Notice on personal data processing

1.1  "Personal data": refers to information in the form of symbols, letters, numbers, images, sounds, or similar formats in electronic environments that is associated with or helps identify a specific individual. Personal Data is specifically defined in Section 2, Part I of this Personal Data Processing Notice (hereinafter referred to as the “PDPN”).

1.2 “Products and services” refer to:

• (i) Products and services provided by VIB;
• (ii) Products and services provided by VIB’s partners and distributed through VIB.

1.3 This PDPN governs the processing of personal data of "Data Subjects", including:

• Individual customers currently using VIB's products and services (hereinafter referred to as “Customer”);
• Related persons of the Customer as required by law (“Related Parties”);
• Other individuals as defined by VIB from time to time, including but not limited to: guarantors who are individuals; dependents; spouse; children; parents; siblings; grandparents; uncles/aunts; friends; beneficiaries; referees; colleagues; lawful heirs; estate administrators/users; legal representatives; guardians; individuals residing/living at the customer’s residence; authorized persons; emergency contacts; users of the Customer’s VIB Checkout electronic banking application (VIB Checkout Users); and/or other individuals in accordance with applicable laws (collectively referred to as “Third Parties” in this document).
• By providing the personal data of Data Subjects to VIB, the Customer represents and warrants that:
  • (i) The Customer has obtained the consent of such Data Subjects for the processing of their personal data under the terms and conditions set forth in this PDPN;
  • (ii) The Customer shall be fully responsible for VIB’s processing of the personal data of such Data Subjects as provided by the Customer

1.4 Within the scope of personal data processing under this PDPN, VIB shall act as the data controller and/or both the data controller and data processor.

1.5 Personal data processing means one or more activities performed on personal data, including but not limited to: collection, recording, analysis, validation, storage, modification, disclosure, combination, access, retrieval, withdrawal, encryption, decryption, duplication, sharing, transmission, provision, transfer, deletion, destruction of personal data, or other relevant actions.

2.1 Group 1 personal data:

Full name, middle name, and birth name; aliases (if any); date of birth, date of death or missing status, and related documentation; gender; place of birth, place of birth registration, birth certificate details, permanent residence, temporary residence, current address, hometown, contact address; nationality; personal images; voice information; electronic data; phone number; identification details including but not limited to: national ID card, citizen ID/passport/residence card, personal identification number notification; visa; driver’s license number; vehicle plate number; personal tax code; social insurance number; health insurance card number; ownership or usage information relating to assets of the Data Subjects; marital status; employment-related information including but not limited to: occupation, employer, work address, position, work permit details, labor contract, email, personal/business tax code, income level, payment method, and other related information; family relationship information (spouse, parents, children); personal account number information; personal data reflecting activities and online history; any other information associated with or used to identify Data Subject that is not classified as Group 2 Personal Data below.

2.2 Group 2 personal data:

Political and religious views; health status and private medical information recorded in health records, excluding blood type; racial or ethnic origin; genetic characteristics, whether inherited or acquired; physical attributes and unique biometric identifiers; criminal records and criminal behavior information as collected or stored by law enforcement agencies; dispute-related information involving Data Subject or their assets; customer information held by credit institutions, foreign bank branches, intermediary payment service providers, and other legally authorized entities, including: addditional identity information as prescribed by law; account details, deposit information, asset deposits, transaction data; information regarding organizations/individuals acting as guarantors; contractual information entered into with partners via VIB; location data of individuals as identified through devices/systems/location services and other related data sources; other personal data deemed sensitive or requiring special confidentiality measures as regulated by law.

2.3 Group 3 personal data:

Data generated or extracted from or related to technical systems (e.g., devices, applications, software, operating systems, browsers, IP addresses, and other technical infrastructure), including but not limited to: language settings; date and time of access to digital platforms; application usage statistics, configuration settings, and access timestamps; usernames; passwords; login credentials; usage data; and other related technical information.

Data generated or extracted related to advertisement preferences; cookie data; clickstream data; web browsing history; responses to direct marketing; opt-out preferences from direct marketing; other related behavioral data and information.

