Personal Data Protection Policy

PERSONAL DATA PROTECTION POLICY

APPOTA JOINT STOCK COMPANY

Version: V01

Effective date: 01 January 2026

PART A. GENERAL POLICY FRAMEWORK

This Part sets out the principles, rights, obligations and procedures that apply uniformly to every Personal Data Subject ("PDS") whose data is controlled and processed by Appota Joint Stock Company (the "Company"). Content specific to each group of PDS (types of data, purposes, legal bases for processing, notification/consent mechanisms) is set out in the Appendices in Part B.

ARTICLE 1. SCOPE AND SUBJECTS OF APPLICATION

1.1. Subjects of application

1.1.1. This Policy applies to every individual whose personal data is collected, controlled and/or processed by the Company, including but not limited to the following groups (each group hereinafter referred to as a "PDS Group"):

(i) Individual customers, and individuals who are representatives/contact persons of organisational customers, using the Company's products and services (detailed in Appendix 1);

(ii) Employees, persons on probation, interns, and persons cooperating with the Company as collaborators (detailed in Appendix 2);

(iii) Candidates participating in the Company's recruitment processes (detailed in Appendix 3);

(iv) Individuals who are legal representatives, contact persons or personnel of partners, suppliers, contractors or other third parties that transact or cooperate with the Company (detailed in Appendix 4);

(v) Other individuals whose personal data arises in the course of the Company's operations (for example: visitors who contact or work at the Company's head office/offices), to whom the general principles in Part A and the most relevant content of the Appendices apply.

1.1.2. This Policy consists of two inseparable parts: (a) Part A — the General Policy Framework, which sets out the principles, rights, obligations and procedures that apply uniformly to all PDS Groups; and (b) Part B — the Appendices, which specify the types of data, purposes, legal bases for processing and notification/consent mechanisms specific to each PDS Group. In the event of any discrepancy between Part A and the content of the Appendix applicable to a particular PDS Group, the content of that Appendix shall prevail with respect to the corresponding PDS Group.

1.1.3. This Policy, once the PDS has been made aware of it and/or has accepted it through a form and notification channel appropriate to each PDS Group (as specified in the corresponding Appendix), constitutes the basis for the Company's control and processing of the PDS's personal data in the course of establishing and maintaining the relationship between the PDS and the Company.

1.1.4. Under this Policy, the Company is the Personal Data Controller and/or the Personal Data Processor, depending on the Company's role with respect to each type of data and each specific processing purpose.

1.2. Scope of application

1.2.1. All personal data of PDS that the Company collects, processes and stores in the course of its operations, including: providing products/services to customers; recruitment, human resources and labour management; cooperation with partners and suppliers; and other activities of the Company.

1.2.2. Personal data processing activities include: collection, analysis, aggregation; encryption, decryption; editing; erasure, destruction; de-identification; provision, disclosure, transfer; and other activities affecting personal data.

ARTICLE 2. INTERPRETATION OF TERMS

2.1. Personal data: means digital data or information in other forms that identifies or helps identify a specific individual, including basic personal data and sensitive personal data. Personal data that has been de-identified is no longer personal data.

2.2. Basic personal data: means personal data reflecting personal identity and background factors that are common and frequently used in transactions and social relationships, falling within the list issued by the Government (as specified in Article 3 of Decree No. 356/2025/ND-CP detailing a number of articles of, and measures for implementing, the Law on Personal Data Protection).

2.3. Sensitive personal data: means personal data closely associated with an individual's privacy which, when infringed, directly affects the lawful rights and interests of agencies, organisations and individuals, falling within the list issued by the Government (as specified in Article 4 of Decree No. 356/2025/ND-CP).

2.4. Personal data protection: means the use by agencies, organisations and individuals of forces, means and measures to prevent and combat activities that infringe personal data.

2.5. De-identification of personal data: means the process of altering or erasing information to create new data that cannot identify, or cannot help identify, a specific individual.

2.6. Processing of personal data: means activities affecting personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, editing, erasure, destruction, de-identification, provision, disclosure and transfer of personal data, and other activities affecting personal data.

2.7. Personal Data Recipient: means the Company and/or a party authorised by the Company for the purpose of carrying out personal data protection and processing activities in accordance with the law.

2.8. Personal Data Controller-Processor: means the Company, which both determines the purposes and means of, and directly carries out, the processing of personal data.

2.9. Personal Data Subject (PDS): means the individual reflected by the personal data, including the PDS Groups set out in Article 1.1.1 of this Policy.

2.10. Consent of the PDS: means the PDS's permission for the processing of his or her personal data, applicable to cases of data processing that require consent under the law; the specific legal bases for processing (consent, contract, legal obligation, legitimate interests, etc.) for each PDS Group are set out in the corresponding Appendix.

2.11. Third party: means an organisation or individual, other than the PDS, the personal data controller, the personal data controller-processor and the personal data processor, that participates in the processing of personal data in accordance with the law.

