Personal Data Collection and Processing Policy

1. Personal Data We Collect

When You register an account and use our services, we may collect the following categories of personal data:

• Full name;
• Mobile phone number;
• Email address;
• Contact/transaction address;
• Date of birth (where age verification is required);
• Account information (username, encrypted password);
• Technical data generated through use of the service: IP address, device type, browser, cookies, and activity logs on the platform.

We do not proactively collect sensitive personal data (such as health status, religion, financial information, or biometric data), except where a specific business need arises and Your separate consent has been obtained in accordance with applicable law.

2. Purposes of Collection and Processing

1. Creating, verifying and managing Your user account;
2. Providing, operating and improving the quality of our products and services;
3. Contacting You, providing customer care, technical support and handling complaints;
4. Sending transaction notifications and service updates; sending promotional and marketing information (only where You have consented to receive such information);
5. Conducting analysis and statistics for product research and development;
6. Ensuring system safety and security, and preventing fraud and unauthorized access;
7. Complying with lawful requests from competent state authorities.

We do not use Your personal data for any purpose other than those set out above without Your additional consent, except as otherwise provided by law.

3. Legal Basis and Data Processing Principles

Your personal data is processed on the basis of the consent You provide upon account registration, and in accordance with the following principles: lawfulness; transparency as to purpose; limitation to the scope necessary for the stated purpose; accuracy and timely updating; security throughout the processing lifecycle; and retention only for the period necessary to achieve the processing purpose, all in accordance with the PDPL and the Decree.

4. Sharing of Data with Third Parties

We do not sell or trade Your personal data for commercial purposes. Personal data is only shared in the following circumstances:

• With partners providing technical infrastructure, cloud hosting, payment processing, or logistics services that directly support the operation of our services, on the basis of a data protection commitment with us;
• With competent state authorities upon a written request made in accordance with the procedures prescribed by law;
• Where You have consented to sharing with a specific third party;
• In the event of a merger, consolidation, or transfer of business operations, provided that the transferee continues to comply with this Policy.

Where Your data is processed on a system/server located outside the territory of Vietnam, we undertake to fully comply with the requirements applicable to cross-border transfer of personal data under the PDPL and the Decree, including, where applicable, preparation of a cross-border data transfer impact assessment dossier.

5. Data Retention Period

Your personal data is retained for as long as You maintain Your account/use our services and for the period necessary to fulfil the purposes set out in Section 2, or for such mandatory retention period as required under applicable sector-specific laws. Upon expiry of the retention period, or upon Your valid request to delete Your account, we will delete or anonymize the data, except as otherwise required by law.

6. Data Security Measures

We apply technical and organizational security measures to protect Your personal data, including: encryption of sensitive data and passwords; use of secure connections (SSL/TLS); access control based on the principle of need-to-know; network security monitoring; periodic data backups; and requiring personnel and partners with access to Your data to sign confidentiality/data protection undertakings. In the event of a personal data breach, we will notify the competent authority and You within the time limit prescribed under the PDPL and the Decree (currently 72 hours from the time the breach is discovered).

7. Your Rights over Your Personal Data

In accordance with the PDPL, You have the following rights with respect to Your personal data:

• The right to be informed about the processing of Your personal data;
• The right to consent or to withdraw consent to the processing of Your personal data;
• The right to access, view, and request correction of Your personal data;
• The right to erasure of Your personal data (the “right to be forgotten”);
• The right to restrict or object to the processing of Your personal data;
• The right to request a copy of Your personal data (data portability);
• The right to lodge a complaint, denunciation, initiate legal proceedings, and claim compensation for damages in accordance with law.

To exercise the rights above, please contact us using the details in Section 10 of this Policy. We will respond to and process Your request within the time limit prescribed by applicable law.

8. Cookies and Tracking Technologies

Our website may use cookies and similar technologies to remember Your login session, improve Your user experience, and analyze site traffic. You may adjust or disable cookies through Your browser settings; however, doing so may affect certain functionalities of the website.

9. Minors

Our services are not directed at users under the age of 18. If You are under 18 years of age, registration and consent to this Policy must be given by Your parent or legal guardian in accordance with applicable law.

10. Contact Information

If You have any questions, requests, or complaints regarding the processing of Your personal data, please contact:

DA NANG FINTECH LAB LIMITED LIABILITY COMPANY

Address: Da Nang Software Park 2, Nhu Nguyet Street, Hai Chau Ward, Da Nang City

Data protection contact email: contact@dfl24.com

11. Changes to this Policy

We may update or amend this Policy from time to time to reflect changes in applicable law or our business operations. The updated version will be published on our website and will take effect from the date of publication. We encourage You to review this Policy periodically to stay informed of any changes.