Personal Data Protection Policy Applicable to Online Visitors
Ricons Construction Investment Joint Stock Company (â€Áè¾±³¦´Ç²Ô²õâ€) is committed to protecting the personal data (“P¶Ùâ€) of users of our Website (specifically, the website ) (“W±ð²ú²õ¾±³Ù±ðâ€). This Personal Data Protection Policy (“P´Ç±ô¾±³¦²ââ€) describes how Ricons manages PD in accordance with the laws of Vietnam (“L²¹·Éâ€). We encourage you to read this Policy carefully before interacting with the Website so that you know and understand how we collect, use, and process your PD and the reasons for doing so.
I. Application of the Policy
- PD means personal data, which is digital data or information in other forms expressed as symbols, writing, numerals, images, sounds, or similar forms that identify or help identify a specific human being. PD includes Basic PD and Sensitive PD. PD, once de-identified, is no longer PD. PD, once encrypted, remains PD.
- For the purpose of collecting your PD as set out below, we will collect your PD in the manners mentioned in Section I.3 of this Policy. The collected PD may include:
- Basic PD (“Basic PDâ€) means PD reflecting personal identifiers and background commonly used in transactions and social relations, such as surname, middle name, and first name as recorded in the birth certificate, contact address, gender, phone number, etc.
- Sensitive PD (“Sensitive PDâ€) means PD associated with individual privacy which, if infringed, would directly affect the rights and legitimate interests of agencies, organizations, or individuals, such as IP address information, and/or individual location data identified through location services.
- By submitting information to or otherwise communicating with Ricons, and by explicitly agreeing through actions and/or taking affirmative steps on our Website or platforms as specifically instructed, you thereby indicate your agreement and consent for Ricons and our related companies, affiliates, and subsidiaries (hereinafter collectively and individually referred to as “A´Ú´Ú¾±±ô¾±²¹³Ù±ð²õâ€), as well as the respective representatives and/or trustees of these Affiliates (hereinafter collectively referred to as â€Áè¾±³¦´Ç²Ô²õâ€, “w±ðâ€, â€Îвõâ€, or ※Á³Ü°ùâ€) to collect, use, and process your PD in accordance with this Policy. â€Ô¨´Ç³Ü†or ′â´Ç³Ü°ù†refers to any individual governed by the Law and includes users of our Website such as employees of clients, investors, shareholders, suppliers, agents, existing and potential business partners, and/or potential job applicants. For the purposes of this Policy, “existing and potential clients†where ′â´Ç³Ü†are employed are referred to as “Corporate Clientsâ€.
- This Policy does not supersede any other consent you may have previously provided or provide separately to us regarding your PD, and your consent to this Policy is in addition to any other rights that Ricons already has under the Law.
- This Policy and your use of the Website shall be governed by the Law in all respects.
- From time to time, we may collect information about you from third-party sources and third-party data providers. We strictly strive to ensure that these third parties have sufficient legal and contractual grounds to disclose such information to us. Examples of information we may receive from other sources include demographic information, device information, location, and online behavioral data (such as information about usage of other websites, page view information, search results, and links). We use this information, independently or in combination with other information (including PD) collected by us, to enhance our ability to provide you with relevant content and marketing activities, as well as to develop and provide you with more suitable updates, news, promotions, features, and services.
II. Collection of PD and Consent
- PD may be collected from you in one or more of the following ways:
- when you visit our Website;
- when you enter requested information into contact forms on our Website;
- when you post feedback or interact with our customer service staff, for example: via chat boxes, emails, phone calls, or directly through our social media platforms (which may be recorded for training, quality control, business, and/or other legal purposes);
- when you request us to contact you, or add you to an email list or other mailing list;
- when you respond to our trade promotion programs, campaigns, or other initiatives or attend our events;
- when you participate in any contests, surveys, or promotions conducted by us and/or our business partners (including submitting photos);
- when you submit your PD to us for any other reason; and/or
- when we collect your PD by other lawful means.
- Unless permitted by Law, we will not collect, use, or process your PD without your consent. We only collect, use, and process PD for necessary purposes on a basis that is sufficient and appropriate to achieve such purposes, and only with your consent. To avoid confusion, unless required by Law or competent authorities, we will not collect or require you to provide us with your personal identification number or, if applicable, a copy of your citizen identification card.
