the feature for creating an account on OM’s ecosystem provided by us, which allows customers to log in and use the utilities and features on the Interaction Channels; (ii) use the information services and other services provided by OM and One Nexus through the available Interaction Channels (“Joint Services”); (iii) use other goods and services provided/used by OM, One Nexus or the subsidiaries, affiliates and companies within OM’s group of companies (“ES”), whether directly or through cooperation with third parties other than OM/One Nexus/ES, on the available platforms and Interaction Channels (“Separate Services”) (items (i), (ii) and (iii) are collectively referred to as the “Services”).

1.2. All of your information arising from and/or relating to the Joint Services will be jointly Processed and kept secure by One Nexus and OM (in their capacity as controllers) in accordance with this Policy. In the event that One Nexus and OM terminate their cooperation in providing the Joint Services, your consent collected by the parties under this Policy with respect to your personal data collected before the time of termination will remain independently valid for each Party. For clarity, the Processing of personal data by One Nexus and OM in their capacity as controllers means that One Nexus and OM will jointly decide on the purposes and means of the processing of personal data in accordance with this Policy and the agreement between OM and One Nexus.

1.3. With respect to the Separate Services provided by Nexus, OM or ES, whether directly or through cooperation with third parties other than OM, all personal data arising from and/or relating to such Separate Services will be Processed and kept secure by the ES providing that Separate Service in accordance with this Policy.

2. Types of Personal Data We Process

The types of personal data processed by us under this Policy may be:

2.1. Basic personal data: surname, middle name and name given at birth, and other names (if any); date of birth; date of death or disappearance; gender; place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current place of residence, hometown, contact address; nationality; images of the individual; telephone number, personal identification number, passport number, driver’s license number, vehicle license plate number; marital status; information about family relationships (father, mother, children, spouse); information about the individual’s digital accounts; and other information associated with a specific person or that helps identify a specific person and that is not Sensitive personal data as defined below.

2.2. Sensitive personal data: data revealing racial origin or ethnic origin; political or religious views or beliefs; information about private life, personal secrets or family secrets; health status; biometric data and genetic characteristics; data revealing the sex life or sexual orientation of an individual; data on crimes and violations of law collected and stored by law enforcement agencies; the location of an individual identified via location services; the login name and password for accessing an individual’s electronic identification account, and images of identity cards, citizen identification cards and people’s identity cards; the login names and passwords of bank accounts, bank card information, data on the transaction history of bank accounts, financial and credit information, and information on the financial, securities and insurance activities and transaction histories of customers at credit institutions, foreign bank branches, intermediary payment service providers, securities and insurance organizations and other licensed organizations; data tracking behavior and activities in the use of telecommunications services, social networks, online media services and other services in cyberspace; together with other personal data prescribed by law as requiring confidentiality or strict security measures.

3. How We Collect Personal Data

We may collect personal data in the following circumstances:

3.1. Directly from you

• From our Websites: we may collect personal data when you visit any of our websites or use any features or resources available on or through the Websites.
• From our Mobile Application: We may collect personal data when you download or use our application for mobile devices.
• From the Services: We may collect personal data when you register to use any service provided via the Website or the Application, or log in to the Website or the Application; or when you transact directly at our head office or places of business.
• From exchanges and communications with you: We may collect personal data when you contact us (in person, by mail, telephone, online, electronic communication or any other means), including through our customer surveys.
• From interactions or automated data collection technologies: We may collect information including the IP address, referring URL, operating system, web browser and any other information automatically recorded from the connection
• Cookies, flash cookies, pixel tags, web beacons or other tracking technologies.
• Third-party cookies, plug-ins or social network connectors.
• Any technology capable of tracking individual activity across devices or websites.
• Location information or other metadata provided by a device.
• Other means: We may collect personal data when you interact with us through any other means

3.2. We may receive personal data about you from other third parties

• If you interact with third-party content or advertising on the Website or in the Application, we may receive your personal data from the relevant third party, in accordance with that third party’s applicable and lawful privacy policy.
• If you choose to make electronic payments directly to us or via the Website or the Application, we may receive your personal data from third parties, such as payment service providers, for the purpose of such payment.
• To comply with our obligations under applicable law, we may receive personal data about you from competent authorities in accordance with law.
• We may receive personal data about you from public sources (such as telephone directories, advertising materials/leaflets, information published on websites, etc.).
• We may receive your personal data from companies in the Ecosystem where you are also a customer or a user of the services of those companies.

