Privacy Policy

Effective date: 01/07/2026 · Last updated: 20/07/2026

PERSONAL DATA PROTECTION POLICY — Version: 2.1 · Effective date: 01 July 2026

This PERSONAL DATA PROTECTION POLICY (hereinafter abbreviated as the “PDP Policy” or the “Policy”) is published by NewEra Inc Joint Stock Company (hereinafter abbreviated as “NEWERA”) on the website https://newera.inc/ and/or on NEWERA's NEXA Application and/or notified through such other means of communication as NEWERA considers appropriate. DATA SUBJECTS SHOULD READ AND CAREFULLY UNDERSTAND THIS POLICY BEFORE CARRYING OUT ANY ACTIVITY RELATING TO THE PROVISION OF THEIR PERSONAL DATA TO NEWERA.

This PDP Policy describes NEWERA's activities relating to the protection of personal data of Data Subjects who are customers, prospective customers, job applicants, employees and other individuals connected with NEWERA through relationships arising from legal requirements and/or from requests, contracts or agreements between NEWERA and the Data Subject. This Policy also constitutes the rules for protecting personal information and transaction information between NEWERA and customers and consumers (who use NEWERA's utilities and services) as required by consumer protection law.

NEWERA applies and implements this Policy in its capacity as a Personal Data Controller, a Personal Data Controller and Processor, or a Personal Data Processor, and it applies to Data Subjects who have a legal relationship or connection with NEWERA. This Policy also clarifies the types of personal data NEWERA collects, the purposes of collection, the manner of use, the parties with whom data is shared, data retention, and the data-protection measures applied to ensure that such data always remains safe and secure through reasonable, necessary efforts.

Article 1. NEWERA's Statements And Commitments Regarding Personal Data Protection Activities

1. NEWERA fully complies with Vietnamese law and with the contracts, agreements and commitments established with Data Subjects in its personal data protection activities.
2. NEWERA collects personal data for specific, clear and lawful purposes, and uses personal data within the scope of the purposes set out in this Policy and in accordance with Vietnamese law.
3. NEWERA consistently applies and updates technical measures that meet Vietnamese legal requirements and appropriate standards to ensure the security of personal data, including measures to protect Data Subjects from unauthorized or unlawful access and/or the destruction, loss of, or harm to, personal data.
4. NEWERA stores data in an appropriate manner and to the extent necessary for the purposes of processing, in accordance with Vietnamese law.
5. Where data is transferred to a third party or a competent state authority, NEWERA ensures that such transfer complies with the law on confidentiality and personal data protection and with the agreements, contracts and commitments made with the Data Subject. Where necessary, NEWERA will review the recipient's data security and safety policies/information security policies/personal data protection policies to ensure that they apply standards equivalent to NEWERA's commitments set out in this Article.
6. In addition to the statements and commitments above, NEWERA is committed to complying with regulations relating to the protection of children's data and of vulnerable consumers, and to ensuring compliance with legal regulations on confidentiality, data protection and consumer-rights protection from time to time.

Article 2. Definitions

In this PDP Policy, the following words and terms shall have the meanings set out below:

For the purposes of this PDP Policy: terms not defined in this Article, and matters not addressed in this Article, shall be construed, interpreted and applied in the following descending order of priority: (1) the contract or agreement executed/established in writing or by electronic means between the Customer and NEWERA relating to the provision and use of Products and Services (the “Contract”); (2) NEWERA's NEXA Terms of Service; (3) documents and records relating to the provision and use of Products and Services (if any); and (4) NEWERA's other internal rules and policies. In all cases, the construction, interpretation and application of the foregoing documents must not conflict with Applicable Law. Any reference to Vietnamese legal regulations includes any amending, supplementing or replacing documents from time to time. Where a change in law causes the content of this PDP Policy to conflict with legal regulations, or in respect of matters not addressed by this PDP Policy, the Parties shall prioritize the application of Vietnamese law in force at the relevant time. Headings are for convenience only and do not affect the interpretation of this Policy. Words in the singular include the plural and vice versa. Any reference to an Article or Clause in this PDP Policy is a reference to the corresponding Article or Clause of this Policy. Any reference to a document (including this PDP Policy) is a reference to that document together with its amended, supplemented, annotated or replacement versions (except where expressly excluded in this PDP Policy). Any reference to a Party in this PDP Policy or related documents includes that Party's lawful successors, replacements and assignees. Any reference to time in this PDP Policy is to standard time in Hanoi, Vietnam. Business days are the days of the week excluding Saturdays, Sundays, public holidays and Tet holidays under Vietnamese law, the corresponding make-up days, and any other days off announced by NEWERA from time to time. Where a document refers to a “day” or “month”, such terms mean a calendar day and a calendar month, respectively. Working hours means the period within a business day, namely: morning from 08:30 to 12:00, and afternoon from 13:30 to 18:00.

Article 3. Types Of Personal Data Collected

In order for NEWERA to Process Personal Data for the purposes set out in Article 5 of this Policy, NEWERA may collect and process basic and sensitive Personal Data (as defined in Article 2 above), including the types of Personal Data listed below, which may change depending on the relationship between the Data Subject/Customer and NEWERA, the Data Subject's/Customer's interactions with NEWERA, and Applicable Law from time to time.