- You warrant and represent to us that (a) the PD you disclose to us is accurate and complete; and (b) when you voluntarily provide another person’s PD to us, you are authorized by that person to disclose their PD to us and that such PD is accurate and complete.
- To provide any information to us or contact or interact with us via relevant sections on the Website, you must be 16 years of age or older. Access to and use of our Website by any person under 16 years of age is only permitted with the explicit consent of their legal representative. If we discover that for any reason and by any means, the PD of a child under 16 has been submitted to us without valid consent, we reserve the right to delete and/or remove such PD from our system without prior notice to the person who provided such PD. Furthermore, in such a case, we will not have any obligation to the data subject or the person who provided the PD.
- You are fully informed that we may collect and use your PD without your consent in cases permitted by Law.
- If you decide to give only partial consent, or conditional consent, for us to collect and process your PD, please follow the instructions provided on our Website or through the relevant communication channels with which you are interacting. If you need further assistance regarding this matter, you may send a request to the email address of our Data Protection Officer as provided in Section XII of this Policy. We will respond to you regarding how we will process and resolve your case. However, please note that to maintain internal operational efficiency, we reserve the right to decline to engage in communications with you if we do not receive your full consent to process PD.
III. Purposes for which We Collect, Use, and Disclose Your PD
- Your PD may be collected, used, and/or processed for the following purposes:
- to verify and process your personal information;
- to explore potential business opportunities and/or employment opportunities with you;
- to provide products and services to our Corporate Clients;
- to respond to and resolve inquiries, complaints, and other customer care issues or to contact you;
- to monitor or record phone calls and direct interactions with customers for quality assurance, employee training, performance evaluation, and identity verification purposes;
- to send you information, promotions, updates, and marketing and advertising materials related to our products and services and those of our Affiliates;
- to manage, develop, and improve our business operations to better serve our Corporate Clients;
- to conduct promotions, marketing campaigns, contests, and lucky draws for Corporate Clients;
- to perform market research and customer surveys;
- to conduct investigations or audits, or perform crime and fraud prevention activities, and manage risks;
- to comply with legal and regulatory requirements;
- to enforce our legal rights and obligations;
- to facilitate asset transactions (which may extend to any mergers, acquisitions, or asset sales);
- to ensure optimal display and operation of the Website on your device, including but not limited to identifying and resolving bugs affecting the Website’s inherent functions;
- for retargeting, including creating personalized advertising campaigns for users who have previously visited services on the Website, based on their prior consent for this purpose;
- for other purposes for which we have obtained your consent; and
- for any other purposes that are reasonably necessary, ancillary, or related to the specific purposes above.
- Your PD may be disclosed for the purposes mentioned above to our employees, third parties, affiliates, service providers, advisors, including but not limited to the following persons or entities:
- shareholders of Ricons;
- banks, credit card companies, and payment solution providers;
- debt collection agencies;
- credit information companies;
- transportation and delivery service providers;
- call center service providers;
- our business partners and authorized distributors, trustees, or agents;
- relevant government regulatory agencies, authorities, or law enforcement agencies;
- our insurers and advisors, including consultants, auditors, and lawyers;
- data storage and/or cloud computing service providers; and
- any other party to whom you authorize us to disclose your PD. Except for relevant authorities, government agencies, or law enforcement agencies, we will ensure that recipients of your PD (i) are bound by confidentiality obligations to us regarding the use, holding, processing, retention, and/or transfer of your PD; and (ii) have a need to know or process such PD.
- Similarly, we will only collect, use, and/or process your PD for marketing purposes when we have your consent to do so and only after you have been informed of the purposes for which we do so and the consequences of your consent.
- Your PD may be transferred, stored, and/or processed in a country or territory outside Vietnam for various purposes, including international customer support, service improvements, PD backups, storage, enhancing your experience with us, and achieving our legitimate business objectives.
- Accordingly, you acknowledge and agree that the transfer, storage, and/or processing of your PD outside Vietnam may be necessary for the purposes mentioned above and any other purposes described in this Policy, and you consent to any such transfer, storage, and/or processing of your PD outside Vietnam.
- Any transfer of your PD outside Vietnam will only be carried out with appropriate safeguards in place.
- If you wish to know more about any such transfers, please contact our Data Protection Officer using the contact information provided in Section XII of this Policy.
