Privacy Policy

GENERAL TERMS AND CONDITIONS

ON PERSONAL DATA PROTECTION AND PROCESSING

These General Terms and Conditions on Personal Data Protection and Processing (“General Terms”) specify how S&I Ratings collects, processes, and protects the personal data of Data Subjects.

Article 1. Definitions

The terms used in these General Terms are defined as follows (unless otherwise explained by law):

1.1. “Personal data” is information in the form of symbols, letters, numbers, images, sounds, or similar forms in an electronic environment associated with a specific person or helps identify a specific person.

Personal data includes basic personal data and sensitive personal data.

1.2. “Basic personal data” includes:

1. a) Full name, middle name, and birth name, other names (if any);
2. b) Date of birth, date of death or missing;
3. c) Gender;
4. d) Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown, contact address;
5. e) Nationality;
6. f) Individual’s image;
7. g) Phone number, ID number, personal identification number, passport number, driver’s license number, vehicle registration number, personal tax code, social insurance number, health insurance card number;
8. h) Marital status;
9. i) Information about family relationships (parents, children);
10. j) Information about individual’s account number; personal data reflecting activities, activity history in cyberspace;
11. k) Other information associated with a specific person or helps identify a specific person that does not fall under sensitive personal data.

1.3. “Sensitive personal data” is personal data associated with an individual’s privacy that, when violated, directly affects the legitimate rights and interests of the individual, including:

1. a) Political opinions, religious beliefs;
2. b) Health status and private life recorded in medical records, excluding blood group information;
3. c) Information related to racial origin, ethnic origin;
4. d) Information about inherited or acquired genetic characteristics of the individual;
5. e) Information about physical attributes, unique biological characteristics of the individual;
6. f) Information about sexual life, sexual orientation of the individual;
7. g) Data on crimes, criminal acts collected and stored by law enforcement agencies;
8. h) Customer information of credit institutions, foreign bank branches, intermediary payment service providers, other permitted organizations, including: customer identification information as prescribed by law, account information, deposit information, asset deposit information, transaction information, information about organizations, individuals as guarantors at credit institutions, foreign bank branches, intermediary payment service providers;
9. i) Data on the individual’s location determined through positioning services;
10. j) Other personal data prescribed by law as specific and requiring necessary security measures.

1.4. “Personal data processing” is one or more activities impacting personal data, such as: collecting, recording, analyzing, confirming, storing, editing, publicizing, combining, accessing, retrieving, recovering, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data or other related actions.

1.5. “Data Subject” refers to individuals whose personal data is reflected and shared with S&I Ratings, including but not limited to individuals who are customers of S&I Ratings; users on S&I Ratings’ digital platforms; individuals belonging to organizations with legal relations with S&I Ratings; individuals who are/ belong to suppliers of products, services for S&I Ratings; collaborators, potential candidates, employees; shareholders of S&I Ratings or any other individuals related to or arising from the use, provision of products, services, labor relations, or other legal relations with S&I Ratings.

1.6. “Customer” refers to individuals or organizations that access, learn about, register, use, establish relationships, or are related to the products and services provided by S&I Ratings.

1.7. “Personal Data Provider” refers to the Data Subject or individuals, organizations on behalf of or with the consent of the Data Subject to provide and allow the processing of that individual’s personal data to S&I Ratings.

1.8. “Company” or “S&I Ratings” refers to S&I Ratings, including the headquarters, branches, representative offices, and transaction offices of the company (if any).

1.9. “Third Party” refers to organizations or individuals outside of S&I Ratings, Customers, and Data Subjects.