2.12. Company Platforms: means the websites, applications and information technology systems operated by the Company to provide services to customers, support recruitment, internal administration or interaction with partners.

2.13. Provisions of law: For the avoidance of doubt, content stated as "in accordance with the law", "in accordance with prevailing law" or "in accordance with the Company's regulations" shall be understood as the provisions in force from time to time. Such provisions may change due to changes in the law or separate decisions of the Company.

Specific definitions applicable to each PDS Group (if any, for example the definition of "Services" applicable to Customers) are set out in the corresponding Appendix.

ARTICLE 3. COMMITMENT TO PERSONAL DATA PROTECTION

3.1. This Policy explains the purposes and methods by which the Company controls and/or processes the personal data of PDS arising in the course of establishing and maintaining the relationship between the PDS and the Company, whether a customer, employment, recruitment or business cooperation relationship.

3.2. This Policy also guides PDS on how to exercise their rights relating to their personal data, as specified in the Company's Procedure for Handling PDS Requests (attached as Part C).

3.3. The Company undertakes to comply with the following principles in controlling and processing the personal data of PDS:

3.3.1. The personal data of PDS is controlled and processed lawfully, fairly, transparently and in accordance with applicable law;

3.3.2. The personal data of PDS is collected and processed on an appropriate legal basis — including the consent of the PDS, the performance of a contract (service contract, employment contract, business cooperation contract, etc.), the Company's legal obligations, or the Company's legitimate interests in accordance with the law — for specific, explicit and lawful purposes. The specific legal bases for processing for each PDS Group are set out in the corresponding Appendix. Where processing is based on consent, such consent is expressed separately for each different purpose and the data will not be processed beyond the purposes consented to or notified, unless otherwise provided by law;

3.3.3. The personal data of PDS is stored appropriately and to the extent necessary for the processing purposes, in accordance with applicable law;

3.3.4. The personal data of PDS is accurate and kept up to date; inaccurate data relating to the processing purposes will be erased or corrected promptly in accordance with applicable law;

3.3.5. The Company applies technical and organisational measures in accordance with the law to ensure an appropriate level of personal data security, including measures to protect against unauthorised or unlawful access and against accidental destruction, loss or damage.

3.4. The Company ensures, and takes responsibility for ensuring, that its partners (service providers, business partners, entities processing data on behalf of the Company, etc.) comply with personal data protection in accordance with the law.

3.5. The Company undertakes to comply with other principles on personal data protection provided by law, in particular the provisions relating to the rights of PDS and the obligations regarding the transfer of data abroad.

ARTICLE 4. TYPES OF BASIC PERSONAL DATA CONTROLLED AND PROCESSED

Depending on the PDS Group, the Company may collect and process one or more of the following types of basic personal data, in addition to the specific types of data set out in each Appendix:

4.1. Surname, middle name and given name at birth, and other names (if any);

4.2. Date of birth; date of death or disappearance;

4.3. Citizen identity card/identity card/people's identity card/passport number, gender, position;

4.4. Place of birth, place of birth registration, place of permanent/temporary residence, current place of residence, hometown, contact address;

4.5. Nationality;

4.6. Images of the individual;

4.7. Telephone number, personal identification number, driving licence number, vehicle licence plate number;

4.8. Information on the individual's digital accounts (email, identification account on the Company's systems).

The list of specific personal data for each PDS Group (for example: data on Customers' behaviour in using digital platforms; Employees' personnel records, salary and insurance; Candidates' application records; Partners' transaction information) is set out in the corresponding Appendix.

ARTICLE 5. PURPOSES OF CONTROLLING AND PROCESSING PERSONAL DATA

5.1. The specific purposes of controlling and processing personal data for each PDS Group are set out in detail in the Appendix applicable to that PDS Group (Appendix 1 for Customers, Appendix 2 for Employees, Appendix 3 for Recruitment Candidates, Appendix 4 for Partners/Suppliers).

5.2. Where the personal data of a PDS needs to be processed for a purpose other than those set out in the corresponding Appendix, the Company will notify the PDS so that the PDS may express his or her consent (if such processing requires consent under the law) before carrying it out.

ARTICLE 6. METHODS OF CONTROLLING AND PROCESSING PERSONAL DATA

6.1. Methods of collection

The Company may collect the personal data of PDS from the following sources, depending on the PDS Group:

6.1.1. Directly from the individual (for example: when registering to use services, submitting an application, signing an employment contract, or communicating on work matters as a partner's representative);

6.1.2. From the organisation of which the individual is a member, representative or contact person (organisational customers, partners, suppliers);

6.1.3. From brokers, intermediaries or third parties cooperating with the Company to provide products, services or personnel (for example: headhunters, human resources service providers);

6.1.4. From the Company's subsidiaries, affiliates, branches and dependent units, if the individual has had transactions or relationships with such entities;

6.1.5. Cookies, location services and IP addresses when the individual accesses and uses the Company Platforms (applicable to groups accessing the Company's online platforms — see Article 12);

6.1.6. From third parties such as insurance companies, financial institutions, competent authorities, or lawfully published sources of information;

6.1.7. From surveys, interviews and questionnaires when the individual participates in surveys, conferences, seminars or recruitment interviews;

6.1.8. From other lawfully public sources: telephone directories, media, professional social networks, referral profiles.