IV. Withdrawal of Consent and Access Rights
- You may withdraw your consent for our continued use and processing of your PD or obtain access to your PD (to a reasonable extent and as permitted by Law) at any time by writing to our Data Protection Officer using the contact details provided in Section XII below.
- When you withdraw your consent, you understand that we may not be able to interact or continue interacting with you or provide or continue providing certain products and/or services to the Corporate Client with which you are associated, and we may cease such provision without any liability. Please note that it may take up to 30 days for any withdrawal request to be reflected in our systems. Thereafter, we will stop collecting and processing your PD and will require relevant third parties, as mentioned in Section I.3 above, to also stop collecting and processing your PD.
- We reserve the right to charge a reasonable fee for processing your request, if permitted by Law.
V. Accuracy and Correction
- We will make reasonable efforts to ensure that your PD we use is accurate and complete for making any decisions affecting you.
- To help us maintain the accuracy of your PD, we encourage you to inform us of any changes to the PD you have provided to us by writing directly to our Data Protection Officer using the contact details provided in Section XII. Upon receiving your request to correct PD, we will promptly update or complete the necessary changes. If corrections cannot be made immediately, we will notify you within 72 hours of receiving your request.
VI. Protection, Policies, and Procedures
- We will make reasonable efforts to protect your PD that we possess or control from risks of unauthorized access, collection, use, disclosure, copying, modification, disposal, or destruction through reasonable and appropriate PD protection measures. We strive to ensure our systems are secure and meet appropriate standards. To prevent unauthorized access, maintain data integrity and security, and ensure accurate use of information, we have implemented appropriate physical and electronic management procedures to safeguard and secure the PD we collect, including but not limited to implementing industry-standard security measures combined with carefully developed security processes by our IT Department. You acknowledge that, regardless of the security measures we apply to protect your PD, no transmission of PD over the Internet is absolutely secure, and by providing your PD, you do so at your own risk.
- In the unfortunate event of a cybersecurity incident or violation related to Sensitive PD, we will proactively notify you to a reasonable extent to ensure transparency and help you protect your rights and legitimate interests. The content of the notice will include (i) the basic situation and potential impact on the rights and legitimate interests of the data subject, (ii) the remedial measures we have taken, are taking, and/or will take, and (iii) recommendations for you to proactively prevent and mitigate risks. We will provide notification through appropriate methods such as email, telephone, etc. In case individual notification is difficult, we will apply other reasonable measures to publish the information, including but not limited to posting an official notice on the Website. At the same time, we will also report to and coordinate with competent state management agencies in handling the incident in accordance with the Law.
- To fulfill our obligations under the Law, we may be required to conduct a PD protection impact assessment report regarding the collection and processing of your PD. This assessment report will be prepared in accordance with legal regulations and may need to be submitted to relevant competent authorities as required by Law. Our purpose is to ensure compliance with the legal framework and protect your privacy and PD in accordance with the Law.
VII. Retention and Deletion of PD
- We will retain your PD when retention is necessary or relevant to business purposes or as required by Law.
- You have the right to request the deletion or removal of your PD in accordance with the Law.
- We will carefully review the grounds regarding your request to delete PD and take appropriate steps, including technical measures, to address this request. Please note that we may not be able to immediately remove PD information from backup systems due to applicable legal restrictions and/or technical limitations. In this case, we will securely store your personal information and isolate such information from any further processing activities until the backup can be deleted or anonymized. However, we will do our best to ensure that the requested personal information is completely deleted within 72 hours of receiving your deletion request, unless we have the right to refuse to delete PD under circumstances prescribed by Law.
- We will cease retention and will delete or anonymize your PD after the purpose of collecting PD is fulfilled, or after we agree to your request to delete PD, unless we are compelled to retain your PD as required by Law in specific circumstances.
- Please note that if your PD is deleted for reasons such as the collection and processing of PD no longer being necessary for our business operations, or in the event Ricons is dissolved, goes bankrupt, or ceases business operations in accordance with the Law, this PD will be permanently deleted and cannot be retrieved after the deletion process is complete.
- However, the Law allows for exceptions to the deletion of your PD even if you request deletion. In these cases, we may retain this information for a period longer than the standard retention period, where permitted by Law, even if further processing of PD is not directly related to the original purpose of collection.