1. Basic Personal Data collected includes:
   1. Surname, middle name and given name as registered at birth, and any other name(s) (if any);
   2. Date of birth; date of death or date reported missing;
   3. Gender;
   4. Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current residential address, hometown, and contact address; email address, phone number and/or other information enabling messages/correspondence to be transmitted, sent to, or exchanged with, the Data Subject/Customer;
   5. Nationality;
   6. Personal images (including images and information obtained from security camera systems);
   7. Voice;
   8. Phone number, personal identification number/citizen ID number, passport number, personal tax code, social insurance number, and health insurance card number;
   9. Marital status; family relationships (spouse, parents, children), and relationship with the employer;
   10. Information on the Data Subject's/Customer's occupation, position, education or employment history, and degrees or certificates received;
   11. Information on an individual's digital account(s);
   12. Data from the Data Subject's/Customer's verbal and/or written communications with NEWERA through NEWERA's transaction points/customer-care channels/information-reception channels.
2. Sensitive Personal Data collected includes: In certain cases, NEWERA may need to collect sensitive Personal Data of the Data Subject/Customer, or where permitted by law. Such sensitive Personal Data may include:
   1. Information relating to ethnic origin;
   2. Health status and information on private life recorded in medical records, excluding blood-type information;
   3. Biometric data;
   4. Data on crimes and violations of law collected and stored by law-enforcement agencies;
   5. Data on an individual's location as determined through location-based services;
   6. Data on images of ID cards, citizen identification cards, passports and visas;
   7. Bank-account login usernames and passwords; bank-card information; bank-account transaction history data; financial, credit and other information on the activities and transaction history relating to finance, securities and insurance of a customer at credit institutions, foreign bank branches, payment-intermediary service providers, securities companies and insurers;
   8. Financial and commercial data: information enabling the determination of the Data Subject's/Customer's financial status, standing and history, such as: customer information held by credit institutions, foreign bank branches, payment-intermediary service providers and other licensed institutions, including customer identification information as required by Applicable Law, account information, and transaction information;
   9. Data reflecting activity and activity history in cyberspace: may include data on the use of Products and Services, IP address, referral URL, operating system, browser, and any other information automatically recorded from connections such as cookies, flash cookies, pixel tags, web beacons, or other tracking technologies; third-party cookies, plug-ins or social-network connectors; any technology capable of tracking personal activity on devices or websites; location information or other metadata provided by a device; marketing data such as advertising interests; responses to direct marketing; and opt-in/opt-out choices for direct marketing;
   10. An individual's location data as determined through location-based services.
3. Other Personal Data appropriate and necessary for the use of NEWERA's Products and Services from time to time shall be specifically set out in the relevant terms and conditions for use of such Products and Services.
4. Where Applicable Law provides otherwise regarding the types of Personal Data and the classification of Personal Data, NEWERA shall comply with, and prioritize the application of, the corresponding provisions of Applicable Law, rather than the provisions of this Article 3.

Article 4. Manner And Methods Of Collecting Personal Data

1. Personal Data collected directly from the Data Subject: when the Data Subject registers for and/or uses Products and Services; interacts with an individual/unit authorized or engaged by NEWERA; interacts with NEWERA's call center, website, application, fan page, social media, and other digital platforms (as a Personal Data Processor); or when the Data Subject/Customer visits, works or transacts at NEWERA's head office, offices, or place(s) of business (if any).
2. Personal Data collected from/through a Personal Data Provider (a Third Party):
   1. Personal Data Providers include:
      1. An individual Customer providing information about another individual who is a Data Subject, including but not limited to information on: dependents, persons related under law, spouses, children, parents, siblings, guardians, blood relatives, authorized persons, partners, customers, emergency contacts, or other individuals related to the Customer, where NEWERA must collect such information to fulfil requests and provide Products and Services to the Customer in accordance with NEWERA's rules and Applicable Law;
      2. An organizational Customer providing information about another individual who is a Data Subject, including but not limited to information on: persons connected with the organization, founders, legal representatives, authorized representatives or accountants, managers, owners, employees, customers, beneficial owners, and other individuals, where NEWERA must collect such information to fulfil requests and provide Products and Services to the Customer in accordance with NEWERA's rules and Applicable Law;
      3. NEWERA's service providers, partners and consultants, including but not limited to organizations or individuals conducting surveys, social-media communications, marketing, fraud prevention, data aggregation, infrastructure/systems/service/technology and information support, credit institutions transacting with NEWERA, parties involved in transaction processing, organizations supporting customer identification and verification, brokers, and other third parties connected with NEWERA's business operations;
      4. Third parties with a legal relationship with the Data Subject, including but not limited to employers, co-owners of assets, guarantors, security providers, suppliers of goods or services to the Data Subject, and third parties whom the Data Subject has agreed may collect and provide Personal Data to NEWERA;
      5. Competent state authorities in Vietnam, in accordance with Applicable Law.
   2. When providing NEWERA with the Personal Data of any other person (the “Individual Concerned”), the Personal Data Provider represents, warrants and is responsible to NEWERA for ensuring that:
      1. The information provided to NEWERA is accurate and complete, and it will notify NEWERA of any changes or errors in the Personal Data already provided to NEWERA;
      2. Except where otherwise provided by law, it has notified the Data Subject and clearly understands, and has obtained the lawful consent/approval or valid authorization of, the Individual Concerned to: (i) provide Personal Data to NEWERA, and (ii) permit NEWERA to Process Personal Data for the purposes set out in this Policy;
      3. The Personal Data Provider agrees that NEWERA is not responsible for verifying the legality or validity of such consent/approval/authorization, and that retaining evidence of the same is the Personal Data Provider's responsibility;
      4. The Personal Data Provider must furnish evidence upon NEWERA's request. NEWERA is released from liability and is entitled to claim compensation for related damage and costs where the Personal Data Provider fails to comply properly with the commitments in this Clause;
      5. For Personal Data about/of a child, the Personal Data Provider must provide documents proving that it is the lawful parent or guardian of the child, or must have obtained the consent of the child's lawful parent or guardian, before providing the data to NEWERA;
      6. For a child over 7 years of age, the Personal Data Provider must obtain the consent of the child over 7 (seven) years of age to the Processing of Personal Data under this Policy.
3. Personal Data collected from:
   1. Websites and mobile applications: NEWERA may collect Data when a Data Subject accesses any website, or downloads or uses any mobile application, or uses any feature or resource available on or through a website or mobile application. When a Data Subject accesses such a website or application, NEWERA may collect Data left by the Data Subject and/or information about the Data Subject's device and browser (such as device type, operating system, browser type, browser settings, IP address, language settings, date and time of connection to the website or mobile application, and other technical communication information), all or some of which may constitute Data;
   2. Audio and video recording devices: NEWERA may collect voice data and personal images of a Data Subject through audio and video recording devices installed at NEWERA's head office, branches, offices, place(s) of business (if any), or wherever NEWERA carries out part or all of its operations and where a Data Subject meets, appears, or otherwise interacts with NEWERA;
   3. Interactions or automated data-collection technologies: NEWERA may collect information including IP address, referral URL, operating system, browser, and any other information automatically recorded from connections such as: (i) cookies, flash cookies, pixel tags, web beacons, or other tracking technologies; (ii) third-party cookies, plug-ins or social-network connectors; (iii) any technology capable of tracking personal activity on devices or websites.
4. Personal Data collected from available public information sources or other means and methods: NEWERA may collect Personal Data through public, official sources, or through information shared by the Data Subject or by related organizations and individuals.

