Notice Of Personal Data Processing

The Notice of Personal Data Processing (“Notice”) is intended to notify and obtain your consent (as the Data Subject) in accordance with Decree No. 13/2023/ND-CP dated 17/4/2023 of the Government on personal data protection and relevant laws when Shinhan Vietnam Finance Company Limited, having business registration certificate No. 0304946247 (“SVFC”) collects and processes personal data. This Notice is part of the terms and conditions governing the relationship between the data subject and SVFC (if any). By providing information to SVFC, the data subject understands and agrees to all the contents specified in this Notice.

1. Type of Personal Data to be Processed

In order to help SVFC respond to the data subject’s inquiries, provide products and services to the data subject and/or provide products and services in general, SVFC may need and/or be required to process personal data [1] of the data subject, including but not limited to personal data that directly or indirectly related to the data subject and/or the data subject's transactions with SVFC, and other necessary information related to the data subject and the data subject's transaction(s) with SVFC or the data subject's transactions with SVFC by third parties.

[1] Personal data includes:
• General personal data under Article 2.3 Decree No. 13/2023/ND-CP
• Sensitive personal data under Article 2.3 Decree No. 13/2023/ND-CP
• Credit information under Article 3.1 Decree No. 58/2021/ND-CP

2. Methods to Collect Personal Data

SVFC may collect information from the data subject and from various sources, including but not limited to:

From the data subject's relationship with SVFC, such as information provided by the data subject in the requests to use SVFC's products and services, when using SVFC's products and services, when conducting surveys, participating in promotion programs or financial capacity assessments;

From analyzing behavior of using and managing transaction(s), performed through the data subject's credit card(s)/loan(s);

From third parties relevant to the data subject, such as referees, employers, joint account owners, security solution providers, guarantors and indemnifiers, insurers, retail systems or service providers being partners of SVFC subject to the data subject's prior approval; third parties whose information has been declared, managed, used and archived by the data subject for a period of time in accordance with the law;

Through verbal communications, images and written responses from the data subject to SVFC and/or SVFC's authorized parties via text messages, telephone or mobile devices, email, fax, mail, electronic message browser, social networking sites or any other information channels;

From recordings of surveillance cameras (CCTV) installed at SVFC's business location; and at locations where the data subject conducts transactions related to SVFC (such as, images collected from cameras at banks' ATMs);

From competent authorities to clearly determine the current and past financial situation of the data subject, competent/permitted authorities to provide credit reports;

From other sources, such as financial institutions, survey consultants, social media, marketing, credit reference, fraud prevention, affiliates for SVFC's promotional programs;

From other sources having the consent of the data subject for providing information related to the data subject and/or open sources, without restriction;

Through files created by the websites that the data subject visits (cookie) or similar tools;

From any information provided and/or collected when the data subject accesses SVFC's websites and/or downloads SVFC's mobile applications.

3. Purposes of Personal Data Processing

SVFC may process the personal data of the data subject for the following purposes (“Purposes”):

Review/appraise requests of the data subject related to the use of SVFC’s products/services, verify the data subject’s financial situation, conduct credit history checks and collect or provide credit references;

Verify the data subject’s transactions related to SVFC’s products and services to ensure the accuracy of the transactions;

Manage and maintain the data subject’s loan(s), credit cards;

Manage offers, contests, promotional program, customer care programs and/or enhance the data subject’s experience when using SVFC’s services/products;

Better understand the data subject’s current and future investment needs and financial situation;

Marketing and providing to the data subject information about SVFC or third parties' products, services, offers and/or competitions that may be of interest to the data subject (with or without remuneration to SVFC), including but not limited to product and service management provided by SVFC's co-branded partners or providing insurance;

Innovating SVFC's products/services as well as testing, researching, analyzing, developing new products and features of SVFC's products and/or services;

Researching how the data subject uses the products/services for the purpose of promoting SVFC's products/services;

Informing the data subject of information about benefits and changes to features of SVFC's products/services;