6.2. Methods of storage

6.2.1. Personal data is stored in Vietnam, in the Company's database systems or at locations where the Company or its branches, representative offices, subsidiaries, affiliates, partners or service providers have facilities.

6.2.2. The retention period for personal data is determined based on the purpose of use and in accordance with the law; the specific periods for each type of data/PDS Group are set out in Article 7 and the corresponding Appendices.

6.3. Methods of transfer/sharing of data

6.3.1. The Company does not sell personal data to any party and uses the necessary security measures to ensure that the transfer/sharing of personal data is secure.

6.3.2. If the recipient of personal data is headquartered outside the territory of Vietnam, when transferring personal data abroad, the Company requires the recipient to ensure the safety and security of the transferred data and to undertake to fully comply with Vietnamese law on the cross-border transfer of personal data.

6.4. Methods of analysis

Personal data is analysed based on the Company's internal procedures, data confidentiality principles and information security assurance for information technology systems.

6.5. Methods of encryption/de-identification

Collected personal data is encrypted/de-identified in accordance with appropriate standards during storage, transfer and processing to ensure that the data is protected at all times.

6.6. Methods of data erasure

In accordance with the law or upon a valid request from the PDS, the Company will erase the stored personal data, except in the following cases:

6.6.1. The law does not permit erasure of the data or mandatorily requires the data to be retained;

6.6.2. The personal data is processed by a competent state authority to serve the operations of state authorities in accordance with the law;

6.6.3. The personal data has been made public in accordance with the law;

6.6.4. The personal data is processed to serve legal requirements, scientific research or statistics in accordance with the law;

6.6.5. In a state of emergency concerning national defence, national security, social order and safety, major disasters or dangerous epidemics; where there is a risk of threats to security or national defence; in the prevention and combat of riots, terrorism, crime and violations of the law;

6.6.6. In response to an emergency threatening the life, health or safety of the PDS or another individual;

6.6.7. Data on payment cards issued by financial institutions: the Company does not store important payment card data (card number, cardholder name, CVV) on its systems; payment transactions are carried out on the systems of the relevant bank.

ARTICLE 7. PERSONAL DATA RETENTION PERIOD

7.1. Personal data is processed from the time the Company lawfully receives the personal data and has an appropriate legal basis for processing it in accordance with the law.

7.2. The processing of personal data ends when the PDS requests the Company to cease processing (in the case of processing based on consent and where permitted by law), when the Company no longer has any obligation relating to its relationship with the PDS (services, employment, cooperation, etc.), or at such other time as provided by law.

7.3. The Company stores personal data on its internal systems throughout the relationship with the PDS (provision of services, performance of the employment contract, business cooperation, etc.) or until the processing purposes have been fulfilled, the related legal obligations (accounting, tax, labour, insurance, etc.) have been fulfilled and disputes (if any) have been resolved, unless a longer retention period is required or permitted under prevailing law. The specific retention periods for each type of data/PDS Group are set out in the corresponding Appendix.

7.4. The personal data of PDS is stored, managed and kept confidential by the Company in accordance with the Company's internal regulations, applying reasonable measures to protect the data in accordance with this Policy and the law.

ARTICLE 8. ORGANISATIONS INVOLVED IN THE PROCESSING OF PERSONAL DATA

8.1. Organisations receiving personal data

The Company shares personal data within the Company and its subsidiaries, affiliates, branches, representative offices and dependent units, and with business partners providing services to the Company (including but not limited to: insurance companies, lawyers, banks, accountants, financial institutions, human resources/recruitment service providers, and telecommunications, computer, payment and printing service providers supporting the Company's operations) in order to achieve the purposes set out in the corresponding Appendix. If requested, the Company may also transfer personal data to competent state authorities.

8.2. Cross-border transfer of personal data

The Company may transfer the personal data of PDS abroad for processing and storage to serve the purposes set out in the corresponding Appendix. The Company's cross-border transfer of data must comply with Vietnamese law, including the requirements on the dossier for assessing the impact of transferring data abroad under Decree No. 356/2025/ND-CP.

ARTICLE 9. PROCESSING OF PERSONAL DATA IN CERTAIN SPECIAL CASES

The Company ensures that the processing of the personal data of PDS fully meets the requirements of the law in the following special cases:

9.1. Closed-circuit television (CCTV) footage at the Company's head office and offices may be used for the following purposes: (i) ensuring service quality; (ii) public security and occupational safety; (iii) detecting and preventing suspicious, inappropriate or unauthorised use of the Company's facilities, products, services and assets; (iv) detecting and preventing criminal acts; and/or (v) investigating and verifying incidents. This provision applies to every individual present in areas where cameras are installed, including Customers, Employees, Candidates attending interviews and visitors.