Article 5. Purposes Of Processing Personal Data

NEWERA aims to serve and protect Data Subjects in all of its Personal Data processing activities. For each activity and specific purpose, NEWERA is committed to collecting and processing only the Personal Data necessary for that activity and purpose, and to ensuring that such collection and processing complies with Vietnamese law and this Policy. NEWERA's specific data-processing purposes are set out below:

1. To assess, provide and improve the quality of Products and Services provided to Customers, including but not limited to:
   1. Assessing the validity and appropriateness of the information, documents and applications requested for a Data Subject/Customer to use Products and Services;
   2. Conducting customer due diligence and know-your-customer (KYC) checks as required by Applicable Law;
   3. Setting transaction limits and the scope of Products and Services provided (if any); operating, providing and evaluating Products and Services for Data Subjects/Customers;
   4. Developing, testing and analyzing information systems and Products and Services;
   5. Recording NEWERA's communications with Data Subjects/Customers in order to improve the quality of Products and Services;
   6. Conducting customer-satisfaction surveys; scoring, evaluating and ranking Data Subjects/Customers for the purpose of providing Products and Services;
   7. Collecting information by aggregating data from the use of Products and Services in order to provide Data Subjects/Customers with more suitable Products and Services;
   8. Implementing NEWERA's promotional programs, incentives and support for Data Subjects/Customers;
   9. Providing and carrying out transactions between another organization and a Data Subject where NEWERA participates as an agent or cooperating party in accordance with Applicable Law;
   10. Contacting a Data Subject to provide information about NEWERA's Products and Services;
   11. Processing Personal Data in activities aimed at ensuring the safety of a Data Subject's assets, transactions and data; ensuring legal compliance, governance and risk prevention, auditing, accounting, and the exercise of NEWERA's lawful rights and legal obligations;
   12. Collecting, providing, sharing or transferring Personal Data to a Personal Data Processor that is a partner, supplier or third party with which NEWERA cooperates and/or whose services NEWERA uses, in order to provide Products and Services, support advisory services, and ensure the effectiveness and safety of the Products and Services provided;
   13. Processing Personal Data for the purposes of analytics, advanced analytics, and training AI models and systems (provided that Personal Data has first been de-identified and to the extent permitted by law), and other activities to research and develop Products and Services and technology utilities in support of business or NEWERA's other support and operational activities;
   14. Carrying out activities to protect or exercise NEWERA's lawful rights under contracts or agreements with a Data Subject and under law, including the right to locate and verify a Data Subject's location through location-based services, and to collect service fees owed to NEWERA by a Data Subject (if any);
   15. Carrying out transactions such as the transfer, disposal, or reorganization of NEWERA's business;
   16. Fulfilling community responsibilities in accordance with Applicable Law;
   17. Fulfilling obligations under law and at the request of competent state authorities;
   18. Carrying out other activities necessary for NEWERA's risk-management activities and to ensure compliance with relevant law, in accordance with legal requirements.
2. To fulfil requests from Data Subjects/Customers and obligations under contracts, agreements and other documents between NEWERA and Data Subjects/Customers, including but not limited to:
   1. Carrying out transactions or actions in accordance with a Data Subject's/Customer's instructions or requests;
   2. Keeping updated information about legal representatives, authorized persons, and persons authorized to execute contracts, agreements and commitments in connection with the provision of Products and Services and the Company's business operations;
   3. Communicating with Data Subjects/Customers to exchange information and transaction content, and to provide updated information on changes to Products and Services, policies, terms and conditions for the provision and use of Products and Services, and related documents concerning the provision and use of Products and Services;
   4. Providing information, guidance and advice on Products and Services at a Data Subject's/Customer's request; and handling queries, requests, inquiries and complaints relating to the use of Products and Services carried out by, or in the name of, a Data Subject/Customer;
   5. Recording NEWERA's communications with Data Subjects/Customers arising in connection with the provision and use of Products and Services, for record-keeping and evidentiary purposes, including online messages, emails, and phone conversations;
   6. Implementing terms relating to care policies and the management of benefits connected with the relationship between NEWERA and a Data Subject/Customer, or arising from a Data Subject's/Customer's participation in events, conferences, seminars, advertising/marketing campaigns, or similar programs.
3. To carry out trade promotion, marketing and promotional activities, including but not limited to:
   1. Marketing (directly or indirectly) to a Data Subject/Customer Products and Services that may be of interest to them, or that offer them incentives or benefits. Where a Data Subject/Customer wishes to unsubscribe from notifications/advertisements or other content, the Data Subject/Customer may contact NEWERA using the contact methods set out in Article 14 of this Policy;
   2. Sending information to a Data Subject/Customer regarding promotional programs, gift exchanges, prizes, gift deliveries, and benefits, and collecting a Data Subject's/Customer's feedback through surveys and other forms of trade promotion in accordance with law.
4. To manage NEWERA's internal operations, business activities and internal risk management, including but not limited to:
   1. Managing user authentication and access control for NEWERA's online Products and Services;
   2. Checking the completeness, accuracy and legality of Personal Data collected by NEWERA;
   3. Fulfilling reporting, financial, accounting, tax, audit and other legal obligations required by Applicable Law;