Whenever we collect personal data in this manner, we require, and will bind, the relevant third parties, by agreement or contract, to be responsible for collecting your consent to: (i) the third party’s provision of your personal data to us; and (ii) the processing of the data for the purposes consented to by you under this Policy.

4. Your Rights and Obligations Relating to the Personal Data We Process

We respect your personal data, and you have the following rights in relation to the manner in which we Process your personal data:

4.1. Your rights:

• Right to consent, to refuse consent, or to withdraw consent: You have the right to choose to consent, not to consent, or to withdraw your consent to our processing of your personal data; we will support you in doing so conveniently and transparently, in compliance with law and without affecting the performance of the contractual obligations that you have undertaken with us, and we will clearly inform you of any effects that may arise.
• Right to be informed about the processing of personal data: We are committed to transparency in the processing of personal data and will provide you with full information about the purposes, scope, methods, legal bases and related parties, and will assist you with look-ups and explanations upon request.
• Right to access and rectify personal data: You may access, view and request the rectification of your personal data Processed by us; we will update the information pursuant to valid requests in order to ensure that the data is always accurate and complete.
• Right to request the provision, deletion or restriction of, or to object to, the processing of personal data: we receive and consider your requests relating to the provision of copies of, the restriction of, or objection to the processing of personal data. With respect to data deletion requests specifically, implementation will be carried out in accordance with prevailing law and the relevant specialized laws with which we are responsible for complying and/or the performance of your contractual obligations with us.
• Right to complain, denounce, initiate lawsuits and claim compensation: You have the right to complain, denounce, initiate lawsuits or claim compensation for damage relating to the processing of personal data; we respect and ensure the full exercise of these lawful rights.
• Right to request the application of personal data protection measures: We will coordinate with, and create conditions for, you to request the competent authorities, as well as the relevant organizations and individuals, to take the necessary measures to protect personal data in accordance with law.

We will respond to your requests to exercise your rights in respect of personal data in accordance with prevailing law.

4.2. Your obligations

You also play a role in protecting personal data by:

• Protecting your own personal data and requesting us or other relevant organizations and individuals to protect your personal data.
• Respecting and protecting the personal data of others.
• Providing complete and accurate personal data when you have consented to our processing of your personal data.
• Complying with the applicable laws and regulations on personal data protection, and participating in preventing violations of such laws and regulations.
• Other obligations prescribed by the applicable laws and regulations.

5. Purposes of Processing Your Personal Data

We process your personal data when genuinely necessary for lawful activities and/or on the basis of one or all of the following grounds: (1) Your consent; (2) Legal obligations as prescribed by law; (3) The performance of a contract to which you are a party; (4) The protection of our legitimate interests or those of a third party in accordance with law; (5) Emergency situations in order to protect the life or health of the data subject or of another person in accordance with law.

We may process your personal data for the following purposes, including but not limited to:

• Providing our Products/Services to you, including but not limited to the following activities:
  • Providing, operating, maintaining and improving our Products/Services;
  • Carrying out customer identification, account management, transaction and customer care activities;
  • Preventing and combating fraud, money laundering, terrorist financing and other violations of law;
  • Meeting the management, inspection, examination and reporting requirements prescribed by the competent state authorities;
  • Performing legal obligations and obligations under the contract between you and us.
  • Analyzing data to assess and improve the quality of products and services;
  • Managing risks and ensuring the security of systems and customer information;
  • Making audio and video recordings and processing biometric data to serve transactions, security and compliance;
  • Carrying out internal governance activities in accordance with law.
• Marketing, advising on and introducing products and services:
  • Providing information about our products, services, promotional programs and offers;
  • Introducing the products and services of the Company’s partners on the basis that you have consented and the Company has confidentiality and personal data processing agreements in place in accordance with law.
• Creating a unified customer identity, participating in loyalty programs, and operating seamlessly among the companies in the Ecosystem:
  • Unifying customer identity between the Company and the companies in the Ecosystem where you are also a customer or a user of the services of those companies, so that you do not have to re-declare your information when using products and services at the companies in the Ecosystem;
  • Participating in linked loyalty programs and receiving the corresponding linked benefits under the Ecosystem’s policies from time to time.
• Processing your personal data through automated personal data processing systems, including artificial intelligence and machine learning models, for the following activities:
  • Building demand profiles and recommending products and services suitable for you;
  • Personalizing the content displayed on the application, recommending offer programs and predicting your product and service usage needs;
  • Assisting you in looking up information, answering questions and fulfilling service requests via the chatbot (virtual assistant) channel.