Article 2. General Principles

2.1. S&I Ratings values and respects the privacy, security, and safety of Personal Data. Additionally, S&I Ratings strives to protect Personal Data and the privacy of Data Subjects and comply with the law through Personal Data protection measures that meet and align with issued regulations;

2.2. S&I Ratings only collects and processes Personal Data in accordance with legal regulations and within the scope of documents and agreements concluded between S&I Ratings and Customers and/or related parties;

2.3. Depending on the role of S&I Ratings in specific situations as (i) Personal Data Controller; (ii) Personal Data Processor; or (iii) Personal Data Controller and Processor, S&I Ratings will exercise corresponding rights, responsibilities, and Personal Data processing principles in accordance with current legal regulations;

2.4. All rights and obligations of S&I Ratings, Data Subjects, and Personal Data Providers in these General Terms will not replace, terminate, or alter but will simultaneously be the rights and obligations that S&I Ratings, Data Subjects, and Personal Data Providers have in any document, and no provision in these General Terms implies limiting or eliminating any rights or obligations of the parties already established, except where otherwise agreed in writing;

2.5. Data Subjects/Personal Data Providers understand and agree that Personal Data (including both Basic Personal Data and Sensitive Personal Data) provided to S&I Ratings will not be limited to the scope of Personal Data to be provided but also includes Personal Data already provided to S&I Ratings. The continued use of S&I Ratings’ services and products or the continued maintenance of transactions and agreements established with S&I Ratings after the acceptance of these General Terms constitutes clear, voluntary, and affirmative consent from Data Subjects/Personal Data Providers allowing S&I Ratings to process Personal Data (including both Basic Personal Data and Sensitive Personal Data) throughout the process of receiving and processing Personal Data, starting from when S&I Ratings receives the information until there is a request to terminate data processing from Data Subjects/Personal Data Providers or as prescribed by law;

2.6. When providing Personal Data of another party (including but not limited to Personal Data of the organization’s transaction representative, dependents, related persons as prescribed by law, guardians, friends, beneficiaries, authorized persons, partners, emergency contacts, or other individuals) to S&I Ratings, the Personal Data Provider guarantees, ensures, and is responsible that the Personal Data Provider has provided complete information and obtained legal consent from the Data Subject allowing S&I Ratings to collect and process Personal Data according to these General Terms. The Personal Data Provider agrees that S&I Ratings is not responsible for verifying the legality or validity of such consent, and the responsibility for storing proof of consent lies with the Personal Data Provider. The Personal Data Provider must provide proof of the Data Subject’s consent upon S&I Ratings’ request. S&I Ratings is exempt from liability and entitled to compensation for damages and related costs when the Personal Data Provider fails to comply with the provisions of this section.

Article 3. Personal Data Processing Contents

3.1. Collection of Personal Data

3.1.1. To achieve the purposes stated in Article 3.2 below, S&I Ratings needs and/or is required to collect Personal Data of Data Subjects.

3.1.2. Methods and Means of Collecting Personal Data by S&I Ratings

S&I Ratings may collect Personal Data directly or indirectly from one or more sources as listed below, including but not limited to:

1. a) From direct meetings with the Personal Data Provider: S&I Ratings collects during interactions, work, service provision/use, direct meetings with the Personal Data Provider, and information provided by the Personal Data Provider;
2. b) From exchanges and communications with the Personal Data Provider when contact arises between the Personal Data Provider and S&I Ratings, such as via email, S&I Ratings’ hotline, electronic communications, or any other means (including but not limited to surveys and investigations conducted or obtained by S&I Ratings);
3. c) From S&I Ratings’ websites when the Personal Data Provider accesses and declares Personal Data;
4. d) From mobile applications when the Personal Data Provider downloads, uses, or declares Personal Data on S&I Ratings’ mobile applications;
5. e) From interactions or automatic data collection technologies: S&I Ratings may collect Personal Data of Data Subjects automatically recorded from the connection of the Personal Data Provider or related parties such as cookies, plug-ins, third-party social network connections, or any technology capable of tracking and collecting Personal Data on those devices or websites (e.g., Facebook, TikTok, Instagram…);
6. f) From competent state agencies such as the State Securities Commission, Vietnam Securities Depository and Clearing Corporation, stock exchanges, or other competent authorities in Vietnam;
7. g) From publicly available sources such as phone directories, advertising information/flyers, publicly available information on the internet, etc.;
8. h) From other sources where the Data Subject consents to the sharing/provision of Personal Data, or sources where collection is required or permitted by law.