   4. Carrying out activities for the purpose of monitoring, inspection, internal control, audit and risk management;
   5. Serving requirements arising in NEWERA's internal operations, and ensuring the sound and safe operation of communication and information-processing systems, the development and testing of IT systems, and NEWERA's business planning and decision-making.
5. To develop and manage human resources, including but not limited to:
   1. Verifying candidate eligibility; assessing applications, documents and records for the purpose of vetting and assessing candidate qualifications, registering candidate applications, and supporting the recruitment process;
   2. Executing and managing employment contracts and agreements with candidates and employees;
   3. Training, testing and assessing work quality and compliance with obligations under contracts, agreements and commitments between an employee and NEWERA.
6. To help ensure the safety of Data Subjects/Customers and NEWERA's employees, including but not limited to:
   1. Implementing identity-verification measures for entry to and exit from buildings/offices/workplaces/places of business/locations where NEWERA carries out part or all of its business operations and similar NEWERA facilities;
   2. Using surveillance camera systems at NEWERA's head office, offices, and place(s) of business (if any) to prevent and detect fraud and/or other criminal conduct such as theft of property;
   3. Investigating and reporting incidents or emergencies affecting NEWERA's assets, information systems, and facilities;
   4. Ensuring the safety of NEWERA's information and network systems to keep the data of Data Subjects/Customers safe and secure;
   5. Complying with health and security/safety regulations.
7. To monitor, assess risk, compile statistics, analyze, detect and prevent violations of law, including but not limited to fraud, money laundering, terrorist financing, bribery, corruption, and high-tech crime.
8. To comply with Applicable Law and the requirements of competent state authorities.
9. To protect NEWERA's lawful rights and interests, exercise legal rights, and conduct legal proceedings, including but not limited to:
   1. Investigating, exercising rights, and protecting NEWERA's interests from being infringed;
   2. Retaining records as evidence where necessary for any potential lawsuit or investigation;
   3. Contacting and carrying out lawful procedures to recover outstanding service fees owed by a Customer to NEWERA;
   4. Obtaining professional advice on the Products and Services and technology utilities provided by NEWERA;
   5. Resolving disputes, requests, inquiries and complaints between a Data Subject and NEWERA and/or related parties;
   6. Defending against, or responding to, any matter, action or legal proceeding involving any competent state authority, agency or other organization, whether current or future.
10. To allow a Data Subject to use, and to be provided with and experience, products and services within the NEWERA Ecosystem (if any); for this purpose, Personal Data may be synchronized and shared by NEWERA with companies within the NEWERA Ecosystem. NEWERA and companies within the NEWERA Ecosystem undertake to apply the most reasonable standards, comply with this Policy, and comply with Applicable Law when sharing data.
11. To enhance the experience, benefits and technology utilities available to a Data Subject; for this purpose, Personal Data may be processed by NEWERA for care and support activities for the Data Subject, for personalized offers (such as promotional gifts, care, referrals, and advertising of products and services), and to improve service quality and deliver greater value to the Data Subject, helping the Data Subject fully access and enjoy their benefits and/or increase their opportunities and benefits when using NEWERA's Products and Services. Personal Data is also processed for the purpose of enhancing the Data Subject's experience and benefits under this Policy.
12. Where NEWERA processes a Data Subject's data for purposes other than those set out above, NEWERA will do so only with the Data Subject's consent, except where Applicable Law provides that such consent is not required.

Article 6. Organizations And Individuals Permitted To Process Personal Data

1. In order to carry out the purposes and activities of Processing Personal Data set out in Article 5 above, NEWERA may provide Personal Data, on a contractual basis, to the following permitted Personal Data Processor(s) or Third Parties, ensuring the principle that the receiving party shall Process only the Personal Data necessary for the purpose of performing the functions and tasks assigned or engaged by NEWERA, in accordance with this Policy, the contracts, agreements and other documents established with the Data Subject/Customer, Applicable Law, and/or other rules that NEWERA must comply with, specifically:
   1. NEWERA's employees;
   2. The lawful representative of a Data Subject/Customer (a guardian or authorized person), or any party that has consented/been authorized or that has a lawful basis for sharing;
   3. NEWERA's service providers and cooperating partners, including but not limited to: (i) providers of business-support services (administration, information technology, information security, infrastructure, telecommunications, marketing, market research, storage, audit, legal advisory, tax, etc.); (ii) insurance companies, insurance brokers and insurance agents; (iii) organizations involved in processing a Data Subject's/Customer's transactions, such as commercial banks, payment service providers, and payment-intermediary service providers, including payment-acceptance units, e-commerce service providers, payment-processing units and card-association members; and (iv) partners cooperating in the development and provision of Products and Services to a Data Subject/Customer or supporting NEWERA's business operations;
   4. Organizations within NEWERA's Ecosystem (if any);
   5. Competent state authorities, regulatory bodies, or third parties to whom NEWERA has the right or obligation to disclose data under Applicable Law or pursuant to commitments, contracts or agreements;
   6. Other related parties approved by the Data Subject and/or that NEWERA considers necessary to meet and protect the lawful rights and interests of the Data Subject and NEWERA's own lawful rights and interests.
2. When providing Data to related parties, NEWERA will apply necessary measures and fully comply with Applicable Law to ensure the safety of the Data provided.