3.1 Processing requests from Customers when requested to provide products and services:

• Identify/verify the Data Subject's identity and background information;
• Update personal information of the Data Subject;
• Check and compare with relevant data sources;
• Enter, check, and control the completeness and accuracy of the data entered into the system;
• Evaluate and assess the financial status of the Customer/Data Subject;
• Measure, build, and evaluate the creditworthiness of the Customer/Data Subject;
• Check, assess, evaluate, and approve credit conditions of the Customer/Data Subject;
• Serve the purposes of anti-money laundering, counter-terrorism financing, compliance with embargoes, or provide to competent authorities as regulated from time to time;
• Comply with FATCA (Foreign Account Tax Compliance Act) under the agreement between the IRS and the Government of Vietnam;
• On behalf of the Customer/Data Subject, verify and compare their information and account information (excluding passwords) with the tax authority or product/service providers that VIB deems necessary for the purposes of evaluating, assessing, and verifying Customer/Data Subject information in order to provide the requested products/services;
• Authenticate Customers/VIB Checkout users to allow access to digital/electronic accounts, and personalize their experience on VIB's digital banking application;
• Automatically register the Customer/Data Subject on digital applications so that the Customer/Data Subject and/or VIB can manage their transaction information at VIB;
• Activate/open, manage, maintain, close/lock the services and utilities of the products used by the Customer;
• Provide/send account statements, balance confirmations, invoices, correspondence, letters or other notifications (including but not limited to: updates on changes, including any amendments, supplements, extensions, suspensions, and replacements of products/services and utilities provided by or through VIB) to the Customer/Data Subject or other related parties;
• Carry out VIB's advertising, marketing, promotional, incentive, and customer care programs;
• Respond to customer inquiries and complaints and resolve disputes;
• Serve the purposes of contract execution, disbursement/use for credit facilities;
• Serve the processing of Customer/Data Subject requests related to product/service applications.

3.2. Use and analysis for the development, provision, and enhancement of product and service quality, including:

• Generating data, reports, statistics, and feedback for VIB and/or for related parties specified in Section 4 of this Personal Data Processing Notification;
• Conducting market research, surveys, and data analysis related to products, services, and utilities provided by VIB and/or in cooperation with other parties;
• Risk assessment, trend analysis, statistical processing, planning, including credit and risk data analysis to establish and maintain credit scoring systems, checking credit history to assess/appraise and maintain the credit history data of Customer/the Data Subject;
• Collecting and recording your evaluations and feedback through surveys to improve service quality.

3.3. Compliance with legal and internal requirements necessary for VIB to fulfill its rights and obligations, including:

• Managing and recording calls/videos and electronic communications with Customers/Data Subjects and other relevant parties;
• Managing benefits or interests related to VIB’s relationship with the Customer/Data Subject, or arising from the Customer/Data Subject’s participation in events, campaigns, promotions, marketing, incentives, or support programs organized by VIB or in cooperation with other parties;
• Managing VIB’s infrastructure and business operations;
• Protecting or enforcing VIB’s rights, including but not limited to collecting fees, charges, and debt recovery; handling secured assets (including but not limited to liaising with competent authorities or organizations/individuals deemed necessary by VIB to recover debts/handle secured assets, or publicly disclosing such on VIB’s website for debt recovery purposes);
• Complying with VIB’s internal policies;
• Complying with procedures, legal documents, regulations, guidance, official letters, directives, or requests issued by any court or competent authority (domestic or international) (including but not limited to information disclosure to authorities or as required/permitted by applicable law or regulations);
• Executing transactions involving the purchase, transfer, or assignment of VIB’s business and/or assets;
• Executing transactions involving the assignment, transfer of rights, benefits, or obligations under the Customer’s contracts/agreements with VIB (including but not limited to debt sales);
• For auditing purposes;
• For archiving and information retrieval purposes;
• Executing and complying with agreements/contracts between VIB and other parties;
• Providing data to service providers of VIB

3.4 Performing activities related to the development, improvement, provision, operation, processing, and management of VIB’s banking products and services.

3.5 Generating credit information products using specialized software of Vietnam Credit Information Joint Stock Company (PCB).