3.2. Purposes of Personal Data Processing

3.2.1. S&I Ratings may process Personal Data for one or more of the following purposes:

3.2.1.1. General Purposes:

1. a) Reviewing the accuracy and completeness of the provided Personal Data; identifying or verifying the identity of the Data Subject and conducting the Data Subject verification process;
2. b) Establishing relationships between S&I Ratings and the Data Subject/Personal Data Provider/related Third Parties;
3. c) Serving other purposes related to S&I Ratings’ business activities that S&I Ratings deems appropriate from time to time;
4. d) Protecting the legitimate interests of S&I Ratings and complying with relevant legal regulations, including but not limited to collecting fees, charges, and/or recovering any debts, or handling complaint procedures, claims, or any agreements between the Data Subject/Personal Data Provider and S&I Ratings;
5. e) Evaluating any proposals related to rights, interests, or obligations under the documents, agreements between the Data Subject/Personal Data Provider and S&I Ratings;
6. f) Providing to service providers/partners of S&I Ratings to conduct transactions for the Data Subject/Personal Data Provider and/or S&I Ratings;
7. g) Preventing or mitigating threats to the life, health of others, and public interest;
8. h) Assessing risks, analyzing trends, statistics, planning, including but not limited to analyzing data processing on statistics, transactions, credit, and anti-money laundering, counter-terrorism financing, financing of weapons of mass destruction;
9. i) Detecting, preventing, and investigating crimes, attacks, or legal violations (including fraud, bribery, corruption, or tax evasion);
10. j) Conducting transactions such as transfers, dispositions, corporate reorganizations, or sales, exchanges of S&I Ratings’ operations, assets;
11. k) Complying with and adhering to S&I Ratings’ internal policies, procedures, and any rules, regulations, guidelines, directives, or requirements issued by competent state agencies as prescribed by law;

3.2.1.2. In addition to the General Purposes stated in Article 3.2.1.1 above, S&I Ratings may also process Personal Data for one or more corresponding purposes for each of the following subjects:

1. A) For Customers
2. a) Assessing the legal records, financial capacity, and compliance conditions of Customers for any transactions, products, and services proposed or provided by S&I Ratings;
3. b) Providing transactions, products, services implemented by S&I Ratings (including but not limited to products implemented by third parties in cooperation with S&I Ratings as prescribed by law);
4. c) Promoting, informing about products, services, promotional programs, research, surveys, news, updates, events, contests, awarding related prizes, media activities, introductions related to S&I Ratings’ services, products, and services of other partners cooperating with S&I Ratings;
5. d) Contacting to exchange information, providing documents or other materials related to transactions and the use of products, services at S&I Ratings;
6. e) Notifying information about obligations, rights, changes in features, improvements, and enhancements of the convenience, quality of products, services;
7. f) Preparing financial reports, operational reports, or other related reports as prescribed by law;
8. g) Conducting market research, surveys, and data analysis related to any products, services provided by S&I Ratings (whether conducted by S&I Ratings or another third party cooperating with S&I Ratings) that may relate to Customers/Data Subjects.
9. B) For product, service providers, partners leasing, renting assets, cooperating with S&I Ratings
10. a) Concluding and implementing purposes under related documents, agreements;
11. b) Contacting for work, exchanging, confirming information during the implementation of work/services between the Personal Data Provider and S&I Ratings.
12. C) For potential candidates, collaborators, and employees
13. a) Review the conditions of candidates and collaborators; evaluate applications, documents, and records for the purpose of appraisal, assessing the qualifications of candidates and collaborators, registering candidate and collaborator profiles, and serving the recruitment process and service contract signing;
14. b) Sign and manage employment contracts, service agreements with candidates, collaborators, and employees;
15. c) Train, inspect, and evaluate the quality of work and compliance with obligations under contracts, agreements, and commitments with S&I Ratings;
16. d) Manage personnel records and carry out procedures in accordance with legal regulations with competent authorities such as labor agencies, insurance, tax authorities, the State Securities Commission, etc.;
17. e) Perform necessary activities and tasks arising from agreements and contracts signed with third parties depending on the purpose and needs at each time, such as training services, health insurance, medical examination and treatment, transportation, tourism, event organization, etc.;
18. f) Carry out other purposes related to the development and management of human resources.

