Personal data protection policy

 

PERSONAL DATA PROTECTION POLICY – Vietnamese Version 

(For Non-WAON Members) 

This policy is effective from January 16, 2026, and supersedes any previously published policies.

ACSTV – ACS Trading Vietnam Company Limited, headquartered at 246 Cong Quynh Street, Ben Thanh Ward, Ho Chi Minh City (hereinafter referred to as “ACSTV”) – understands the importance of the personal data you have entrusted to us. It is ACSTV’s responsibility to manage, protect, and process that data appropriately. This Personal Data Protection Policy (“Policy”) represents ACSTV’s obligation to comply with its employees, collaborators, candidates, customers, and any individuals involved in the exchange or transfer of data with ACSTV (hereinafter referred to as “Data Subjects” or “You”).

This Policy covers the following key areas:

  • I. General Provisions
  • II. Definitions
  • III. Personal Data Collected
  • IV. Methods of Data Collection
  • V. Processing of Personal Data
  • VI. Possible Unintended Consequences or Damages
  • VII. Cross-Border Transfer of Personal Data
  • VIII. Rights and Obligations of Data Subjects
  • IX. Vulnerable Consumers
  • X. Information Regarding Children
  • XI. Updates and Amendments to the Policy
  • XII. Contact Details

Please carefully read this Policy before providing your personal data to us. Doing so ensures that you understand how we collect, use, share, transfer, store, and otherwise process the personal data you provide now or in the future.

I. GENERAL PROVISIONS

1.1 This Policy is designed to comply with the requirements of the Personal Data Protection Law of Vietnam, which may be updated or replaced from time to time. For any update, we shall inform in public on our official ACS Vietnam website.

1.2 This Policy forms an integral part of the agreement between ACSTV and the Data Subject. It applies alongside any notices, contractual terms, or consent clauses relating to the collection, storage, use, and/or processing of your personal data and does not override such notices or terms.

1.3 By registering to use our services, signing labor contract, participating into the interview, and/or accessing our platforms, you acknowledge and agree to the practices, requirements, and/or policies described in this Policy. You confirm that you understand and consent to our collection, use, disclosure, and/or processing of your personal data as outlined herein.

IF YOU DO NOT AGREE TO THE PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED IN THIS POLICY, PLEASE DIRECTLY CONTACT TO US

To the extent permitted by law, your continued use of our Services or Platform, including any transactions, will be deemed as your acknowledgment and acceptance of any changes to this Policy.

1.4 Scope of Application includes:

a. All ACSTV employees working in the Company's departments and divisions;
b. Data subjects include collaborators, candidates, customers, and any individuals involved in the exchange or transfer of data with ACSTV;
c.Processing activities include online and offline communication channels, social media, CCTV cameras in the office, cookies, data analysis, direct marketing with consent, customer care, service operation, human resource management, legal reporting, and other related activities during your use of ACSTV services.

1.5 ACSTV is committed to adhering to the following principles when processing personal data:

a. We collect personal data for specific, clear, and lawful purposes within the scope stated in this Policy and in compliance with Vietnamese law.
b. We control, process, and protect personal data within the lawful scope, fully complying with this Policy, contracts, agreements, and other forms of consent obtained from the Data Subject.
c. We ensure the accuracy of personal data, which will be corrected, updated, or supplemented when necessary; stored for an appropriate duration consistent with the purpose of processing and Vietnamese law.
d. We apply and update technical measures to protect data in accordance with Vietnamese legal requirements.
e. We store personal data appropriately and only to the extent necessary for processing purposes in compliance with Vietnamese law.
f. In addition to the above principles, we commit to complying with regulations on the protection of children’s data, protection of consumer’s rights and all applicable data protection laws as amended from time to time.

II. DEFINITIONS

2.1 “Personal Data”
Digital data or information in any form related to a specific individual that enables direct or indirect identification (including both basic and sensitive personal data). Anonymized data is no longer considered personal data.