9.2. The Company respects and protects the personal data of children. Before processing the personal data of children, in addition to the protective measures provided by law, the Company will verify age and request the consent of: (i) the child; and/or (ii) the child's father, mother or guardian in accordance with the law.

9.3. For the processing of personal data relating to persons declared missing or deceased persons, in addition to complying with other relevant provisions of law, the Company will require the consent of one of the related persons in accordance with prevailing law.

ARTICLE 10. RIGHTS AND OBLIGATIONS OF PDS REGARDING PERSONAL DATA

10.1. Rights of PDS

10.1.1. Right to be informed and right to consent

(i) Through this Policy, PDS are informed of the Company's personal data processing activities and, in cases where processing requires consent under the law, may express their consent through the mechanism appropriate to each PDS Group as set out in the corresponding Appendix.

(ii) The Company maintains this Policy so that PDS clearly understand it and, where consent is required, give their consent voluntarily before the Company collects and processes personal data.

(iii) The consent of the PDS (where required) is expressed in a clear and specific manner that can be printed or reproduced in writing, including in electronic or verifiable format.

(iv) PDS have the right to give conditional consent, partial or full consent, or to withdraw consent (in cases where processing is based on consent). Partial consent or withdrawal of consent may affect the Company's ability to fully maintain its relationship with the PDS (provision of services, performance of the employment contract, business cooperation, etc.); the specific consequences for each PDS Group are set out in the corresponding Appendix. The Company may still continue to process personal data to the extent required or in accordance with prevailing law.

10.1.2. Right to access, rectify or request rectification of personal data

PDS have the right to access, rectify or request rectification at any time when they find that information relating to them is inaccurate or incomplete.

10.1.3. Right to request the provision, erasure or restriction of processing of personal data; right to object to the processing of personal data

(i) PDS have the right to request the erasure of their personal data stored by the Company in the cases provided by applicable law, for example when the data is no longer necessary for the original purposes of collection and processing, or the data has been processed unlawfully.

(ii) PDS have the right to request the Company to restrict the processing of their personal data without erasing the relevant data, based on the conditions provided by applicable law.

(iii) PDS have the right to object at any time to the Company's processing of their personal data for direct marketing purposes.

10.1.4. Right to withdraw consent

(i) In cases where the processing of the personal data of a PDS is carried out on the basis of the PDS's prior consent, the PDS has the right to withdraw consent at any time by sending a written notice to the Company, unless otherwise provided by law. The withdrawal of consent does not affect the lawfulness of processing carried out previously on the basis of the consent given.

(ii) The withdrawal of consent may affect the Company's ability to fully maintain its relationship with the PDS (for example: provision of services, performance of a contract) if the data for which consent is withdrawn directly affects such matters; the specific extent of the impact for each PDS Group is set out in the corresponding Appendix.

10.1.5. Right to complain, denounce, initiate lawsuits and claim compensation for damage in accordance with the law

PDS have the right to lodge a complaint if the Company commits a violation of the regulations on personal data protection, unless otherwise agreed by the parties or otherwise provided by law.

PDS may exercise their rights through the Procedure for Handling PDS Requests (Part C of this Policy). PDS understand and agree that the exercise of the above rights is not intended to cause damage to or affect the operations and lawful interests of the Company. Where a PDS withdraws consent, requests erasure of data or exercises other related rights, this may: (i) affect the validity and performance of the legal relationship between the PDS and the Company; (ii) cause the products, services or scope of cooperation between the Company and the PDS to be limited, restricted, suspended or cancelled, as the case may be. The Company will continue to process the personal data of the PDS within the remaining scope requested (if any) or in accordance with the law.

10.2. Obligations of PDS regarding their own personal data

10.2.1. To protect their own personal data; to request other relevant organisations and individuals to protect their personal data.

10.2.2. To respect and protect the personal data of others.

10.2.3. To implement and comply with the law on personal data protection and this Policy, and to participate in preventing and combating violations of the regulations on personal data protection.

10.2.4. To provide complete, truthful and accurate personal data and other information as requested by the Company when establishing and maintaining a relationship with the Company (registering to use services, signing an employment contract, submitting an application, business cooperation, etc.) and when such information changes. The Company is not responsible if inaccurate information provided by the PDS affects or limits the PDS's rights and interests.

10.2.5. To be responsible for the information, data and approvals that they create and provide in the online environment; to be responsible in cases where their personal data is leaked or infringed due to their own fault.

10.2.6. Where the PDS is an organisation (or an individual providing data of other persons under his or her management) and provides the personal data of related individuals to the Company, the PDS must ensure that it has obtained the lawful consent of such individuals to the provision of the data.