3.2.2. S&I Ratings will seek permission from the data subject before using their personal data for purposes other than those stated in these General Terms.

3.3. Processing personal data in special cases

3.3.1. S&I Ratings may record, videotape, and process personal data collected from surveillance cameras (“CCTV”) in areas equipped with CCTV (including but not limited to office areas, hallway areas, exit areas, etc.) in accordance with security requirements in S&I Ratings’ operations and for customers as prescribed by law;

3.3.2. S&I Ratings always respects and protects children’s personal data. In addition to the personal data protection measures prescribed by law, before processing children’s personal data, S&I Ratings will verify the child’s age and seek consent from (i) the child and/or (ii) the child’s parents or guardians as prescribed by law;

3.3.3. In addition to complying with other relevant legal regulations, for the processing of personal data related to the personal data of missing persons/deceased persons, S&I Ratings must obtain consent from one of the related persons as prescribed by current law.

3.4. Transfer and Disclosure of Personal Data

3.4.1. S&I Ratings will not sell, exchange, or rent (temporarily or permanently) the personal information of data subjects without the consent of the data subjects in accordance with current law. However, to fulfill the purposes and activities of personal data processing stated in these General Terms, the personal data provider understands and agrees that S&I Ratings may disclose personal data to one or more of the following parties:

1. a) Member units of S&I Ratings, including but not limited to subsidiaries, affiliates, joint ventures, and associated companies identified by S&I Ratings from time to time;
2. b) Employees and departments within S&I Ratings for the purposes stated in these General Terms and the documents and agreements signed between the Customer and S&I Ratings;
3. c) Consultants, lawyers, advisors, accountants, auditors of S&I Ratings or the Customer;
4. d) Competent state agencies in Vietnam or any individual, regulatory agency, or third party that S&I Ratings is permitted or required to disclose according to the legal provisions of any country, or according to any document or agreement between the third party and S&I Ratings;
5. e) Business partners, reward providers, gift providers, co-branding partners, participants or coordinators of loyalty programs, advertisers, charitable organizations, or non-profit organizations, any related organization for the purpose of operating and implementing S&I Ratings’ business activities, system operators, application or device operators, or providers of any product or service chosen by the Customer or for the purposes stated in these General Terms;
6. f) Any individual or organization related to the enforcement or maintenance of any rights or obligations under the agreements between the Customer/Data provider and S&I Ratings;
7. g) Parents, spouses, children, heirs of the data subject in case the data subject has died or been declared missing;
8. h) Third parties that the Customer agrees to or S&I Ratings has a legal basis to share personal data.

3.4.2. S&I Ratings considers personal data to be private and confidential. Apart from the parties mentioned above, S&I Ratings does not disclose personal data to any other party, except in the following cases:

1. a) With the consent of the data subject;
2. b) When S&I Ratings is required or permitted to disclose according to legal provisions or decisions of competent state agencies;
3. c) When S&I Ratings transfers rights and obligations under the agreements between the related parties and S&I Ratings or complies with legal provisions.

3.5. Transfer of Personal Data Abroad

3.5.1. To fulfill the purpose of personal data processing stated in these General Terms, S&I Ratings may need to provide/share personal data to related third parties of S&I Ratings, and these third parties may be located in Vietnam or any other location outside the territory of Vietnam.

3.5.2. When providing/sharing personal data abroad, S&I Ratings will require the recipient to ensure that the transferred personal data is kept confidential and secure. S&I Ratings and the recipient ensure compliance with legal obligations and regulations related to personal data protection.

