Privacy Policy

1. Introduction

1.1 PERSOLKELLY Vietnam Co., Ltd. (the “Company”, “we”, “us”, “our”) respects your privacy and we
acknowledge that you have certain rights related to any personal data we collect from you and we have
certain obligations in respect of the same. The Company supports the various international privacy laws
and is compliant with certain local privacy laws, including Vietnam’s DecreeNo.13/2023/ND on the
Protection of Personal Data (“PDPD”) and its regulations, and has procedures in place to meet the
requirements of those laws.

1.2 This privacy policy (“Privacy Policy”) describes our privacy principles and/or our practices for gathering,
collecting, storing, using and/or disclosing your personal data. We encourage you to review this Privacy
Policy so that you may understand how we may collect, use, disclose, process and share your personal
data.

1.3 For the avoidance of doubt, “personal data” means data, whether true or not, about an individual who
can be identified (a) from that data; or (b) from that data and other information to which the organisation
has or is likely to have access.

2. Information We Collect, Use or Disclose

2.1 In order for us to provide our services and for the operation of our business, provide services of recruiting
and placing individuals for potential work assignments (and related services) with our customers and/or
directly at the Company, act as employer or hirer of record for individuals employed or engaged by the
Company, or provide human resources related services to our customers, we must collect certain personal
data from and about individuals who are candidates, employees, contractors, and former employees. In
the event we are unable to collect the required personal data from such individuals, we may not be able
to proceed with the abovementioned services, including providing potential job placements, for such
individuals.

2.2 The types of personal data collected, used, processed, disclosed and stored by us depends on the
circumstances and/or the purposes for which we may need to process your personal data. Hence, subject
to the aforesaid, such personal data may include:

•  Name;
•  Contact information (address, phone number, e-mail address);
•  Identification details or passport;
•  Employee identification number;
•  Date of birth;
•  Contents of any other identification provided to the Company for application or employment purposes;
•  Education and employment history;
•  Work-related skills and experience;
•  Professional credentials or licenses;
•  Membership in professional organisations;
•  Any other information contained on an individual’s Curriculum Vitae (CV);
•  Citizenship and work authorisation status;
•  Disability and health-related information;
•  Next-of-kin or emergency contact information;
•  Information from and related to publicly published profiles you’ve created on job-related social media
  platforms and job boards (such as LinkedIn, Anphabe, Facebook, Monster or Indeed);
•  Information provided by references; and
•  Information regarding your career interests, preferences, and qualifications

2.3 In addition, under certain circumstances and consistent with prevailing laws, we may request types of
personal data that are viewed by some countries as “sensitive”:
 National identification, tax identification, passport number or social security number(s);
 Financial or bank account information;
 Results of drug, criminal, and/or background screenings;
 Benefits selections, potentially including health insurance and retirement planning information;
 Biometric data;
 Information contained within your personnel file with the Company, such as performance reviews,
disciplinary action, and other payroll related information; and
 Health information, including that related to a work-related claim (e.g. workers’ compensation claim).

2.4 In some jurisdictions, in order to comply with statutes, rules, and regulations pertaining to equal
employment opportunities or to assist the Company or its related corporations in compiling data for its
equal opportunities practices and reporting, we may also ask you to provide gender, race/ethnicity or
disability information. The provision of this type of information will be voluntary, unless it is required by law,
and failure to provide this information will not hinder your employment or project opportunities.
2.5 Your interactions with our websites and mobile applications may also result in the collection, processing,
and storage of the following types of information from you:
 Geolocation data; and

 Other information you may provide to us, such as through surveys, interactions with our social media,
or other mediums used to contact the Company.
2.6 Some of our websites require you to provide your personal data, such as when you create a profile and
log-in credentials. Instead of having to type in your personal data, some of these functionalities may allow
you to use third-party authentication tools such as Facebook, Twitter, and Google to populate certain fields.
By authenticating through one of the social media options, you allow us to receive your personal data and
other information that is accessible through these tools. This information may be incorporated into your
profile. For any such tool you choose to use, we encourage you to also review the tool provider’s privacy
policy and any terms and conditions.

2.7 We may use your personal data to permit you to participate in live social media feeds. If you choose to
participate, your public username may be displayed on the sites along with your post, including, but not
limited to, any comments, images, and videos that you may have posted.

2.8 We may provide you with access to third-party functionality that allows you to post content to your social
media account(s). Any information that you provide to your social media account(s) through use of such
third-party functionality is governed by the applicable third party's privacy policy, and not by this Privacy
Policy. For the avoidance of doubt, we are not responsible for any personal data that you provide to such
third party.

