PERSONAL DATA PROCESSING POLICY

Applicable to the website bumatech.vn and all customer data collection activities

Code: CS-CCO-02 · Version 1.0 · Effective: 01/09/2026

Article 1. Legal basis, scope and application

1.1. This Policy is issued pursuant to the Law on Personal Data Protection No. 91/2025/QH15 (effective from 01/01/2026), the Civil Code 2015, the Law on Cyber Information Security, the Law on Protection of Consumer Rights No. 19/2023/QH15 and Decree No. 52/2013/ND-CP on e-commerce (as amended by Decree No. 85/2021/ND-CP).

1.2. Data Controller: BUMATECH COMPANY LIMITED — head office at 154/1/5 Cong Lo Street, Tan Son Ward, Ho Chi Minh City; manufacturing plant at 820 Chanh Hamlet, Duc Lap Ward, Tay Ninh Province.

1.3. This Policy applies to personal data collected by the Company through the website bumatech.vn, the Zalo Official Account, registration forms, contracts and other transaction channels.

Article 2. Personal data processed

• Contact identification: full name, phone number, email. Purpose: account creation, consultation, order confirmation. Legal basis: consent · performance of contract. Retention: for the life of the account + 24 months.
• Transactions: delivery address, order history, payment method (card numbers are not stored). Purpose: delivery, invoicing, warranty, after-sales care. Legal basis: performance of contract · legal obligation. Retention: 10 years, together with accounting records, under the Law on Accounting.
• Business / distributor data: entity name, tax code, legal representative, bank details. Purpose: contract signing, payment, reconciliation of receivables. Legal basis: performance of contract. Retention: contract term + 10 years.
• Technical data: IP address, browser type, cookies, browsing behaviour. Purpose: website operation, statistics, experience improvement. Legal basis: legitimate interest · consent (for non-essential cookies). Retention: up to 12 months.
• Recruitment: candidate profiles, CVs. Purpose: recruitment. Legal basis: consent. Retention: 12 months from submission, unless the candidate requests earlier deletion.

The Company does NOT collect sensitive personal data (health status, political opinions, biometric data, etc.) and does NOT require customers to provide photos of identity documents to verify an account.

Article 3. Collection method and processing principles

3.1. Data is collected directly from the data subject when: registering an account, placing an order, completing a contact or distributor registration form, joining a promotion, or submitting a job application.

3.2. Processing principles: collect only for the stated purpose · minimum necessary · transparency · security · retain only for as long as necessary · never buy or sell personal data in any form.

Article 4. Sharing data with third parties

4.1. The Company shares personal data only to the extent necessary with:

• Carriers (trucking companies, freight forwarders, delivery platforms): name, phone number, delivery address — to deliver goods to the customer.
• Credit institutions and payment gateways: transaction information (excluding bank login credentials) — to process payments.
• Auditors and tax advisers: transaction records — accounting and tax obligations.
• Competent state authorities: upon lawful written request — legal obligations.

4.2. The Company requires each recipient to commit to confidentiality and to use the data solely for the shared purpose.

4.3. The Company does not transfer personal data abroad, except where it uses hosting or email services of international providers — in which case it complies with the provisions of the Law on Personal Data Protection on cross-border data transfer.

Article 5. Rights of the data subject

Under the Law on Personal Data Protection No. 91/2025/QH15, you have the following rights regarding your personal data:

• Right to be informed: to know about the processing of your personal data.
• Right to consent and to withdraw consent: to consent or refuse consent to processing; to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right of access: to view and request a copy of your personal data held by the Company.
• Right to rectification: to request correction of inaccurate or incomplete data.
• Right to erasure: to request deletion of data no longer necessary for the stated purpose, or upon withdrawal of consent.
• Right to restrict processing: to request suspension of processing while a complaint is being verified.
• Right to object: to object to processing for marketing purposes.
• Right to complain, denounce and initiate legal proceedings: to lodge a complaint with the Company or a competent state authority in accordance with the law.

Article 6. Exercising rights and response time

6.1. Requests may be sent through any of the following channels: email privacy@bumatech.com.vn · hotline 0979 793 804 · written request to the Company's head office · or directly in the account management section of the website (for updating information).

6.2. The Company verifies the identity of the requester to protect the data subject's own data, then responds within 72 hours of receiving a valid request. For complex requests, the Company will notify the reason and the specific processing time.

6.3. The Company may refuse a deletion request where the law requires retention (for example, accounting records must be kept for 10 years) or where the data is needed to resolve a dispute; in such cases the Company will state the grounds for refusal.

Article 7. Cookies and tracking tools

7.1. The website uses essential cookies (maintaining login sessions, shopping cart) and analytics cookies (measuring traffic).

7.2. You have the right to REFUSE non-essential cookies via the cookie notice shown on your first visit, or through your browser settings. Refusing non-essential cookies does not affect your ability to make purchases.

Article 8. Security and storage

8.1. Protective measures: role-based access control · encrypted website connection · regular backups · confidentiality undertakings by staff with data access under the Company's IT and Information Security Policy.

8.2. When the retention period expires or the processing purpose ends, data is deleted or anonymised.

8.3. In the event of a personal data breach or loss, the Company notifies the competent authority and the affected data subjects within the statutory time limit.

Article 9. Data of persons under 16

The Company's website and products are intended for adult customers and organisations. The Company does not knowingly collect data from persons under 16; if such data is discovered, the Company will delete it, unless consent has been given by a parent or legal guardian as required by law.

Article 10. Contact point and effect

10.1. All enquiries regarding personal data: privacy@bumatech.com.vn · 0979 793 804 · 154/1/5 Cong Lo Street, Tan Son Ward, Ho Chi Minh City.

10.2. This Policy takes effect from the date of publication on the website and replaces the previous "Information Security Policy" page. Any amendment will be published on the website with the date of update clearly stated.