10.2.7. To regularly monitor the Company's official notification channels (website, email, or the corresponding internal channels) in order to keep up to date with and comply with changes (if any) relating to this Policy.

10.2.8. To promptly contact and notify the Company when there is a change in their personal data or when they discover or suspect that their personal data has been exposed in a way that may lead to risk. The PDS is responsible for any delay in such notification.

10.2.9. To cooperate with the Company, competent state authorities or third parties when issues arise that affect their personal data.

10.2.10. Other obligations in accordance with the law.

ARTICLE 11. UNDESIRED CONSEQUENCES AND DAMAGE THAT MAY OCCUR

11.1. The Company always values privacy and endeavours to keep confidential and ensure the security of the personal data of PDS, complying with the law on personal data protection in order to minimise or eliminate undesired consequences and damage that may occur when personal data is leaked. However, beyond the Company's best efforts, security cannot be absolutely guaranteed against all threats.

11.2. PDS understand that providing personal data to the Company in the course of establishing and maintaining a relationship with the Company always carries a risk of leakage or of data being processed inappropriately or untimely, arising from causes including but not limited to: (i) hardware or software errors during data processing; (ii) security vulnerabilities beyond the Company's control, or attacks on the system by third parties; (iii) the PDS exposing his or her own personal data through carelessness, being defrauded, or accessing websites/applications containing malware.

11.3. The Company recommends that PDS keep confidential information relating to login passwords and OTP codes and not share such information with anyone.

11.4. PDS should safeguard their electronic devices and lock/log out of their accounts on the Company's websites or applications when not in use.

11.5. Where a data storage server is attacked by a third party, resulting in the loss of the personal data of PDS, the Company is responsible for reporting the incident to the competent authorities for timely investigation and handling, and for notifying the PDS.

11.6. To the best of its ability, the Company limits access to the personal data of PDS to those who need to know; all individuals with access to the data are required to maintain the confidentiality of such information.

ARTICLE 12. USE OF COOKIES AND SIMILAR TECHNOLOGIES

12.1. This Article applies to PDS when accessing and using the Company's websites, applications and online platforms — including Customers when using services, Candidates when submitting applications online, Partners/Suppliers when accessing the web portal, and Employees when using internal systems on the Company's web/application platforms.

12.2. The Company may use "Cookies" or similar technologies to collect or share information in order to improve its websites and existing products and/or develop new services and features. "Cookies" are small data files sent to the PDS's computer or mobile device that allow the Company to recognise the device, how products/websites are used and the number of visitors, and to track the PDS's activities on the Company Platforms.

12.3. The Company may link information collected from cookies with the personal data of PDS for purposes such as maintaining sessions/shopping carts, providing personalised content and monitoring product usage.

12.4. PDS have the right to refuse or disable the use of cookies by adjusting the appropriate settings in their browser. The Company notes that doing so may prevent the PDS from making full use of the functions of the Company's websites or products.

ARTICLE 13. PROCESSING OF PERSONAL DATA WITHOUT THE CONSENT OF THE PDS

Clause 1, Article 19 of the Law on Personal Data Protection 2025 provides for cases in which personal data is processed without the consent of the PDS, including:

13.1. To protect the life, health, honour, dignity, rights and lawful interests of the PDS or other persons in urgent circumstances; to protect, as necessary, one's own legitimate rights or interests, those of others, or the interests of the State or of agencies and organisations against acts infringing such interests. The personal data controller, personal data processor, personal data controller-processor and third party bear the burden of proving this case;

13.2. To deal with a state of emergency; a risk of threats to national security that has not yet reached the level of declaring a state of emergency; to prevent and combat riots, terrorism, crime and violations of the law;

13.3. To serve the operations of state agencies and state management activities in accordance with the law;

13.4. To perform an agreement between the PDS and relevant agencies, organisations or individuals in accordance with the law;

13.5. Other cases as provided by law.

ARTICLE 14. MONITORING COMPLIANCE WITH THE POLICY

14.1. Through this Policy and its internal control system, the Company monitors personal data protection and compliance with the Law on Personal Data Protection, and urges and reminds its officers, employees and relevant departments to properly implement the provisions of the Policy.

14.2. The Company applies reward policies for compliance, as well as specific sanctions to limit/eliminate violations of the regulations on personal data protection.

ARTICLE 15. GENERAL PROVISIONS

15.1. This Policy takes effect from 01 January 2026, has been approved by the Company's Board of Management and is kept at the Company's head office. This Policy may be amended from time to time and will be notified to each PDS Group through the appropriate channel (website/application for Customers; internal notices/company email for Employees; notice at the time of application for Candidates; written notice/email for Partners). The effectiveness of, and the mechanism for expressing acceptance of, amendments and supplements for each PDS Group are specified in the corresponding Appendix.