3. The Purposes For Which We Collect, Use and Disclose Your Personal Data

3.1 We will/may collect, use, disclose and/or process your personal data for one or more of the following
purposes:
a) administering, processing and/or dealing with any transactions between you and the Company and/or any
of its related corporations including but not limited to any application by you for employment or work with
the Company;
b) recruiting, assessing and/or matching you with/for potential positions or assignments with third party
organisations (or our customers), and/or dealing with matters related thereto such as offering you a
placement of work or job with such third party organisations (or our customers) or referring you for
employment to a third party organisation (or our customer);
c) administering, managing and/or dealing with the provision of work or job placement services to you. This
includes us sharing your personal data with our customers or third party organisations, for your potential placement or employment opportunities with those customers/third party organisations who are seeking
employees or workers, or to the organisation to which you have been assigned to work;
d) carrying out your instructions or responding to any enquiry given by (or purported to be given by) you or
on your behalf;
e) administering, facilitating, processing and/or dealing in any matters relating to your use of any of the
Company’s or its related corporations’ websites, any functionalities on the websites or any transactions or
activities carried out by you on or through any of the Company’s or its related corporations’ websites, such
as but not limited to live social media feeds;
f) monitoring, processing and/or tracking your use of any of the Company’s or its related corporations’
websites in order to provide you with a seamless experience, facilitating or administering your use of any
of the Company’s or its related corporations’ websites, and/or to assist us in improving your experience in
using any of the Company’s or its related corporations’ websites;
g) contacting you or communicating with you via phone/voice call, text message and/or fax message, email
and/or postal mail for the purposes of administering your use of any of the Company’s or its related
corporations’ website or any transactions you have with us, or for the provision of our services to you. You
acknowledge and agree that such communication by us could be by way of the mailing of correspondence,
documents or notices to you, which could involve disclosure of certain personal data about you to bring
about delivery of the same as well as on the external cover of envelopes/mail packages;
h) carrying out due diligence or other screening activities (including background checks) in accordance with
legal or regulatory obligations applicable to us (whether from Vietnam or any other country), the
requirements or guidelines of governmental authorities which we determine are applicable to us (whether
from Vietnam or any other country), and/or our risk management procedures that may be required by law
(whether from Vietnam or any other country) or that may have been put in place by us;
i) to prevent or investigate any fraud, unlawful activity or omission or misconduct, whether or not there is
any suspicion of the aforementioned; dealing with conflict of interests; or dealing with and/or investigating
complaints;
j) creating reports with respect to our transactions with you, and/or producing statistics and research of such
transactions for internal and/or statutory reporting and/or record-keeping requirements for us or our related
corporation(s);
k) managing internal operations including conducting data analytics for the purpose of system and process
improvements and enhancements to human resources processes;
l) complying with or as required by any applicable law, governmental or regulatory requirements of any
jurisdiction applicable to us or our related corporations, including meeting the requirements to make
disclosure under the requirements of any law binding on us or our related corporations, and/or for the
purposes of any guidelines issued by regulatory or other authorities (whether from Vietnam or any other
country), with which we or our related corporations are expected to comply;
m) complying with or as required by any request or direction of any governmental authority (whether Vietnam
or non-Vietnam) which we are expected to comply with; or responding to requests for information from
public agencies, ministries, statutory boards or other similar authorities. For the avoidance of doubt, this
means that we may/will disclose your personal data to the aforementioned parties upon their request or
direction;
n) storing, hosting, backing up (whether for disaster recovery or otherwise) of your personal data, whether
within or outside Vietnam;
o) facilitating, dealing with and/or administering external audit(s) or internal audit(s) of the business of the
Company and/or its related corporations;
p) for marketing, if you have separately indicated that you consent to such purpose. If so, we may/will send
you by email, postal mail or other modes of communication marketing and promotional information and
materials relating to products and/or services (including products and/or services of third party
organisations whom the Company may collaborate or tie up with) that the Company or its related
corporations may be selling, marketing or promoting, whether such products or services exist now or are
created in the future. In the case of the sending of marketing and promotional information and materials
to you by voice call and instant messaging applications like SMS/MMS, Zalo, Facebook Messenger,
WhatsApp or Telegram to your Vietnam telephone number, we will not do so unless we have complied
with the requirements of Vietnam’s PDPD in relation to use of the latter modes of communication to send
you such marketing information or materials or where you have expressly consented to such mode of
communication; and
q) dealing with and/or facilitating a business asset transaction or a potential business asset transaction,
where such transaction involves the Company as a participant, and there may be other third party
organisations who are participants in such transaction. The term “business asset transaction” means the
purchase, sale, lease, merger or amalgamation or any other acquisition, disposal or financing of an
organisation or a portion of an organisation or of any of the business or assets of an organisation,
(the purposes set out above shall be collectively referred to as the “Purposes”).