3.6 Serving the purpose of fulfilling VIB’s rights and obligations under the law, VIB’s internal regulations, and other purposes deemed necessary by VIB from time to time.

• VIB employees, collaborators, branches/units within the VIB system, and VIB’s subsidiaries/affiliates;
• Companies and/or organizations acting as vendors, service providers, partners, agents, and consultants, including but not limited to:
  • Companies providing services to assist VIB in verifying Customer/Data Subject identity, operating products, websites, apps, or devices; delivering selected products/services; or managing operations on behalf of VIB, including marketing, newsletters, market surveys, and training services;
  • Partners and affiliates cooperating with VIB to jointly provide products/services;
  • Companies offering administrative, postal, telecom, data processing, IT, payment, credit reference, depository, data entry, verification, document management, tech support, cybersecurity, data center, consulting, or other services related to or supporting VIB’s operations;
  • Companies providing payment services and related transaction processing;
  • Debt collection companies and credit risk control services;
  • Auditing firms and law consultancy firms;
  • Appraisal, valuation, and price consultancy firms;
  • Credit rating agencies;
• Competent authorities and individuals involved in debt recovery;
• Data Subject whom VIB deems necessary to contact for debt recovery purposes;
• Entities involved or intending to be involved in the purchase, transfer, or assignment of VIB’s business and/or assets;
• Entities involved or intending to be involved in the purchase, transfer, or assignment of rights, interests, or obligations under Customer agreements with VIB;
• Insurance companies, insurance brokers, or credit protection service providers (directly or indirectly);
• National Credit Information Center of Vietnam;
• Vietnam Credit Information Joint Stock Company (PCB), Business Registration Certificate No. 0102547296, issued on 27/11/2007;
  Credit information provided to PCB includes the personal data outlined in Section 2, Part I, of Data Subject at VIB. The provision of such information to PCB complies with government regulations on credit information services and related laws.
  In case PCB’s eligibility to provide credit information services is revoked, VIB will cease to provide Data Subject information to PCB. The Customer agrees that PCB may continue processing the data in accordance with relevant government regulations. VIB shall notify Data Subject of the data handling plan within 10 business days from the date it receives notice from PCB.
• Any individual, competent authority, regulatory body, or organization that VIB is allowed or required to disclose personal data to under the laws of any country, or under any contract or commitment with such entity;
• Any party involved in enforcing or maintaining any of VIB’s rights under agreements with the Customer;
• Any party intending to settle any outstanding financial obligations of the Customer with VIB;
• Other organizations or individuals as prescribed by law;
• Any party VIB deems necessary for the purposes of personal data processing outlined in Section 3.

5.1 Methods of Collection:

• Directly from Customers:
  • Information provided and declared by Customers in writing, including but not limited to: Credit application forms, capital usage plans, and other documents related to the implementation of the credit agreement.
  • Through the relationship established between VIB and Customers when Customers register for or use any products or services via any transaction channel of VIB or VIB's authorized agents.
  • From VIB's websites: VIB may collect personal data when Customers/Data Subjects access any of VIB’s websites or use any features or resources available on or through such websites.
  • From VIB's mobile applications: VIB may collect personal data when Customers/Data Subjects download or use VIB’s mobile applications.
  • From interactions and communications between VIB and Customers: VIB may collect personal data during interactions (in-person meetings, letters, phone calls, online interactions, electronic communications, or other means), including surveys, promotions, or contests organized by VIB that Customers participate in.
  • Through Customers’ cashless transactions at VIB’s affiliated agents/acceptance points.
  • Through interactions or automatic data collection technologies: VIB may collect information including IP address, referring URL, operating system, browser information, and other automatically recorded data from the connection:
    • Cookies, flash cookies, pixel tags, electronic beacons, or other tracking technologies;
    • Cookies, plug-ins, or social media connectors from other organizations or individuals;
    • Any technology capable of tracking personal activity across devices or websites;
    • Location information or other metadata provided by a device;
    • Other means: VIB may collect personal data when Customers/Data Subjects interact with VIB via any other methods.
• From other organizations or individuals:
  • From service providers, suppliers, partners, affiliates, and other parties involved in VIB’s business activities;
  • From Data Subjects, or individuals related to Customers/Data Subjects, including but not limited to: legal representatives, authorized representatives, guarantors, employers, security providers, cohabitants at the permanent/temporary/current residence of the Data Subject, and other entities permitted by law.
• From government agencies and other sources permitted by law in Vietnam.