VIII. Other Rights Regarding Your PD
Among other rights you have regarding your PD, you have the following rights permitted by Law:
- To be provided with your PD. You have the right to request a copy of the PD about you that we hold. Please note that if you wish to obtain the PD we have collected from you and which is currently being processed, you need to contact our Data Protection Officer using the information provided in Section XII of this Policy, complete and sign the standard PD request form provided by us. Once you have filled out and signed this form, please send it to the email address of our Data Protection Officer. We will only provide you with the requested PD upon receipt of the request form that has been fully filled out and signed by you, to ensure that the provision of PD upon request complies with the provisions of the Law. If you have a disability and cannot complete the request form, please contact our Data Protection Officer using the contact information provided in Section XII of this Policy so that we can assist you in completing the request form.
- Restrict the continued collection and processing of your PD.
- Object to the disclosure of any of your PD to any third party, unless we already have your consent, or we are legally required to do so.
IX. Processing PD of Individuals Declared Dead, Missing, Lost or Restricted Civil Act Capacity, or Having Difficulty in Cognition or Behavior Control
In the event you are declared dead, missing, having lost or restricted civil act capacity, or having difficulty in cognition or behavior control by a competent authority in accordance with the Law, we understand the importance of protecting your PD. We understand the sensitive nature and privacy considerations surrounding such cases, and we are committed to maintaining the confidentiality of your information. Therefore, we will only continue to process your PD upon receiving written consent (i) from your spouse or children over 18 years of age, or from your parents if the aforementioned individuals do not exist, if you are declared dead or missing; and/or (ii) from your legal representative if you fall into the remaining legal statuses.
X. Cookies
- Similar to many other websites, Ricons and our service providers use cookies to collect information about visitors’ use of the Website. We collect information about activities on our Website, such as visitor IP addresses, browsing history, geolocation data, data on the number of visitors, the pages they visit, the duration of their visit, etc. This information is collected on an aggregated, anonymous basis and through the use of web server event logs and cookies. We may collect your PD through your IP address and when you enter your PD in the contact form on our Website.
- Cookies are small data sets stored automatically on the end user’s hard drive and are typically used to track preferences related to the subject matter of that website. If you enable these cookies, your web browser will store a text file (a part of the code) on your device. You can set your web browser to notify you of cookie placement requests or refuse to accept cookies by modifying options related to internet settings or computer system browsing preferences, but by doing so, you may not be able to use or activate certain functions available on our Website. For detailed information on the types of cookies we use and their purposes, you may refer to our Cookie Policy.
- By accessing and using our Website, products, and services, you consent to the storage of cookies, other local storage technologies, beacons, and other information on your device. You also consent to the access of such cookies, local storage technologies, beacons, and information by us or our representatives or trustees. If you wish to object, please follow the specific instructions provided on the Website or cookie notice.
XI. Third-Party Products and Links to Our Services
Our Website may link to third-party websites and services belonging to our partner network, advertisers, and Affiliates, and third-party websites and services outside our control. For example: we may allow you to share certain materials about our products and/or services with other parties through social networking services such as Facebook, Instagram, Youtube, and Linkedin. We are not responsible for the security or privacy of any information collected by other third-party websites or services. You should be cautious and review the privacy content applicable to the third-party websites and services you use. To the maximum extent permitted by Law, we are not responsible for the acts, omissions, PD protection policies of third parties, or their use of cookies, nor the content or security of any third-party websites, even if they are linked to our Website. Any such liability is hereby expressly disclaimed and excluded by us.
XII. Contact
We have appointed Data Protection Officer(s) to oversee compliance with the Law regarding PD protection. If you have any inquiries, requests, or feedback regarding your PD, please contact us at the following contact address:
Data Protection Officer
Ricons Construction Investment Joint Stock Company
96 Phan Dang Luu, Duc Nhuan Ward, Ho Chi Minh City, Vietnam
Full name: Mr. Tran Hoang Nguyen
Email: banbvdlcn@ricons.vn
XIII. Policy Updates
We reserve the right to amend or update this Policy from time to time. Subject to your rights under the Law, you agree to comply with the prevailing terms of this Policy as updated from time to time. The date stated at the end of this Policy indicates the last time this version was revised. We encourage you to check back frequently for the latest version of this Policy.
This Policy was last updated on December 30, 2025.