3.2 The Company may/will need to disclose your personal data to third parties, whether located within or
outside Vietnam, for one or more of the above Purposes, as such third parties, would be processing your
personal data for one or more of the above Purposes. In this regard, you hereby acknowledge, agree and
consent that we may/are permitted to disclose your personal data to such third parties (whether located
within or outside Vietnam) for one or more of the above Purposes and for the said third parties to
subsequently collect, use, disclose and/or process your personal data for one or more of the above
Purposes. Without limiting the generality of the foregoing or of the immediately preceding paragraph
setting out the Purposes, such third parties include:
a) our associated or affiliated organisations or related corporations;
b) any of our agents, contractors or third-party service providers that process or will be processing your
personal data on our behalf including but not limited to those which provide administrative or other services
to us such as mailing houses, telecommunication companies, information technology companies and data
centres;
c) our customers or third-party organisations, who may be your potential employers or hirers or organisations
which engage you for your services; and
d) third parties to whom disclosure by the Company is for one or more of the Purposes and such third parties
would in turn be collecting and processing your personal data for one or more of the Purposes.
3.3 Your consent pursuant to this Privacy Policy is additional to and does not supersede any other consents
that you had provided to the Company with regard to processing of your personal data. We may collect,
disclose or use your personal data pursuant to an exception under the Personal Data Protection Act or
other written law such as during the following situations:
• To respond to an emergency that threatens your life, health and safety or of another individual; and
• Necessary in the national interest, for any investigation or proceedings.
3.4 Data that has been anonymised does not personally identify you and is not covered by this Privacy Policy.

3.5 We hold our employees, agents, and suppliers accountable for maintaining the trust that you place in us
with your personal data. Your personal data will not be used or shared except as in accordance with
applicable law relating to personal data.

3.6 Your personal data may be shared with third party service providers as set out at paragraph 3.2 above.

3.7 Consistent with paragraph 3.2 above, as a result of the scope of the Company’s operations, the sharing
of your personal data with our other group entities, service providers, and customers may result in your
personal data being sent to countries outside of your country of residence, which may have data protection
laws that differ from those in your country of residence. Regardless of the source or destination location
of your information, we will at all times protect your personal data as described in this Privacy Policy, and
in accordance with applicable data protection laws when transferring your personal data.

4. Cookies and Web Beacons

4.1 The Company’s websites use "cookies" to help personalise the online experience. A cookie is a piece of
data stored on the user’s computer or mobile device tied to information about that user. They also allow
us to identify those devices when they return to a website. You can set your browser to notify you before
you receive a cookie, giving you the option of whether to accept it. You can also set your browser to turn
off cookies. If you do so, some areas of our websites may not function properly. We use both session ID
and persistent cookies. A session ID cookie simply expires once the user closes the browser. A persistent

cookie is a small text file stored on the user’s hard drive for an extended period of time. These can be
removed by following the instructions in your Internet browser’s help file.

4.2 To help us provide better service, we sometimes collect anonymous information from visits to our websites
through the use of "web beacons." These do not access your personal data, but rather allow us to log
users who have visited our websites. This anonymous information is sometimes known as "clickstream
data." We or our vendors may use this data to analyse trends and statistics to help us provide better
customer service. If you do not want your transaction details used in this manner, see the paragraph above
on cookies.

4.3 We allow third-party companies to collect certain anonymous information when you visit our websites.
These companies may use non-personally identifiable information during your visits to our websites in
order to provide advertisements about goods and services likely to be of greater interest to you. These
companies typically use a cookie or a third-party web beacon to collect this information.

4.4 Links: For links to organisations not affiliated to us, we are not responsible for the privacy practices or the
content of such websites. We recommend you review the terms and conditions of use and privacy policies
in place on such websites.

5. Your Rights and Choices

5.1 The amount of personal data you are required to supply when requesting our services will be limited to
that which is relevant to and reasonable for the supply of such services or for the Purposes for which such
personal data is being collected.

5.2 Where you have asked us to do the following, or have otherwise given us your consent to do the following, we may periodically use your contact information to send you updates via e-mail in order to alert you to our marketing and promotional materials or opportunities, or services relevant to your interactions with us, such as jobs in our database that match your selected criteria. Each notification will provide instructions on how to opt out of receiving similar e-mails from the registered service or resource. At the point where we request personal data about you, our site also gives you the opportunity to decide which communications you wish to receive. The database is automatically updated with your preferences when you opt out. When your interactions with the Company have resulted in your registration for multiple services or resources it may be necessary to opt out from each service separatel

5.3 Additionally, you have the right to request access to, to withdraw your consent to the use and processing of, and request the correction of inaccuracies of, personal data that the Company maintains about you, or that is in the Company’s possession or under its control. We may limit or deny requests for access or charge reasonable fees for access, in accordance with applicable law data protection law.