15.2. This Policy shall be interpreted and governed by the laws of Vietnam.

15.3. This Policy is issued in good faith by the Company, represents the entirety of the Company's personal data protection policy and supersedes all prior understandings or policies, whether written, oral or in any other form, relating to the matters addressed in this Policy.

15.4. For the purpose of protecting personal data in accordance with the law, this Policy also applies to contracts, agreements, documents, etc. between the Company and the PDS (or the organisation of which the PDS is a representative/member) signed before, during and after the effective date of this Policy. This Policy is an attached and inseparable part of the commitments and agreements between the parties.

15.5. If any provision of this Policy is held invalid by a competent authority, that provision shall automatically become invalid and shall no longer bind the parties; such ruling shall not invalidate the remaining provisions, which shall remain in full force and effect.

15.6. This Policy is publicly posted by the Company on its website and/or notified through the appropriate internal channels so that the relevant parties are informed.

15.7. If a dispute arises from or in connection with the processing of personal data, the PDS and the Company shall first attempt to resolve it through negotiation. If negotiation fails, either party has the right to refer the dispute to a competent Court in Vietnam (or to a competent labour dispute resolution body, for disputes arising from employment relationships) for resolution.

ARTICLE 16. CONTACT INFORMATION FOR PERSONAL DATA PROCESSING

If the PDS has any queries or questions relating to this Policy or to matters concerning the rights of the PDS or the processing of his or her personal data, please contact:

✓ Online by email: legal@appota.com

✓ Hotline: (+84) 2435 191 618

✓ In person at the Company:

— Head office: Số 05 Trần Bình Trọng, phường Quy Nhơn, tỉnh Gia Lai, Vietnam.

— Hanoi office: Số 16-18 ngõ 71 Láng Hạ, phường Ô Chợ Dừa, thành phố Hà Nội, Vietnam.

The specific procedures are set out in the Procedure for Handling Personal Data Subject Requests attached to this Policy (Part C).

PART B. APPENDICES BY GROUP OF PERSONAL DATA SUBJECTS

The Appendices below specify the subjects, types of data, purposes, legal bases for processing and notification/consent mechanisms applicable specifically to each PDS Group, supplementing and detailing the General Policy Framework in Part A. In the event of any conflict between Part A and the Appendix applicable to a PDS Group, the content of that Appendix shall prevail for the corresponding PDS Group.

APPENDIX 1. CUSTOMERS

1. Subjects of application: Individual customers, and individuals who are representatives/contact persons of organisational customers, using the products and services provided by the Company ("Customers").

2. Additional definition — "Services": means the services provided by the Company to Customers to support organisational Customers in their operations and internal administration through the websites, applications and other related services provided by the Company.

3. Types of personal data

In addition to the basic personal data set out in Article 4 of Part A, for Customers the Company may also collect and process the following types of data:

3.1. Data arising when Customers access and/or use the Company Platforms

3.1.1. Image, audio and video data arising in the course of Customers' use of camera services with data storage functions provided by the Company;

3.1.2. Personal images, including images provided when registering to use services and images uploaded by Customers to the Company's applications/websites in the course of using services;

3.1.3. Data uploaded, stored or created by Customers on the cloud computing systems and service platforms provided by the Company;

3.1.4. Digital account information; data reflecting activities and activity history in cyberspace;

3.1.5. Data on telecommunications consumption behaviour: calls, messages, data, value-added services (VAS);

3.1.6. Data provided by Customers when registering to use services and data arising in the course of Customers' use of the Company's services.

3.2. Data on the history and content of communications between Customers and the Company

3.2.1. Communications between the Company and Customers;

3.2.2. Call information, messages and call recording data arising in the course of Customers' use of the Company's voice, messaging and call centre services.

4. Purposes of controlling and processing personal data

Customers agree to allow the Company to process their personal data for one or more of the following purposes:

Where Customers' personal data needs to be processed for other purposes or at the request of Customers, the Company will notify Customers so that they may express their consent before it is carried out.

5. Legal bases for processing and mechanism for expressing consent

5.1. The principal legal basis for processing is the consent of Customers, combined with the performance of the service contract and legal obligations (for the purposes in Sections II and III of the table above).

5.2. A Customer's acceptance to use the services and acceptance of the terms and conditions for using the Company's services constitutes the Customer's consent, allowing the Company to collect and process personal data in accordance with this Policy.

5.3. Where a customer that is an organisation or enterprise agrees to use the services and accepts the Company's terms and conditions of service, the Company understands that such organisation provides the Company with its approval for the use of the related personal data and warrants that it has obtained the consent of the related individuals, and releases the Company from liability relating to obtaining such consent.

5.4. Partial consent or withdrawal of consent by a Customer may prevent the Company from providing the services fully and at the required quality, or may require the Company to limit, restrict, suspend or cancel part or all of the services, as the case may be; this may result in costs and damage to be borne by the Customer and/or third parties.