2.2 “Basic Personal Data”
Personal data reflecting common identity details (e.g., full name, date of birth, ID number) as specified by the Government of Vietnam, frequently used in transactions and social interactions.

2.3 “Sensitive Personal Data”
Personal data closely linked to a person's privacy—such as health, finance, biometric data—where unauthorized disclosure may directly infringe on the individual’s lawful rights and interests, as specified by the Government.

2.4 “Data Subject”
The individual whom the personal data refers to.

2.6 “Data Controller”
An agency, organization, or individual that determines the purposes and means of processing personal data.

2.7 “Data Processor”
An entity authorized by the Data Controller to process personal data on its behalf, often under contract.

2.8 “Data Controller & Processor”
An entity that both determines the purpose and means of data processing and directly carries out the processing.

2.9 “Third Party”
Any organization or individual, outside of the Data Subject, Controller, or Processor, involved in data processing activities as permitted by law.

2.10 “Anonymization of Personal Data”
The process of transforming or removing identifiers so data can no longer identify a specific individual. Encryption that can be reversed does not qualify as anonymization.

2.11 “Encryption of Personal Data”
Converting such data into an unreadable format without decryption; encrypted personal data is still considered personal data.

2.12 “Vulnerable Consumers”
Consumers who may face disadvantages in accessing information, health, property, or dispute resolution at the time of purchasing or using products, goods, or services, including:

a) Elderly persons as defined by law;
b) Persons with disabilities as defined by law;
c) Children as defined by law;
d) Ethnic minorities; persons living in ethnic minority and mountainous areas, islands, or areas with difficult or extremely difficult socio-economic conditions as defined by law;
e) Pregnant women or women raising children under 36 months;
f) Persons with serious illnesses as defined by law;
g) Members of households classified as poor under the law.

III. PERSONAL DATA COLLECTED

ACSTV will collect the appropriate types of personal data depending on the subject and purpose of data processing. ACSTV does not collect and process sensitive personal data unless you are an ACSTV employee under an employment contract. ACSTV only collects one or more type of sensitive personal data for the purpose of managing and coordinating ACSTV employees.

Below is a list of legally mandated personal data types for reference purposes:

3.1 Basic Personal Data

a) Full name, middle name, birth name, and any other names (if applicable);
b) Date of birth, date of death, or date of disappearance;
c) Gender;
d) Place of birth, place of birth registration, permanent residence, temporary residence, current address, hometown, and contact address;
e) Nationality;
f) Personal image; images obtained from security systems, including recordings from cameras or surveillance systems at ACSTV’s business locations and offices;
g) Phone number, national ID number, personal identification number, passport number, driver’s license number, vehicle registration number, personal tax code, social insurance number, health insurance card number;
h) Occupation and workplace;
h) Marital status;
i) Family relationship information (parents, children, wife, husband);
k) Information about personal accounts; data reflecting activities and history of activities in cyberspace;
l) Other information associated with or helping to identify a specific individual;
m) Data generated from account operations, including how you manage and use services; behaviors, actions, or preferences displayed on digital platforms.

3.2 Sensitive Personal Data

a) Data revealing an individual’s racial or ethnic origin;
b) Political opinions, religious beliefs, or other beliefs;
c) Information relating to an individual’s private life, personal secrets, or family secrets;
d) Health-related information;
e) Biometric data and genetic characteristics;
f) Data revealing an individual’s sexual life or sexual orientation;
g) Data relating to criminal records or violations of law, collected and stored by law enforcement or competent authorities;
h) Location data of an individual as determined through positioning or location-based services;
i) Login names and passwords for access to an individual’s electronic identity accounts; images of identity cards, citizen identity cards, or identity card;
k) Login names and passwords for bank accounts; bank card information; transaction history data of bank accounts; financial and credit information, as well as data relating to activities and transaction histories in finance, securities, and insurance of customers at credit institutions, foreign bank branches, intermediary payment service providers, securities and insurance companies, and other authorized organizations;
l) Data concerning the monitoring of behavior and usage activities related to telecommunications services, social networks, online communication services, and other services in cyberspace;
m) Other personal data which, under applicable laws, is required to be kept confidential or subject to enhanced security and protection measures.
n) Other personal data related to the operation, provision, and evaluation of ACSTV’s activities, products, and services, in accordance with applicable laws and regulations.