5.4 Where you seek access to and/or seek to correct the personal data currently in our possession or control, we will need enough information from you in order to ascertain your identity as well as the nature of your request, so as to be able to deal with your request.

5.5 For a request to access personal data, once we have sufficient information from you to deal with the request, we will seek to provide you with the relevant personal data within 30 days. Where we are unable to respond to you within the said 30 days, we will notify you of the soonest possible time within which we can provide you with the information requested. Note that an access request is, however, subject to any exceptions provided by the PDPD or any other relevant laws.

5.6 For a request to correct personal data, once we have sufficient information from you to deal with the request, we will correct your personal data within 30 days. Where we are unable to do so within the said 30 days, we will notify you of the soonest practicable time within which we can make the correction.

5.7 We will process your request to withdraw your consent within a reasonable time from such a request being made, and will thereafter not collect, use and/or disclose your personal data in the manner stated in your request. However, your withdrawal of consent could result in certain legal consequences arising from such withdrawal. In this regard, depending on the extent of your withdrawal of consent for us to process your personal data, it may mean that we will not be able to continue providing our services such as recruitment, placement, or employment, as the case may be.

6. Administration, Management, Protecting and Retaining Your Information

6.1 We will take reasonable efforts to ensure that your personal data is accurate and complete, if your personal data is likely to be used by the Company to make a decision that affects you, or disclosed to another organisation. However, this means that you must also update us of any changes in your personal data that you had initially provided us with. We will not be responsible for relying on inaccurate or incomplete personal data arising from you not updating us of any changes in your personal data that you had initially

6.2 We will also put in place reasonable and appropriate administrative, physical and technical measures such as up-to-date antivirus protection, encryption, use of privacy filters, access control, password protection and disclosing personal data both internally and to our authorised third-party service providers and agents only on a need-to-know basis to prevent any unauthorised access, collection, use, disclosure, copying, modification, disposal, leakage, loss, damage and/or alteration of your personal data. However, we cannot assume responsibility for any unauthorised use of your personal data by third parties which are wholly attributable to factors beyond our control.

6.3 You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While security cannot be guaranteed, we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures.

6.4 We will also put in place measures such that your personal data in our possession or under our control is destroyed and/or anonymized as soon as it is reasonable to assume that (i) the purpose for which that personal data was collected is no longer being served by the retention of such personal data; and (ii) retention is no longer necessary for any other legal or business purposes.

6.5 Where your personal data is to be transferred out of Vietnam, we will comply with the PDPD and any applicable privacy laws. In this regard, this includes us taking appropriate steps to ascertain that the foreign recipient organisation of the personal data is bound by legally enforceable obligations to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the Act. This may include us entering into an appropriate contract with the foreign recipient organisation dealing with the personal data transfer or permitting the personal data transfer without such a contract if the PDPD or law permits us to.

7. Data Breach Notification

7.1 In the event a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, we shall promptly assess the impact and once assessed that it
is a notifiable data breach, we shall report this breach to the relevant authority(ies) based on the country’s data breach notification requirements. We will notify you when the data breach is likely to result in
significant harm to you after our notification to the relevant authority(ies). We may also notify other relevant regulatory agencies, where required

7.2 If we are a Personal Data Processor (Data Intermediary), we shall inform the relevant Personal Data
Controller (Data Controller) immediately of any data breach so they can promptly assess the impact and
comply with their data breach notification obligation.

8. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. If we change our Privacy Policy, we will post the
revised version here, with an updated revision date.

9. How to Contact Us

If you have any questions, grievances or complaints, or comments about this Privacy Policy and/or the
handling of your personal data by us, please contact our Data Protection Officer at:
Address: 18th floor, SONATUS, 15 Le Thanh Ton District 1, Ho Chi Minh City, Vietnam,
Attention: Data Protection Officer, Ms. Nguyen Thuy Vy
Email: mailboxhrvietnam@persolkelly.com
Please note that any resumes or job applications sent to this mailbox will NOT be attended to as this mailbox is
solely for the purposes of personal data protection related feedback. For submissions of resumes or job
applications, please send to us info_vn@persolkelly.com, or visit our website at www.persolkelly.com.vn for more
details