5.2 Collection methods: 

VIB may collect personal data of Data subject using the following methods: written notes, recordings of verbal instructions or information provided directly, via phone, email, text message, or any other electronic means; extraction of instructions or data entered directly by Customers/Data Subjects into systems or electronic devices; video recordings; and other collection methods implemented by VIB from time to time.

• Customer Rights: To be informed, to consent, to access, to withdraw consent, to request data deletion, to restrict data processing, to request data provision, to object to data processing, to complain, to denounce, to sue, to request compensation for damages, and to self-protect in accordance with personal data protection laws.
• Customer Obligations: To protect their own personal data; to request relevant organizations or individuals to protect their data; to provide complete and accurate personal data when consenting to VIB’s processing; to obtain consent from the Data Subjects for data processing as outlined in this Notice and provide it upon request by VIB and/or Data Subjects and/or competent authorities; to comply with personal data protection laws and other relevant legal obligations.
• Customers are responsible for regularly checking this Personal Data Processing Notice on VIB’s official website to stay updated on changes and to inform the Data Subjects accordingly.

• VIB will begin processing personal data of Data Subject from the moment it is collected and continue for as long as necessary to fulfill the purposes outlined in this Notice and to perform agreements or contracts with Customers, unless a longer period is required or permitted by applicable law.
• The data processing ends when VIB no longer retains any personal data of Data subject, in accordance with VIB’s policies and legal regulations.
• Personal data will be stored and protected with appropriate security measures. Where permitted by law, VIB may store personal data in Vietnam or overseas, including on cloud computing solutions

• When a Customer (authorized in writing by the Data Subject) wishes to access the personal data being processed by VIB or believes that such data is inaccurate, incomplete, misleading, or outdated, they may send a written request for access, correction, or update via VIB’s branches/transaction offices or through other channels as announced by VIB from time to time.
• VIB, with reasonable efforts, will comply with valid, complete access or correction requests, including any applicable processing fees.
• Please note that VIB may, at its discretion, allow corrections upon request and/or request additional documentation to verify the new information to prevent fraud and inaccuracies.
• VIB commits to processing Data subject’s personal data based on the Customer’s consent under this Notice, unless otherwise provided by law. While processing, VIB strives to apply optimal data protection measures. However, personal data processing may carry risks of data breaches or improper use. Therefore, VIB will continuously review and update its technical and managerial safeguards to the best of its capabilities.
• If a Customer identifies any violations related to Data subject’s personal data processing, they may request VIB’s assistance in preventing or limiting data disclosure, unless otherwise required by law.
• To protect Customers’ lawful rights and interests and VIB’s duties and responsibilities, the exercise of these rights and obligations shall be implemented once VIB verifies the legal authority and validity of the Customer or their authorized representative, along with compliance with legal and regulatory requirements.
• Customers may send written requests to withdraw their consent for any or all contents of this Notice through VIB’s branches/transaction offices or via other channels as announced by VIB from time to time. If a Customer withdraws consent to data processing under this Notice, VIB reserves the right to cease providing products or services. Such withdrawal will be deemed a unilateral termination of any agreements or commitments by the Customer and a breach of contractual obligations, and VIB reserves its legal rights and remedies. VIB shall not be liable for any costs, damages, or losses incurred by Data subject due to such termination.
• Regardless of the above, the Customer agrees and acknowledges that any withdrawal of consent shall not affect any data processing activities already conducted based on prior consent given to VIB.
• This Notice is available in both Vietnamese and English. In case of any inconsistencies or discrepancies, the Vietnamese version shall prevail.

If you have any questions regarding the terms and conditions of this Personal Data Processing Notice, please contact VIB's 24/7 Call Center via email: dvkh247@vib.com.vn.