Article 7. Data Processing Activities And Methods

1. Data processing activities and methods:
   1. A Data Subject's personal data may be processed by NEWERA by carrying out one or more activities such as receiving, collecting, recording, analyzing, aggregating, confirming, storing, editing, disclosing, combining, accessing, retrieving, recalling, encrypting, decrypting, copying, sharing, transmitting, providing, disclosing, transferring, converting, organizing, deleting, destroying, de-identifying data, processing data within a Big Data Analytics System, or other activities affecting Personal Data;
   2. Depending on the purpose of data processing, NEWERA, NEWERA's Personal Data Processor, or a third party permitted to process data for NEWERA under an agreement or contract, may apply appropriate processing methods, including automated or manual data-processing methods, or other methods consistent with law and with NEWERA's practices from time to time. Automated data processing shall not affect the lawful rights and interests of a Data Subject.
2. Data storage and security:
   1. Data of a Data Subject stored by NEWERA will be kept secure. NEWERA will take reasonable measures to protect a Data Subject's data. NEWERA will store a Data Subject's Data in Vietnam, either at NEWERA or with a third party chosen by NEWERA. NEWERA will only store a Data Subject's Data overseas where permitted by Applicable Law. NEWERA may apply cloud-storage solutions consistent with relevant Applicable Law. NEWERA applies global data-security standards consistent with current Applicable Law;
   2. NEWERA stores a Data Subject's data for the period necessary to fulfil the data-processing purposes set out in this Policy, unless a longer retention period is required or permitted by relevant Applicable Law then in force;
   3. In any data-processing activity, security is NEWERA's highest priority. NEWERA will apply appropriate technical and technological measures to prevent unauthorized access to, or use of, Data.
3. Cross-border transfer of Personal Data (if any):
   1. In order to carry out the data-processing purposes agreed with a Data Subject, NEWERA may share a Data Subject's Personal Data with NEWERA's related third parties, which may be based in Vietnam or outside the territory of Vietnam.
   2. A Data Subject carries out the cross-border transfer of Personal Data (including the use of Data in cyberspace, on devices, by electronic means, or by other methods to transfer Data outside the territory of Vietnam). NEWERA will comply with the legal obligations and requirements relating to the cross-border transfer of Personal Data, including requiring the recipient to ensure that a Data Subject's Data transferred to it will be kept secure and safe.
4. Notice of data processing: The Data Subject confirms that, by accepting this Policy on the application, website, or by any other means, whether by clicking a “Select” box and then an “Agree” button, or by any other means of confirming agreement, such as replying via email or in writing when consulted by NEWERA, the Data Subject has been notified by, is aware of, and agrees with, all of the content that must be notified to the Data Subject in advance of NEWERA processing data, including that the Data Subject's sensitive Personal Data may be processed by NEWERA, that a Data Subject's Personal Data may be processed within a Big Data Analytics System, and that Personal Data may be subject to Automated Processing through an artificial-intelligence system in accordance with Vietnam's applicable law on artificial intelligence. The Data Subject agrees that NEWERA is not required to provide further notice or obtain renewed consent from the Data Subject before processing data.
5. Updating, amending and cancelling Data:
   1. NEWERA and the relevant Personal Data Processors will update and correct Personal Data at a Data Subject's request or as required by law. NEWERA undertakes to apply the necessary measures to ensure the accuracy of Personal Data when updating and correcting it. Where NEWERA is unable to correct Personal Data for good cause, NEWERA undertakes to fully discharge its responsibilities under Applicable Law.
   2. NEWERA will delete, destroy or de-identify Personal Data in the following circumstances: where the Data Subject so requests and accepts the risks and losses that may result. A Data Subject's request in such a case must comply fully with the principles set out by law, such as: the purpose of Processing Personal Data has been fulfilled; the retention period under Applicable Law has expired; the request is made pursuant to a decision of a competent state authority; the request is made pursuant to an agreement; or other cases provided by Vietnamese law. NEWERA complies with relevant Applicable Law when deleting, destroying and de-identifying Personal Data.
6. Processing the personal data of children, persons who have lost or have limited civil-act capacity, or persons with cognitive difficulties or difficulty controlling their behavior:
   1. NEWERA will process the data of children, persons who have lost or have limited civil-act capacity, or persons with cognitive difficulties or difficulty controlling their behavior, on the principle of protecting their rights and acting in their best interests, and in accordance with Applicable Law.
   2. NEWERA will only process the Personal Data of a child, or of a person who has lost or has limited civil-act capacity, or a person with cognitive difficulties or difficulty controlling their behavior, if their lawful representative exercises the Data Subject's rights on their behalf. The lawful representative is responsible for obtaining the child's consent before providing the child's Personal Data to NEWERA, and for fully complying with the provisions on the Transfer of Data of the Individual Concerned set out in this Policy.
7. Organizations and individuals involved in data-processing activities:
   1. Depending on the case, NEWERA may act as a Personal Data Controller or as a Personal Data Controller and Processor.
   2. Under this Policy, the Data Subject understands that NEWERA may share Data with organizations and individuals that process Data as set out in Article 6 of this Policy. Data sharing will be carried out in accordance with the order, manner and requirements of Applicable Law.
   3. Organizations and individuals that receive and process Data are obliged to keep the Data secure in accordance with this Policy, NEWERA's internal rules and data-protection standards, and Applicable Law.