IV. METHODS OF DATA COLLECTION

ACSTV shall collect data from Data Subjects when requested by the Data Subjects or during the course of employment and recruitment, or use any of our products (if any) and services. Data may be obtained from various sources, including but not limited to:

4.1 From Websites

Personal data is collected when you access any ACSTV website or use any of its features or products.

4.2 From Mobile Applications

Personal data is collected when you download, provide information to, and/or use our mobile applications, including all information that may constitute personal data.

4.3 From Services

Personal data is collected when you use any services provided through our websites or mobile applications.

4.4 From Communications and Interactions

Personal data is collected through any verbal and/or written communications with ACSTV, including surveys and information provided during promotional programs.

4.5 From Interactions or Automated Data Collection Technologies

Information may be automatically collected, including IP address, referring URL, operating system, browser type, and other data recorded from your connection, such as:

Cookies, web beacons, or similar tracking tools;

Third-party cookies, plug-ins, or social media connectors;

Any technology capable of tracking personal activity across devices or websites;

Location data or other metadata provided by a device.

4.6 From Other Means

Personal data may be collected through any interaction you have with ACSTV, where the information collected may constitute personal data.

4.7 From Third Parties

Personal data may be collected when you interact with third-party content linked to ACSTV, in accordance with the third party’s privacy policy and applicable laws. Data collected from third parties will only occur with your consent for:

The third party to provide your data to ACSTV;

ACSTV to process such data for the purposes described in this Policy.

4.8 Other Sources

Personal data may also be collected through information you provide, requests made by ACSTV, or from publicly available sources. Such data may be created or aggregated with other information ACSTV already holds.

V. PROCESSING OF PERSONAL DATA

5.1 Purpose of Processing Personal Data

Personal data may be processed by ACSTV, its authorized data processors, or permitted third parties for one or more of the following purposes:

a. To assess and provide ACSTV products and services to you

  • Evaluate and deliver products and services during your usage;
  • Consider whether to provide or suspend ACSTV’s products and services.

b. To fulfill ACSTV’s obligations and provide customer care

  • Perform agreements for product and service provision;
  • Handle customer inquiries and complaints;
  • Contact you for direct or indirect marketing of products and services, and conduct promotional programs, gift exchanges, and prize delivery.

c. To understand your needs and improve service quality

  • Conduct research, surveys, and data analysis to enhance existing products and develop new ones;
  • Monitor and ensure transaction security and customer support;
  • Carry out activities related to the operation, management, and improvement of ACSTV’s products and services, including development and enhancement initiatives.

d. To Perform Recruitment-Related Activities

  • Assessing skills and suitability: Using information from CVs, resumes, and qualifications to determine the candidate's ability to meet the position requirements.
  • Communicating during the recruitment process: Using email and phone numbers to send notifications, invite for interviews, or provide feedback on results.
  • Verifying information: Checking the accuracy of qualifications, experience, or references.
  • Complying with legal obligations: Maintaining recruitment records to meet labor laws, tax regulations, or internal reporting requirements.
  • Managing the recruitment process: Analyzing data to improve recruitment efficiency, for example, tracking the number of applicants and success rates.
  • Considering for future positions (if the candidate agrees): Maintaining records to contact candidates when suitable opportunities arise.

e. To Manage and Coordinate Employees

  • Human resource management and operations
  • Personnel record management: storing personal information, employment contracts, qualifications, and certificates.
  • Payroll and benefits calculation: using data to calculate salaries, bonuses, social insurance, health insurance, and other benefits according to company policy.
  • Legal compliance and reporting obligations: meeting the requirements of state agencies regarding labor, taxes, and insurance.
  • Performance evaluation and career development: using personal data to track work results, consider promotions, training, and skill development.
  • Working time management: attendance tracking, leave management, and overtime management. • Internal security and safety: using contact information to communicate announcements, policies, record videos (for internal security purposes), or organize events.
  • Emergency response: Contacting family members in case of health or safety incidents involving employees.
  • Training and development of personnel.