Providing to the data subject products and services provided or managed by SVFC's service providers, contractors (including subcontractors), vendors, business partners;

Respond to inquiries, complaints of the data subject and resolve disputes generally;

Conduct research for analytical purposes including but not limited to data mining and analysis of the data subject’s transactions with SVFC;

To create and maintain credit, behavioral and risk-related models for automated credit scoring or suitability and/or any purpose related to audit, compliance and risk management purposes or functions;

Analyze credit scores, assess and monitor the debt repayment capacity of the data subject as part of the lending and loan management process;

Transmit or transfer rights, benefits and obligations under the agreements that data subject entered with SVFC;

Protect or enforce any rights of SVFC, including but not limited to SVFC’s rights to process, collect debts;

Conduct anti-money laundering checks; detect, investigate, prevent and prosecute crimes;

Comply with regulations and law enforcement requirements; ensure that SVFC discloses information as required by applicable laws; other purposes as required or permitted by law, regulations, guidelines or decisions of courts and/or competent authorities;

Provide to the Credit information Company for creating Credit information products to provide services to SVFC.

SVFC ensures to notify and obtain the consent of the Data Subject before processing personal data of the data subject for purposes other than the aforementioned Purposes.

4. Transfer of Personal Data of Data Subject

Being part of the provision of products and services to data subject and/or in order to implement one or any purpos(es) stipulated in this Notice, the data subject agrees and allows SVFC to transfer personal data of the data subject and personal data of third parties relevant to the data subject inside or outside of the territory of Vietnam, specifically:

Member enterprises of Shinhan Financial Group;

Affiliates, partners, information verification, data compilation and analysis service providers duly operate and competent authorities in order to: (i) verify/compare personal data, evaluate financial capacity/payment ability, appraise credit dossier and serve post-lending loan management requirements, according to internal regulations on information confidentiality of SVFC from time to time; (ii) report on credit and provide credit information per request of competent authority, according to the laws from time to time.

Organizations supporting SVFC in processing transactions which data subject requests, including but not limited to administrative service provider, marketing, printing, delivery and transportation materials to the data subject, process of business, travelling, debt colletion, market research, gift exchange, archive and manage dossiers, data entry, legal, website or social communication media, telecommunication, message or electronic mail transmission, calling, infrastructure and technology support, risk report, credit decision, information safety, software maintenance and license, consultancy service, and/or other services.

Organizations providing services to SVFC in the process of providing or transmitting information about products/services of SVFC to data subject;

The National Credit Information Centre of Vietnam [2], credit informations enterprises and any other organizations established by the State Bank of Vietnam or any other organization having jurisdiction over SVFC;

Any party with a confidentiality obligation to SVFC has undertaken to keep the information confidential;

Individuals, organizations (including but not limited to accountants, auditors, attorneys, financial consultants or other professional consultants) authorized by data subject;

Third parties through debt selling, or acquisition of enterprises by any enterprise of Shinhan Financial Group, provided that the data receiver simultaneously process personal data of the data subject for the same original purpose at the time the data subject provides personal data to SVFC or has personal data processed by SVFC;

Any entity providing confidentiality solutions which SVFC uses to provide services and utilities to the data subject;

Any person having intention to settle the outstanding balance of loan/credit card which SVFC granted to the data subject;

Any credit ranking organization, insurance enterprise or insurance broker;

Any other financial organizations, sellers, card organization relevant to the credit cards issued by SVFC for the data subject, charity organization ot non-profit organization.

Any agency having the authority to request for information provision under the laws.

[2] Information of the Credit information company which SVFC is participating is:

• Name of the company: VIETNAM CREDIT INFORMATION JOINT STOCK COMPANY (PCB)
• Enterprise registration certificate: number 0102547296
• First registration: 27/11/2007

Not conflicting with other contents stipulated in this Notice, should Certificate of eligibility to operate credit information service provision of PCB be revoked, SVFC will suspend the provision of personal data of the data subject to PCB and the data subject agrees that its personal data at PCB is processed under the regulations of the Government on credit information service provision. SVFC will inform the data subject on the process of personal data at PCB. The personal data confirms that it understands and is aware that personal data is collected, processed and archived in at least 05 (five) years to serve the purpose of creating credit information products due to specialized softwares of PCB.