Article 8. Commencement And Termination Of The Processing Of Personal Data

1. Except where otherwise provided by Applicable Law then in force, NEWERA begins Processing Personal Data upon receiving Personal Data with the Data Subject's/Customer's consent and/or a Personal Data Provider's commitment as to the Data Subject's consent to the Processing of Personal Data under this Policy.
2. NEWERA will end the Processing of Personal Data upon the occurrence of whichever of the following comes later:
   1. At the Data Subject's written request;
   2. Where the legal agreements between the Data Subject/Customer and NEWERA terminate, or the Parties have fulfilled all obligations relating to such legal agreements;
   3. Where a dispute or complaint is concluded by agreement/judgment/decision of a competent state authority that has taken legal effect;
   4. Upon completion of the processing purpose to which the Data Subject consented;
   5. Upon completion of the retention obligation under Applicable Law;
   6. As provided by Applicable Law.

Article 9. Rights And Obligations Of The Data Subject

1. Rights of the Data Subject:
   1. The right to be informed: a Data Subject has the right to be informed about the processing of their personal data. NEWERA provides documents and notices on personal data protection, together with this Policy, fully informing the Data Subject so that they are aware and understand these matters before providing Personal Data and consenting to NEWERA processing their personal data;
   2. The right to consent: a Data Subject has the right to consent or not consent, and to request the withdrawal of consent, to the processing of Personal Data. However, a Data Subject should note that the exercise of these rights must be carried out in compliance with relevant Applicable Law;
   3. The right to request provision of, to view, and to correct or request correction of, Personal Data: except where otherwise provided by Applicable Law, a Data Subject has the right to request that NEWERA allow them to view, correct, and/or request the correction of, their Personal Data held by NEWERA;
   4. The right to request deletion of, or restriction on the processing of, Personal Data, and to object to the processing of Personal Data: a Data Subject may withdraw their consent to any or all data-processing activities agreed with NEWERA; may request the deletion of Data, restriction of Processing, or object to Processing; and has the right to anonymize or delete their profile and identifying data, even where the technology platform retains a history of behavior;
   5. The right to complain, denounce, initiate legal proceedings, and claim damages in accordance with law: a Data Subject may respond to, report, or complain to NEWERA about any violation, or suspected violation, of data protection of which they become aware;
   6. The right to request that a competent state authority, or an agency, organization or individual involved in the Processing of Personal Data, implement measures or solutions to protect their Personal Data in accordance with Applicable Law;
   7. Other rights of the Data Subject under this Policy, the Contracts, the relevant terms and conditions for the provision and use of Products and Services, and personal data protection law.
2. Obligations and commitments of the Data Subject:
   1. To protect their own Personal Data and require other organizations and individuals to protect their Personal Data; and to promptly notify NEWERA upon discovering any error, mistake or leak concerning their Personal Data, or upon suspecting that their Personal Data has been infringed;
   2. To respect and protect the Personal Data of others;
   3. To provide their Personal Data fully and accurately in accordance with Applicable Law, under a contract/agreement, or when consenting to the processing of their Personal Data. Where any of a Data Subject's Personal Data is provided incorrectly, the Data Subject shall be responsible where that information affects or limits the Data Subject's own rights and interests;
   4. To comply with the law on personal data protection, refrain from acts prohibited by current law, and participate in preventing and combating violations of Personal Data;
   5. To read and clearly understand this Policy before carrying out any activity relating to the Processing of Personal Data with NEWERA;
   6. Other obligations under this Policy, the relevant contracts/agreements and terms and conditions for the provision and use of Products and Services, and personal data protection law.
3. Notes on exercising the Data Subject's rights and obligations:
   1. A Data Subject may exercise the rights set out above by submitting a request to NEWERA. A Data Subject's request must be sent to NEWERA following the correct order, procedure, location and method of receipt, and must include complete information and content, such as: the type of Personal Data to be deleted, the reason, and the purpose of the request, etc. Any costs arising (if any) from fulfilling such requests, including but not limited to printing, copying, postal and courier costs, shall be borne by the Data Subject;
   2. NEWERA will handle a Data Subject's requests in accordance with law and having regard to the Data Subject's legitimate interests. Where a Data Subject withdraws their consent, requests the deletion of their Personal Data, and/or exercises other related rights over any or all of their Personal Data in a manner that affects NEWERA's ability to provide or maintain Products and Services to that Data Subject or a related person, or to maintain a contractual/agreement relationship, NEWERA may, depending on the nature of the request, consider and decide to discontinue providing NEWERA's Products and Services to the Data Subject or to terminate the contractual relationship between NEWERA and the Data Subject. Acts carried out by a Data Subject under this provision shall be regarded as a unilateral termination by the Data Subject of any legal relationship between the Data Subject and NEWERA, and may fully give rise to a breach of obligations or commitments under any contract/agreement between the Data Subject and NEWERA. NEWERA reserves the right to apply its lawful remedies in such cases; NEWERA shall not be liable to the Data Subject for any resulting loss, and NEWERA's lawful rights shall be fully reserved;
   3. NEWERA will fulfil requests to exercise a Data Subject's lawful rights within a period consistent with Applicable Law. However, for the purposes of legal compliance and/or security, NEWERA may require a Data Subject to verify their identity before processing the Data Subject's request;
   4. NEWERA has the right to refuse to fulfil a Data Subject's requests in certain cases, including but not limited to where: (i) the Data Subject fails to follow the correct order or procedure under NEWERA's guidance; (ii) the Data Subject fails to satisfy NEWERA's identity-verification requirements; or (iii) NEWERA assesses that there are indications of fraud or a breach of personal data protection; or (iv) legal regulations do not permit the request to be fulfilled;
   5. A Data Subject must comply with Applicable Law and with a Data Subject's obligations under any contract/agreement executed with NEWERA. The exercise of a Data Subject's rights and obligations must be aimed at protecting that Data Subject's own lawful rights and interests;
   6. A Data Subject must not obstruct or impede the exercise of NEWERA's or the relevant Personal Data Processor's lawful rights and obligations;
   7. A Data Subject must not infringe the lawful rights and interests of the Vietnamese State or of any other agency, organization or individual;
   8. Where a Data Subject provides their own Personal Data to NEWERA, that Data Subject must fully comply with the responsibilities of a Personal Data Provider set out in this Policy.