f. To manage business operations and internal risk control

  • Ensure ACSTV’s legitimate business purposes, including sharing information with partners, parent company, affiliates, and service providers;
  • Input and verify the completeness and accuracy of information you provide;
  • Comply with agreements and contracts between ACSTV and third parties;
  • Fulfill reporting, financial, accounting, and tax obligations;
  • Conduct audits, risk management, and compliance activities;
  • Support internal operations, including information management, system planning and development, auditing, and administration.

g. To comply with legal requirements and prevent crime

  • Provide information to competent authorities as required by law;
  • Prepare reports and data in accordance with legal regulations;
  • Assess risks, analyze trends, perform statistical reviews, and maintain data records;
  • Detect, prevent, and investigate fraudulent activities, potential risks, and money laundering.

h. To protect ACSTV’s legitimate rights and interests

If personal data is processed for purposes other than those listed above, ACSTV will notify and obtain your consent through appropriate means before proceeding.

5.2 Provision of Personal Data

To fulfill the purposes and processing activities outlined in this Policy, ACSTV may disclose or share your personal data with the following parties:

  • ACSTV;
  • Any member entity within the AEON Group, AEON Finance Service – AFS (the ACSTV’s parent company) with other businesses owned by AFS (“AFS Companies”), WAON POINT partners and ACSTV’s subsidiaries and affiliates;
  • Companies and/or organizations acting as service providers, partners, agents, or professional advisors to ACSTV. This includes, but is not limited to, providers of administrative services, mailing, telemarketing, call centers, business process outsourcing, travel and visa services, knowledge management, HR management, data processing, IT and computing services, payment processing, debt collection, background checks, market research, data modeling, rewards programs, record storage and management, data entry, screening and verification, legal services, web or social media platforms, telecommunications, SMS or email delivery, network connectivity, infrastructure and technology support, workforce management, risk reporting, information security, software maintenance and licensing, data centers, conferencing, consulting services, payment intermediaries, switching services, and other related services supporting ACSTV’s business operations;
  • Partners, subcontractors, and trusted affiliates with whom ACSTV has agreements ensuring confidentiality and compliance with privacy obligations;
  • Business partners collaborating with ACSTV to develop or provide products and services;
  • Third parties supporting the verification of the Data Subject’s information include: Vietnam Credit Information Joint Stock Company (PCB), National Credit Information Center of Vietnam (CIC), or any other agency or organization that assists in information verification.
  • Competent authorities requesting information under applicable laws, including courts, arbitration bodies, enforcement agencies, or other judicial entities;
  • Any individual, agency, or organization legally authorized or required to receive disclosure under national law or contractual commitments;
  • In the event of corporate restructuring, reorganization, dissolution, liquidation, or change of control, ACSTV may transfer your personal data to the transferee, provided reasonable and lawful measures are taken to ensure data security and confidentiality;
  • Other relevant parties deemed necessary to protect the legitimate rights and interests of the Data Subject;
  •  Other data processors engaged with your consent;
  •  Data processors approved by you when using ACSTV’s products or services.

5.3 Methods of Processing Personal Data

Depending on the purpose, ACSTV, its authorized data processors, or permitted third parties may process personal data using appropriate methods, including but not limited to manual or automated processing, or other lawful techniques as determined by ACSTV from time to time.

5.4 Duration of Processing Personal Data

ACSTV will begin processing your personal data as soon as you provide it. Processing will continue until ACSTV no longer retains any of your personal data.

VI. POSSIBLE UNINTENDED CONSEQUENCES OR DAMAGES

ACSTV protects your personal data using security measures equivalent to those applied to ACS Vietnam’s confidential information. We recognize the importance and responsibility of safeguarding your personal data and are committed to implementing appropriate protective measures. These measures are regularly reviewed and updated to ensure optimal technical standards, aiming to minimize risks and prevent any unintended consequences or damage.