3.6. Methods of Personal Data Processing

Depending on the purpose of personal data processing, S&I Ratings or S&I Ratings’ data processors or third parties authorized to process data for S&I Ratings may apply appropriate processing methods, including but not limited to automatic, manual, or other methods in accordance with legal provisions and S&I Ratings’ regulations from time to time.

3.7. Duration of Personal Data Processing

Depending on specific activities, personal data may be processed by S&I Ratings after being provided, collected, and concluded when the data processing is completed in accordance with the purpose or until the personal data has been deleted as prescribed (whichever comes later).

3.8. Other Contents

Other contents related to personal data processing not stated in these General Terms shall be applied according to current legal documents.

Article 4. Rights and Obligations of Data Subjects Related to Personal Data Provided to S&I Ratings

4.1. Data subjects have the following rights: (i) Right to be informed; (ii) Right to consent; (iii) Right to access; (iv) Right to withdraw consent; (v) Right to erasure; (vi) Right to restrict processing; (vii) Right to data portability; (viii) Right to object to processing; (ix) Right to complain, denounce, and initiate lawsuits; (x) Right to claim compensation; (xi) Right to self-protection; and (xii) other related rights as prescribed by law. The specific content of these rights complies with current legal regulations.

4.2. S&I Ratings, through reasonable efforts, will fulfill legitimate and valid requests from data subjects within the statutory period from the time of receiving a complete, valid request and related processing fees (if any) from the data subject, subject to S&I Ratings’ right to invoke any exemptions and/or exceptions as prescribed by law;

4.3. In the event that the data subject withdraws their consent, requests data erasure, restricts data processing, and/or exercises other related rights concerning any or all of their personal data, and depending on the nature of the data subject’s request, S&I Ratings may consider and decide to discontinue transactions or cease providing products and services related to the use of the Customer’s/data subject’s personal data due to the inability to ensure the standards/quality of products and services as assessed by S&I Ratings or due to legal requirements to collect related personal data when providing products and services. Actions taken under this provision are considered unilateral termination of transactions by the data subject/Customer for any relationship with S&I Ratings and may entirely lead to breaches of obligations or commitments under documents and agreements between the data subject/Customer and S&I Ratings. In such cases, S&I Ratings will notify the data subject/Customer of the termination of products and services, and the Customer/data subject will be fully responsible for any related damages incurred.

Customers/data subjects should note that, due to the nature of S&I Ratings’ operations, in cases where the law requires S&I Ratings to retain personal data in certain circumstances, S&I Ratings cannot comply with the data subject’s request for data erasure if such erasure would result in a legal violation;

4.4. For security purposes, the data subject may need to submit their request in writing or use other methods to prove and verify their identity. S&I Ratings may require the data subject to verify their identity before processing the data subject’s request;

4.5. Data subjects are responsible for protecting their personal data, requesting related organizations and individuals to protect their personal data. At the same time, data subjects will respect and protect the personal data of others;

4.6. Data subjects must provide complete and accurate personal data to S&I Ratings when entering into contracts or using services provided by S&I Ratings;

4.7. Data subjects must comply with legal regulations on personal data protection and participate in preventing and combating violations of personal data protection regulations;

4.8. In the event of changes or adjustments to personal data, the data subject/personal data provider and/or related parties are responsible for contacting and promptly notifying S&I Ratings so that S&I Ratings can update those changes and adjustments in a timely manner. The data subject/personal data provider and/or related parties will be fully responsible for any delay in notification; at the same time, such delay will exempt S&I Ratings from any arising damages or risks (if any);

4.9. Data subjects must update information posted on S&I Ratings’ website at https://S&I Ratings.com.vn/bao-mat and comply with any changes (if any) related to these General Terms;

4.10. Data subjects must immediately notify S&I Ratings if they discover or suspect that their personal data has been exposed, which may lead to risks during the use of products and services, or any violations of personal data protection according to these General Terms that the data subject may recognize;