6. Protection of Your Personal Data

We are committed to processing your personal data safely and securely and to ensuring your rights with respect to personal data processing activities in accordance with the provisions of prevailing law.

We apply appropriate data processing methods as well as appropriate technical and organizational security measures in order to prevent the unauthorized access, reading, use, alteration, provision or destruction of personal data, or other unauthorized personal data processing.

However, the transmission of data over the Internet involves inherent risks and cannot be guaranteed to be absolutely secure. When using online channels to provide personal data, please use secure devices and connections, and take responsibility for keeping your login information and authentication factors confidential.

You should notify us immediately upon detecting signs of unauthorized use of your login information or suspecting that your data has been compromised. We will receive, assess and handle the incident in accordance with law, and will coordinate with you to mitigate risks and protect your personal data.

7. Provision and Transfer of Your Personal Data

We will not transfer (for a definite or indefinite period) your personal data without your consent in accordance with prevailing law.

Every third party with whom we share, or to whom we transfer, personal data under this Policy must have an appropriate legal basis for receiving and processing the data, and is obliged to apply personal data protection measures with a level of protection equal to or higher than the level provided for in this Policy and in accordance with applicable law. We only share personal data to the extent necessary to fulfill the purposes to which you have consented, and we require the data recipients to process the data only for those purposes. We may transfer/share or provide/use your personal data to/with the following related parties:

• Employees, workers, candidates, agents and authorized units of the Company, within the scope of their assigned functions and duties, in order to fulfill the data processing purposes stated in this Policy;
• Data recipients outside the Company, including but not limited to:
  • Business partners, service providers and subcontractors of partners;
  • Subsidiaries and affiliates of the Company;
  • Trusted third parties that have cooperative relationships with us (including the companies in the Ecosystem), provided that such parties have entered into written agreements or commitments on personal data confidentiality and compliance with the regulations on the protection of personal data and your privacy under Vietnamese law. The list of such companies is published and updated on the Company’s website from time to time. When there is a change to the list, we will notify you via the Company’s website and/or the communication channels that you have previously registered. You have the right to refuse the sharing of data with any company on this list by notifying us in accordance with the instructions in the section “Your rights and obligations relating to the personal data we process”
• Partners with whom we enter into product distribution agreements, under which we act as a distribution agent/organizing agent, for the purpose of advising on and providing products (including but not limited to insurance products) according to your needs and at your request;
• Third-party service providers that provide services to us (including but not limited to the artificial intelligence (AI) service providers used by the Company, such as: Soniox and Google LLC (Gemini) or other providers used by the Company from time to time in order to provide the AI features on the application. In such cases, the Company shares with the AI provider only the data necessary to process your request, including the content of the questions, requests, documents, images or other data that you proactively provide when using the AI features, together with the technical information necessary to operate the service. The Company does not share personal data beyond the scope necessary for the purpose of providing the AI features) in order to:
  • Support the operation of the Company’s activities, information technology systems, websites, applications or devices;
  • Provide you with the products and services that you have selected;
  • Carry out activities on the Company’s behalf, such as sending information, newsletters and surveys, providing customer care or other related support activities;
  • Provide payment services or payment intermediary services, or to related parties, where you conduct transactions or make payments via the website or the application or make payments directly to us, for the purpose of supporting, confirming and completing such payment transactions;
  • Serve inspection, audit, supervision and reporting work in order to ensure that our business operations and systems are operated safely, efficiently and in compliance with regulations.
• Transferees, potential purchasers or their representatives, where we consider, propose or carry out a sale, merger, consolidation, division, restructuring or transfer of all or part of our business or assets (including dissolution or liquidation), provided that we have taken and will take the reasonable and necessary measures required by law to ensure the safety and security of your personal data;
• Competent state authorities, upon a lawful request in accordance with law or in other circumstances permitted by law.

We are committed to ensuring that the sharing and processing of your personal data is always carried out in conformity with the processing purposes, the data minimization principle, the processing time limits, and the rights of data subjects under the law on personal data protection.

8. Third-Party Services

You may see advertisements or other content on any website, application or device that may link to the websites or services of our partners or other third parties.