VII. CROSS-BORDER TRANSFER OF PERSONAL DATA

To fulfill the purposes of personal data processing as outlined in agreements with you, ACSTV transfer personal data collected and stored in Vietnam to server systems located outside the territory of the Socialist Republic of Vietnam or to cloud computing services provided by overseas service providers; transfer personal data to recipients that are organizations or individuals located abroad; and process personal data collected in Vietnam by transferring such data to platforms located outside the territory of the Socialist Republic of Vietnam for further processing.

ACSTV will apply appropriate security and confidentiality measures and require the receiving party to ensure the same level of protection.

VIII. RIGHTS AND OBLIGATIONS OF DATA SUBJECTS

8.1 Rights of Data Subjects

a) ACSTV is committed to respecting and safeguarding the following rights:

  • Right to Know about Personal Data Processing: You have the right to understand what personal information we collect, process, and share or sell. This policy is designed to provide transparency. For further inquiries, you may contact us at privacy@acsvietnam.com.vn
  • Right to Give Consent or Refuse, Withdraw Consent: You have the right to give or refuse consent for the processing of your personal data. If you have provided consent for the processing of your personal information, you may withdraw that consent at any time.
  • Right to Access and Rectification: You may request access to a copy of the personal information we have collected about you. If any of your personal information is inaccurate, you may request corrections. While we will update or remove inaccurate data, we may retain copies as necessary to comply with legal obligations, resolve disputes, or enforce agreements. Certain requests may require additional verification.
  • Right to Data Provision, Erase, Restriction and Object of Processing: You have the right to request a copy of your personal data. You may request the deletion of all personal information we have collected. Please note that exercising this right may result in the loss of access to your account and any associated purchases, points, or features. To cancel your account or request that we discontinue the use of your information, contact us at privacy@acsvietnam.com.vn
  • Right to Complain, Accusations, Initiate Lawsuits, and Claim Compensation: You have the right to submit a request or lodge a complaint with the competent data protection authority regarding the collection or use of your personal data. The exercise of this right shall not affect any of your other lawful rights. Please note that exercising this right may limit access to some or all of our services. This right applies only to personal data processed for commercial purposes.
  • Right to Request the Competent Authorities or Relevant Organizations, Individuals involved in Personal Data Processing, to implement measures and solutions to protect your personal data in accordance with applicable laws: The exercise of this right shall not affect any of your other lawful rights.

To submit any request, please visit our Request Form and complete the form, or email us at privacy@acsvietnam.com.vn. Contact details are provided in the “Contact Details” section below.

Please note that identity verification may be required before we can fulfill these rights. If you are submitting a request on behalf of another individual, a signed authorization letter from the consumer is required.

b. When exercising your lawful rights, you understand and agree that ASCTV will process your requests in compliance with applicable laws and with due consideration of your legitimate interests.

c. Requests to exercise your rights must follow the procedures established by ASCTV; they must be submitted during ASCTV’s business hours and working days, and through the methods specified by ASCTV from time to time.

d. If you withdraw consent, request deletion of data, and/or exercise other rights affecting ACSTV’s ability to provide or maintain products/services, ACSTV may, at its discretion, decide to discontinue such products or services. Such action will be deemed a unilateral termination by you of any relationship with ACSTV and may result in a breach of obligations or commitments under agreements between you and ACSTV. ACSTV reserves all legal rights and remedies in such cases and will not be liable for any losses incurred. ACSTV’s rights to limit, suspend, cancel, or restrict processing of such personal data are expressly reserved.

f. For security purposes, you must submit your request in writing or through other methods that allow proof and verification of your identity. ACSTV may require identity confirmation before processing your request.

g. For clarity, ACSTV reserves the right to refuse requests in certain cases, including but not limited to: (i) failure to follow ACSTV’s prescribed procedures; (ii) failure to provide sufficient documentation for identity verification; (iii) suspected fraud or violation of personal data protection; or (iv) where prohibited by law.