6. Retention period

In accordance with Article 7 of Part A; for data serving accounting, tax and anti-money laundering obligations, the retention period is as prescribed by the corresponding specialised laws, including after the Customer ceases to use the services.

APPENDIX 2. EMPLOYEES

1. Subjects of application: persons who have an employment relationship with the Company (including probation and apprenticeship), interns and collaborators ("Employees").

2. Types of personal data

In addition to the basic personal data set out in Article 4 of Part A, for Employees the Company may also collect and process:

2.1. Curriculum vitae, professional qualifications, degrees and work history;

2.2. Employment contract information, job title, job position and department;

2.3. Salary, bonus and benefits information; information on the bank account for receiving salary;

2.4. Social insurance, health insurance and unemployment insurance information; personal income tax code;

2.5. Timekeeping data and times of entry/exit at the workplace;

2.6. Job performance evaluation results and labour discipline (if any);

2.7. Health information for periodic health check-ups and pre-employment health check-ups in accordance with labour law (sensitive personal data);

2.8. Images and security camera data at the workplace;

2.9. Emergency contact information (full name and telephone number of relatives) voluntarily provided by the Employee.

2.10 Information on staff competency assessments

3. Purposes of processing

3.1. Entering into, performing and managing employment contracts and personnel records;

3.2. Calculating and paying salaries, bonuses and benefits; managing timekeeping;

3.3. Fulfilling obligations relating to social insurance, health insurance, unemployment insurance and personal income tax under the Labour Code, the Law on Social Insurance, the Law on Personal Income Tax and guiding documents;

3.4. Job performance evaluation, training, succession planning and personnel development;

3.5. Ensuring security and occupational safety at the workplace;

3.6. Resolving internal complaints and labour disputes;

3.7. Fulfilling reporting and explanation obligations to competent state authorities (labour authorities, social insurance authorities, tax authorities) in accordance with the law.

4. Legal bases for processing

4.1. The processing of Employees' personal data is principally based on: (i) the performance of the employment contract; and (ii) the Company's legal obligations under the Labour Code, the Law on Social Insurance, the Law on Personal Income Tax and related legal documents.

4.2. For sensitive personal data (for example: health information) or processing purposes beyond the scope of performing the employment contract/legal obligations (for example: using Employees' images for the Company's communications and promotional purposes), the Company will notify Employees and obtain their specific, separate and voluntary consent before processing.

4.3. An Employee's refusal to provide personal data necessary for the performance of the employment contract or related legal obligations may affect the Company's ability to perform its obligations under the employment contract or the corresponding legal obligations.

5. Notification mechanism

The Company notifies Employees of this Policy (including this Appendix) when signing the employment contract or at the time the Policy is issued/amended, by written notice, company email or the internal human resources management system. Employees confirm that they have read and understood the Policy as part of their personnel records.

6. Retention period

Throughout the existence of the employment relationship and, after termination of the employment contract, for the retention periods for labour, payroll, social insurance, accounting and tax records prescribed by the corresponding specialised laws.

APPENDIX 3. RECRUITMENT CANDIDATES

1. Subjects of application: individuals who submit applications to and participate in the Company's recruitment processes, whether successful or unsuccessful ("Candidates").

2. Types of personal data

2.1. Basic personal identity information and portrait photographs;

2.2. Educational level, degrees and certificates; work experience; job application/CV;

2.3. Contact information (telephone number, email, address);

2.4. Interview results, competency tests and recruitment evaluations;

2.5. Reference information (reference check) from previous workplaces, if the Candidate provides it or consents to the Company verifying it.

2.6. Audio and video recording data of the interview process, where the Candidate has been notified of and consents to the Company's audio and video recording.

3. Purposes of processing

3.1. Screening and evaluating applications;

3.2. Organising interviews and competency tests;

3.3. Making recruitment decisions and contacting Candidates to notify them of the results;

3.4. Retaining the records of potential Candidates for consideration for other vacancies in the future, if the Candidate gives separate consent for this purpose.

3.5. Supporting interviewers/managers in evaluating Candidates' competencies based on interview audio and video recording data (Section 2.6); where the Company applies automated data analysis tools or software (including artificial intelligence - AI) to add a layer of evaluation based on audio and video recording data, the Company will specifically notify Candidates of this and obtain their specific and separate consent before deployment, in accordance with Section 4 below.

4. Legal bases for processing

The processing of Candidates' personal data is based on the consent of the Candidate when actively submitting an application, as expressed by sending the application, attending an interview or confirming on the Company's recruitment form/platform. Retention of the application for subsequent recruitment rounds (Section 3.4) requires the specific and separate consent of the Candidate. In particular, for the audio and video recording of interviews (Section 2.6) and the processing of audio and video recording data using automated tools or software/artificial intelligence (AI) to support evaluation (Section 3.5), the Company obtains the Candidate's consent in a clear form that can be verified and traced (for example: confirmation on the recruitment form/platform, in writing, or a stored record of oral confirmation of consent). A Candidate's refusal to consent to audio and video recording or to processing using automated tools/AI does not affect the Candidate's right to have his or her application considered through the Company's other evaluation methods.