We do not control the content or the links that appear on the websites or services of third parties, and we are not responsible for the practices employed by the third-party websites or services linked to or from any website, application or device.

These websites and services may be subject to the third party’s own privacy policies and terms of use.

9. Direct Marketing

The Company, its direct marketing partners or the service providers authorized by the Company will only carry out direct marketing contact with your prior, clear and specific consent in accordance with the Law on Personal Data Protection.

After you give your consent, the Company may contact you via email, messages, phone calls or appropriate electronic means to provide information about products, services and promotional programs that the Company believes may suit your needs.

You may refuse or withdraw your consent to direct marketing at any time through the contact methods published by the Company.

The withdrawal of consent will be processed as soon as possible in accordance with law, and from that point in time, the Company will immediately stop sending marketing information to you.

The withdrawal of consent to direct marketing does not affect the Company’s continued contact with you for other purposes on appropriate legal bases, including but not limited to: executing transactions, operating services, providing updates on the features of the products and services in use, or performing legal obligations.

10. Automated Processing of Personal Data

Operating principles of the automated personal data processing algorithm:

The system operates according to the following process: (i) aggregating your personal data from the sources described in this Policy, combined with the context of your interaction (such as the content of your requests, questions or commands), as input data; (ii) the Artificial Intelligence/Machine Learning system processes the input data through predictive analytics models (behavioral pattern recognition, classification, probability calculation) and/or generative Artificial Intelligence models (synthesizing context to generate appropriate response content, summaries or advice); (iii) the output is the result of automated processing in the form of recommendations, assessments, verifications, automatically generated response content or decision support, serving the purposes set out in this Policy. We are committed to complying with the provisions of prevailing Vietnamese law on the automated processing of personal data and to proactively updating our operating procedures when the law changes in order to protect your lawful rights and interests.

Impact on your lawful rights and interests:

The results of automated processing may be in the nature of recommendations or decision support, or may serve as a basis for the Company to make decisions affecting the provision of products and services to you. Content provided by generative Artificial Intelligence is for reference purposes; important decisions are always reviewed by authorized personnel before being applied. For artificial intelligence systems classified as high-risk under prevailing Vietnamese law, the Company designs the systems to ensure human oversight and intervention capabilities. In all cases, you have the right to request a review of the results of automated processing, to be given an explanation of the main factors leading to the results, and to be supported through alternative methods when necessary.

11. Cookies

When you use or visit the Company’s websites, the Company may place one or more cookies on your device. A “cookie” is a small file placed on your device when you visit a website. It records information about your device and your browser and, in some cases, your preferences and browsing habits. The Company may use this information to recognize you when you return to the Company’s websites, to provide personalized services on the Company’s websites, to compile analytics in order to better understand website activity, and to improve the Company’s websites. You can use your browser settings to delete or block cookies on your device. However, if you decide not to accept or to block cookies from the Company’s websites, you may not be able to take full advantage of all of the features of the Company’s websites.

The Company may process your personal data through cookie technology, in accordance with the provisions of this Policy. The Company may also use remarketing measures to serve advertisements to individuals whom the Company knows have previously visited its websites.

To the extent that third parties have embedded content on the Company’s websites (for example, social media features), such third parties may collect your personal data (for example, cookie data) if you choose to interact with that third-party content or use the services of the third party.

12. Data Storage

Your personal data will be processed at any point in time depending on your consent, unless otherwise provided by prevailing law, and will cease to be processed when you withdraw your consent or when so required under the prevailing regulations. The Company will retain your personal data for business or legal reasons for the duration of your dealings with the Company, and will also retain it for an additional period thereafter to serve the purposes stated in this Policy in accordance with prevailing law.

13. Updates and Amendments to the Policy

The Company may amend or update this Policy where necessary in order to conform to legal regulations or to changes in its provision of products and services. Any material amendments relating to your rights and obligations will be notified via the Company’s website and/or the communication channels that you have previously registered.

Where an amendment or update to this Policy results in a change to personal data processing activities that, as required by law, must have your consent, or that significantly affects the manner in which personal data is processed, the Company will provide appropriate information in accordance with the Law on Personal Data Protection for you to consider and make your choice of consent with respect to the purposes requiring consent.

14. Contacting the Company

If you have any questions relating to this Policy or the manner in which we process your personal data in any form, including the automated processing of personal data, please contact the Company via email [email protected].