Article 10. Rights And Obligations Of NEWERA

1. To comply with Personal Data Protection Law No. 91/2025/QH15 and other related legal regulations on personal data protection. Where processing Big Data containing Personal Data, NEWERA is responsible for ensuring full compliance with personal data protection regulations.
2. To properly fulfil its commitments and responsibilities under this Policy and Applicable Law; to ensure the accuracy of Personal Data and have it corrected, updated or supplemented as necessary; to retain Personal Data for a period consistent with the purpose of data processing, unless Applicable Law otherwise provides; to implement measures to ensure information security and protect the Personal Data of Data Subjects/Customers; to collect, transfer and process Personal Data only within the scope of, and for, specific, clear purposes, ensuring compliance with Applicable Law and this Policy; and to proactively prevent, detect, deter, combat, and promptly and strictly handle, any violation of law on personal data protection.
3. To apply, maintain and regularly review management, technical and organizational measures to protect personal data from the risk of unauthorized access, use, disclosure, alteration or destruction.
4. To fully and clearly notify Data Subjects/Customers of the processing of personal data in accordance with Applicable Law and NEWERA's personal data protection policy.
5. To ensure and create conditions for a Customer to exercise a Data Subject's rights under Applicable Law, including but not limited to the right to be informed, the right to consent, the right of access, the right to correction, the right to withdraw consent, and other rights under Applicable Law.
6. To be liable to Data Subjects/Customers and under law for damage arising from the processing of personal data due to NEWERA's fault, in accordance with Applicable Law.
7. To coordinate with the Ministry of Public Security and other competent state authorities in personal data protection efforts, and to provide information and documents necessary at the lawful request of a competent authority.
8. Other rights and obligations under this Policy, the relevant contracts/agreements and terms and conditions for the provision and use of Products and Services, and personal data protection law.

Article 11. Unintended Consequences And Damage That May Occur

1. Data processing always carries an inherent risk of data leakage or inappropriate processing. NEWERA recognizes the importance of, and its responsibility for, protecting Personal Data, and is committed to applying protective measures consistent with current Applicable Law, and to regularly reviewing and updating the most optimal technical measures to ensure the safety of data processing, making every effort to prevent risk and limit any unintended consequences or damage that may occur, and to protect the lawful rights and interests of the Data Subject and of NEWERA. However, NEWERA cannot guarantee the absolute security of Personal Data in certain cases, such as:
   1. A technology-system error during data processing that causes the loss of a Data Subject's Data;
   2. A security vulnerability beyond NEWERA's control, or a system attack that causes Data to be leaked or exposed;
   3. The occurrence of a force-majeure event under current artificial-intelligence law;
   4. The occurrence of other force-majeure events beyond NEWERA's control.
2. When NEWERA processes a request relating to a Data Subject's rights:
   1. A Data Subject's withdrawal of consent, request to delete data, restriction of processing, objection to the Processing of Personal Data, and/or exercise of other related rights over any or all Personal Data may affect NEWERA's ability to provide/maintain Products and Services for the Data Subject/Customer. Depending on the nature of the Data Subject's request, NEWERA may consider and decide to refuse, or discontinue, providing Products and Services to the Data Subject/Customer. Acts carried out by a Data Subject under this provision shall be regarded as a unilateral termination of the contract/agreement by the Data Subject/Customer in respect of any relationship between the Data Subject/Customer and NEWERA, and may fully give rise to a breach of obligations or commitments under any contract/agreement or other document between the Data Subject/Customer and NEWERA. Accordingly, the Data Subject/Customer shall be liable for any resulting loss, and NEWERA's lawful rights shall be expressly reserved with respect to limiting, restricting, suspending, cancelling, or declining any request relating to such Personal Data;
   2. Requests to delete data, withdraw consent, restrict processing, or object to the processing of data shall not affect the lawfulness of NEWERA's prior data-processing activities;
   3. With respect to requests to view or correct Personal Data, the Data Subject understands and agrees that, in certain cases, for technical reasons, the capacity of NEWERA's systems or infrastructure, the need to verify Personal Data before correction under Applicable Law, or for other reasons, the scope of the types of Personal Data, and the manner in which a Data Subject may access, view and correct such Personal Data, may be affected and limited.
3. NEWERA recommends that a Data Subject:
   1. Keep secure any information relating to their account login password and OTP code, and not share such information with any third party. A Data Subject should be aware that whenever they disclose and make their Personal Data public, that data may be collected and processed by other organizations or individuals for purposes beyond the control of the Data Subject and of NEWERA;
   2. When using cyberspace to transmit Data, only use secure systems and devices to access websites, applications or devices in order to use NEWERA's Products and Services. A Data Subject is responsible for keeping their access credentials for each website, application or device safe and confidential. A Data Subject should immediately notify NEWERA upon discovering any misuse or unauthorized use of their login information, and should change their access password immediately.