5. Marketing

SVFC is entitled to share personal data of the data subject to third parties to implement targeted advertising.

The data subject understands and agrees for SVFC and Shinhan Financial Group, affiliates, partners and service providers of SVFC to process personal data of the data subject for advertisement, marketing, market research and promotion under the laws.

At any time, the data subject is entitled to inform SVFC on not wanting to receiving marketing communications information directly from SVFC, from any organization or individual in SVFC and Shinhan Financial Group and/or from seller and strategic partner of SVFC by informing SVFC following the contact point provided in Article 11 of this Notice. In some certain circumstances, when marketing information from SVFC is sent via browser to mobile devices of the data subject, the data subject shall perform some certain steps to stop receiving information.

6. Term for Archiving and Processing Personal Data of the Data Subject

Before, within and after the time the data subject using services and products of SVFC, personal data of the data subject is archived and processed according to this Notice; and/or the terms and conditions of other agreements of the data subject and SVFC; or whenever needed to perform obligations of SVFC to data subject; or performed to protect the interests of Shinhan Financial Group and SVFC and/or the customers where necessary; or upon the requirements of applicable laws and policies of SVFC relevant to the archival and process of data.

7. Potential undesirable consequences and damages

When appointed (such as: in Loan/Credit card application form) and permission to process personal data, the data subject is subject to providing the personal data to SVFC sufficientlyl, truthfully and accurately for SVFC to process request of the data subject related to products/services of SVFC.

Should the data subject refuses to provide such compulsory personal data, or fails to provide accurate personal data or fails to provide sufficient personal data or withdraw the acceptance for processing personal data, SVFC may or may not process the request of data subject or provide the data subject products and services of SVFC. The data subject shall inform SVFC on any adjustment to personal data of the data subject recorded by SVFC.

The personal data processing made by SVFC and/or third parties may lead to incident in personal data, affecting the data subject. SVFC will sufficiently perform all mandatory measures to ensure the personal data protection and processing is in accordance with the laws.

8. Rights to Access and Adjust Personal Data of the Data Subject

The data subject is subject to accessing/inquiring to view, adjust its personal data after it is being collected by SVFC with consent, unless otherwise provided by the laws.

In case the data subject cannot directly adjust due to technique of any reasons, the data subject may request SVFC to modify personal data of the data subject;

SVFC will make effort to ensure rights to access/inquire or modify personal data of the data subject is processed after requests being checked and personal data is available;

SVFC may have to retain the rights to access/inquire personal data of the data subject in some certain circumstances, in such circumstances, SVFC will inform the data subject on the reason of imcapacity to execute the request of data subject;

SVFC reserves the right to decide whether or not to allow the requests of modification and/or may request additional documentation of new personal data to avoid scientific conduct and provision of inaccurate personal data

9. Rights and Obligations of the Data Subject

Data subject has the rights and obligations provided in relevant laws. Should the data subject be unclear about its rights and obligations, data subject kindly contact SVFC via contact points provided in Article 11 of this Notice for clarification. The data subject achknowledges that the data subject has read, understood and agreed to the contents on its rights and obligations under applicable laws.

10. Notice Modifications

SVFC may amend, update or modify this Notice from time to time. The notification on any amendment, update, or modification of this Notice will be updated, posted on information media which SVFC deems appropriate.

11. Contact Point

Should the data subject having any questions relevant to this Notice, kindly contact SVFC via:

Phone: 1900 5454 49 Email: [email protected]

For the avoidance of doubt, should the data subject provide personal data of another third party (such as information of dependant, spouses, children and/or parents, friends, beneficiaries, authorized persons, partners, emergency contacts) to SVFC, the data subject undertakes and ensures that the data subject has obtained the consent of such third party, for contents related to personal data processing stipulated in this Notice (including but not limited to collection, use and provision of information for the Purposes.