8.2 Obligations of Data Subjects

  • Protect your own personal data.
  • Respect and safeguard the personal data of others.
  • Provide complete and accurate personal data in accordance with the law,  contracts, or upon their consent to the processing of their personal data;
  • Comply with personal data protection laws and actively participate in preventing violations of personal data security.
  • If the Data Subject provides personal data of another individual to ACSTV and/or related parties, the Data Subject guarantees that such individual has consented to the provision of their data. ACSTV shall be fully indemnified in such cases.
  • If the Data Subject submits a written request to withdraw consent and/or requests ACSTV to delete or restrict the processing of personal data, ACSTV reserves the right to limit, suspend, or terminate the provision of products or services to the Data Subject due to insufficient information required for service delivery. ACSTV shall not be liable for any losses incurred by the Data Subject in such circumstances.
  • The Data Subject shall not file complaints or lawsuits regarding any actions performed by ACSTV in accordance with the Data Subject’s consent under this Policy.
  • Immediately notify ACSTV if you discover or suspect that your personal data has been exposed, which may lead to risks during service usage, or if you detect any violation of personal data protection under this Policy.
  • Regularly check ACSTV’s official website to stay updated and comply with any changes related to this Personal Data Protection Policy.
  • Fulfill all other obligations as required by law.

IX. VULNERABLE CONSUMERS

9.1 Based on the Law on Protection of Consumer Rights 2023, issued by the National Assembly on June 20, 2023 (effective from July 1, 2024) that might be updated or revised by the governance from time to time, ACSTV provides specific measures to protect the information of vulnerable consumers (hereinafter referred to as “Consumers”).

9.2 Data subjects, including vulnerable consumers, retain all rights and obligations under applicable laws and ACSTV’s published policies. ACSTV is committed to processing personal data and applying appropriate measures to ensure the security of vulnerable consumers’ information.

9.3 If a vulnerable consumer uses ACSTV’s products or services, we will guide the consumer to provide evidence or documents verifying their status as a vulnerable consumer.

9.4 Based on the verification documents, ACSTV commits to:

  • Prioritize support, receipt, and resolution of requests from vulnerable consumers in accordance with ACSTV’s regulations;
  • In case of refusal, provide a written response stating the legal basis and reasons for non-compliance with the request.

9.5 ACSTV commits not to refuse requests due to differences in language, writing, customs, or practices. We also commit to preventing discrimination, exploitation, or abuse of vulnerability factors that could infringe upon the lawful rights and interests of consumers during transactions.

X. CHILDREN’S INFORMATION

Our Services are not intended for children under 16 years of age. We do not knowingly collect or store any personal or non-identifiable information from individuals under 16. No part of our platform or services is designed for children under 16.

Parents or guardians of children under 16 must supervise and ensure that the child’s personal information is not submitted to ACSTV. If personal information of a child under 16 is provided to ACSTV by a parent or guardian, such parent or guardian agrees to the processing of the child’s information and accepts this Policy on behalf of the child.

We will disable any account used exclusively by such children and remove or delete any personal data we believe was submitted by a child under 16.

XI. POLICY UPDATES AND AMENDMENTS

ACSTV reserves the right to modify, adjust, supplement, or update this Policy at any time. Notifications of any changes will be posted on our official website and/or other communication channels deemed appropriate.

We recommend that you regularly review ACSTV’s Personal Data Protection Policy to stay informed about updates and how we protect your personal data.

Your continued use of our products, services, or applications constitutes your acknowledgment and acceptance of this Policy and any related amendments.

XII. CONTACT DETAILS

12.1 If you have any questions or complaints regarding this Personal Data Protection Policy, please contact our Customer Service team:

12.3 If you have any complaints related to how we process your data or wish to exercise your data subject rights, please contact us and submit your Request Form.

12.4 If you send a complaint via mail or email, please include a subject line referencing the applicable personal data protection law. This will help us process your request promptly by directing it to the responsible department. For example, you may include “Complaint under Data Protection Law” in the subject line.

 

 

Gọi ngay
SMS
Liên hệ