Article 12. Measures To Ensure Information Security And Personal Data Protection

The Company has the following rights and responsibilities:

1. To review and update management and technical measures to protect the Personal Data of Data Subjects/Customers from unauthorized access, processing, destruction or deletion.
2. To record and retain system logs of the Personal Data processing process.
3. To report violations of personal data protection regulations as required by Applicable Law.
4. To select a Personal Data Processor with clearly defined responsibilities, and to work only with a Personal Data Processor that has executed a contract/agreement/commitment on information security (including Personal Data) with NEWERA.
5. To coordinate with the Ministry of Public Security and other competent state authorities in protecting Personal Data, and to provide information to support the investigation and handling of violations of personal data protection law.
6. Other necessary measures appropriate to NEWERA's capabilities and current Applicable Law.

Article 13. Cookies

1. When a Data Subject uses or accesses NEWERA's websites, NEWERA may place one or more cookies on the Data Subject's device. NEWERA may use this information to recognize the Data Subject when they return to NEWERA's websites, to provide personalized services on NEWERA's websites, to compile analytics to better understand website activity, and to improve NEWERA's websites. A Data Subject may use their browser settings to delete or block cookies on their device, and has the right to anonymize or delete identifying records, even where the platform retains a history of behavior. However, if a Data Subject decides not to accept, or to block, cookies from NEWERA's websites, the Data Subject may not be able to take full advantage of all features of NEWERA's websites.
2. NEWERA may process a Data Subject's data through cookie technology in accordance with this Policy. NEWERA may also use retargeting measures to send advertisements to individuals whom NEWERA knows have previously visited its websites.
3. To the extent that third parties have placed content on NEWERA's websites (for example, social-media features), those third parties may collect a Data Subject's Data (for example, cookie data) if the Data Subject chooses to interact with that third-party content or use the third party's services.

Article 14. Requests By The Data Subject

1. Where a Data Subject (the “Requester”) has any request relating to personal data protection regulations or a Data Subject's rights (a “Request”), please contact NEWERA using the following methods:
   1. Contacting the office directly or sending notice by post to the following address:
      • Recipient: Customer Support Department — NEWERA INC Joint Stock Company
      • Contact address: 5th Floor, Lim Tower 3, 29A Nguyen Dinh Chieu, Sai Gon Ward, Ho Chi Minh City, Vietnam.
   2. Contacting via email: support@newera.inc
   3. Contacting via the online support channel: the Contact Support section on the NEXA Application.
2. Timeline for receiving and fulfilling a Request:

Note: The period for fulfilling a Request begins to run once the Requester's identity has been verified and a valid Request has been received (from a person entitled to make the request under Applicable Law).

The process for receiving and handling a Request follows the four (4) basic steps below:

Article 15. Implementation Provisions

1. This Policy is governed by the laws of the Socialist Republic of Vietnam. If any term, condition or part of this Policy is declared invalid or unenforceable by a competent state authority, such term or condition shall not invalidate the other terms and conditions of this Policy.
2. By registering for or using Products and Services, executing a contract/agreement, and/or providing Personal Data to NEWERA on any technology platform or channel and/or in any form, the Data Subject/Customer has read, clearly understood and accepted this Policy.
3. The Data Subject/Customer understands and agrees that, by accepting this Policy, the Data Subject/Customer has been fully notified and informed by NEWERA about NEWERA's Processing of Personal Data (including but not limited to notice of the types of Personal Data; the sensitive Personal Data that may be processed; the purposes and manner of Processing Personal Data; the organizations and individuals that Process Personal Data; the potential consequences and damage that may occur; and the rights and obligations of the Data Subject), and clearly understands and agrees with all of the content set out in this Policy. The Data Subject/Customer agrees that NEWERA is not required to provide further notice before Processing Personal Data, or when processing a request to withdraw the Data Subject's/Customer's consent.
4. Where either Party breaches an obligation set out in this Policy and thereby causes damage to the other Party, the breaching Party shall be liable to compensate the non-breaching Party in full for the actual and direct damage arising, in accordance with current Applicable Law.
5. Any dispute arising from or relating to this Policy shall first be resolved through negotiation. Where the Parties are unable to reach agreement through negotiation, either Party has the right to bring the dispute to a competent court for resolution. Costs relating to the resolution of the dispute shall be borne by the losing party in accordance with the effective judgment or decision of the court.
6. NEWERA may amend, update or replace this Policy where there is a change in law and/or in NEWERA's policy on risk management or information security, and/or in other circumstances that NEWERA considers necessary.
7. NEWERA will give Data Subjects/Customers advance notice of any amendment, update or replacement of this Policy, and NEWERA will publish such changes at https://newera.inc/ and/or on NEWERA's NEXA Application and/or notify them through such other means of communication as NEWERA considers appropriate. NEWERA recommends that a Data Subject regularly review this Policy to stay informed of any amendments, updates or replacements and of how NEWERA is protecting the Data Subject's Data.
8. Where there is a discrepancy between the personal-data-protection content of this Policy and any other policy or regulation published by NEWERA, the content of this Policy shall prevail.
9. This Personal Data Protection Policy is made in Vietnamese and shall be legally binding upon the relevant parties. Where this Personal Data Protection Policy is translated into any other language, such translation is for reference purposes only. If there is any discrepancy or inconsistency between the foreign-language translation and the Vietnamese version, the Vietnamese version shall prevail.
10. This Personal Data Protection Policy takes effect from the Effective Date.

NOTE:

This NEXA Personal Data Protection Policy is made in Vietnamese and shall be legally binding upon the relevant parties. In the event that this Personal Data Protection Policy is translated into any foreign language, such translation is for reference purposes only. In the event of any discrepancy or inconsistency between the foreign language translation and the Vietnamese version, the Vietnamese version shall prevail.