4.11. Data subjects understand and agree that S&I Ratings has the right to refuse to fulfill the data subject’s requests in certain cases, including but not limited to: (i) The data subject does not follow the procedures and processes guided by S&I Ratings; (ii) The data subject does not provide or provides incomplete documents to verify their identity; or (iii) In cases where S&I Ratings assesses signs of fraud or violations of personal data protection; or (iv) Legal regulations do not allow the fulfillment of the data subject’s request;

4.12. Data subjects confirm that by accepting these General Terms, they have been informed by S&I Ratings, are fully aware of, and agree with all the contents that need to be notified before S&I Ratings processes personal data, as detailed in these General Terms. Data subjects agree that S&I Ratings does not need to re-notify before processing personal data.

Article 5. Risks of Personal Data Disclosure and Protection Measures

5.1. The data subject agrees that the processing of personal data will always carry potential risks due to system errors, transmission errors, force majeure events, viruses, cyber-attacks, or hardware and software failures, actions or operations by the Customer/data subject or any other third party affecting the provision and processing of the data subject’s personal data. Risks may arise such as personal data being disclosed or stolen by another party, leading to the use of this personal data for unintended purposes or beyond the control of S&I Ratings and the data subject, causing both material and mental losses.

5.2. S&I Ratings considers personal data as its most important asset and always strives to ensure confidentiality, safety, legal compliance, and to limit any unwanted consequences or damages that may occur.

5.3. The responsibility to protect personal data is a mandatory requirement set by S&I Ratings for all employees. S&I Ratings fulfills its responsibility to protect personal data in accordance with current legal regulations using the best security methods as prescribed by law and regularly reviews and updates management and technical measures when processing personal data (if any).

Article 6. Storage of Personal Data

6.1. Personal data stored by S&I Ratings will be kept confidential. S&I Ratings will take reasonable measures to protect personal data when stored at S&I Ratings.

6.2. S&I Ratings stores personal data for the necessary period to complete the purposes according to the documents signed between the related parties and S&I Ratings and according to these General Terms, unless a longer storage period is required or permitted by the related parties and current legal regulations.

Article 7. Amendments and Supplements to the General Terms

S&I Ratings may amend and supplement the contents of these General Terms from time to time and ensure that the amendments and supplements comply with relevant legal regulations. Notifications of any amendments or supplements will be updated and posted on S&I Ratings’ website at https://S&I Ratings.com.vn/bao-mat and/or notified to the data subject/Customer or related parties through communication means deemed appropriate by S&I Ratings.

To the extent permitted by current law, the continued use of S&I Ratings’ services and products by the Customer or related parties, or the continued maintenance of transactions and agreements with S&I Ratings, means that the data subject/Customer/related parties agree to the amended and supplemented contents of these General Terms without any conditions.

Article 8. Contact Information for Personal Data Processing

For any questions related to S&I Ratings’ processing of the data subject’s personal data, please contact the following:

• For Customers: S&I Ratings Hotline
• For candidates, collaborators, employees: S&I Ratings Human Resources Department
• For service providers, other partners: according to the contact information in the relevant documents and agreements.

Article 9. Consent Terms

9.1. By using any service, product, or accessing any website, application, or device of S&I Ratings or connected to S&I Ratings, or establishing transactions or allowing S&I Ratings to process personal data (directly or through a third party), the data subject/Customer is deemed to have accepted and unconditionally agreed to the policies mentioned in these General Terms and any changes (if any) from time to time.

9.2. These General Terms are an inseparable part and must be read, understood, and agreed upon in conjunction with the contracts, agreements, proposals, commitments, and registrations for using products and services established between the data subject/Customer/personal data provider and S&I Ratings. The General Terms will take precedence in the event of any conflict or inconsistency with the contracts, agreements, proposals, commitments, and registrations for using products and services governing the relationship between the data subject/Customer/personal data provider and S&I Ratings, whether signed before, on, or after the date the data subject/Customer/personal data provider accepts these General Terms.