5. Retention period

For the duration of the recruitment process for the position to which the Candidate applied. If the Candidate is unsuccessful, the application will be erased/destroyed within 12 months from the end of the recruitment process for that position, unless the Candidate gives specific and separate consent for the Company to continue retaining the application as a Potential Candidate Record under Section 3.4. Potential Candidate Records are retained by the Company until the Candidate withdraws consent or requests erasure of the record in accordance with the Procedure for Handling Personal Data Subject Requests.

6. Rights of Candidates

Candidates have the right to withdraw consent and to request to access, rectify or erase their application at any time in accordance with the Procedure for Handling PDS Requests attached to this Policy (Part C). The withdrawal of consent does not affect the lawfulness of processing previously carried out, but may prevent the Company from continuing to consider the Candidate's application for the vacancy being recruited.

7. Processing of data by automated means, including artificial intelligence (AI)

7.1. Where the Company uses automated tools or software (including AI) to support the analysis and evaluation of the Candidate's interview audio and video recording data under Section 3.5, the results from the automated tools/AI are for reference and support only; the final recruitment decision concerning the Candidate is made by humans (the interviewer, manager or competent recruitment department) and is not based solely on the results of automated processing.

7.2. Candidates have the right to be informed that their audio and video recording data is processed by automated tools/AI, and have the right to request the Company to conduct a human review or to object to such processing in accordance with the Procedure for Handling Personal Data Subject Requests (Part C).

APPENDIX 4. PARTNERS AND SUPPLIERS

1. Subjects of application: individuals who are legal representatives, contact persons or personnel of the Company's business partners, suppliers and contractors ("Partners").

2. Types of personal data

2.1. Full name, position and employer;

2.2. Contact information: email, telephone number;

2.3. Information appearing on contracts, invoices and transaction documents with the Company (signatures, information on signing representatives).

3. Purposes of processing

3.1. Entering into and performing business cooperation, procurement and service supply contracts;

3.2. Contacting and communicating on work matters in the course of cooperation;

3.3. Payment and reconciliation of receivables and payables;

3.4. Compliance with accounting, tax and reporting obligations in accordance with the law.

4. Legal bases for processing

The processing of Partners' personal data is based on: (i) the performance of the business cooperation contract between the Company and the organisation of which the Partner is a representative/contact person; (ii) the Company's legitimate interests in maintaining business cooperation relationships; and (iii) legal obligations (accounting, tax). The partner/supplier organisation is responsible for notifying and, where required by law, obtaining the consent of the representative/contact individual regarding the provision of data to the Company.

5. Retention period

For the duration of the business cooperation between the Company and the partner/supplier organisation, and thereafter for the retention periods for vouchers, contracts and accounting records prescribed by law.

PART C. PROCEDURE FOR HANDLING PERSONAL DATA SUBJECT REQUESTS

This Procedure applies uniformly to all PDS Groups set out in Article 1.1.1 of Part A of the Policy (Customers, Employees, Candidates, Partners/Suppliers).

1. Purpose

This Procedure sets out the sequence, responsibilities and time limits for handling requests of Personal Data Subjects ("PDS") in order to ensure that Appota Joint Stock Company ("Appota" or the "Company") fully complies with the Law on Personal Data Protection 2025 and related provisions of law.

This Procedure is an inseparable part of Appota's Personal Data Protection Policy and of the contractual terms and agreements governing the relationship between Appota and the PDS (service contracts, employment contracts, business cooperation contracts, etc.).

2. Scope of application

PDS have the right to request the Company to give effect to the following rights with respect to their personal data ("PD") in accordance with prevailing law, including:

2.1. Right to withdraw consent to processing

PDS have the right to withdraw their consent at any time, except where the PD is processed without the need for consent or where otherwise provided by law. PDS should consider the possible consequences (set out in the Appendix applicable to their PDS Group) before exercising this right.

2.2. Right to access, rectify or request rectification of PD

PDS have the right of access to view, rectify or request the Company to rectify the PD that the Company is processing, unless otherwise provided by law.

2.3. Right to request the provision of data

PDS have the right to request the Company to provide their PD that the Company is processing, unless otherwise provided by law.

2.4. Right to request erasure or restriction of processing of PD; right to object to the processing of PD

2.4.1. PDS have the right to request the Company to restrict the processing of certain PD, or to carry out only certain processing activities, or to limit the period of processing of PD consistent with the purposes previously consented to/notified, unless otherwise provided by law.

2.4.2. PDS have the right to erase or request the Company to erase their PD that the Company is processing, unless otherwise provided by law.

2.4.3. PDS have the right to object to the Company's processing of their PD in order to prevent or restrict the disclosure of PD, or the use of PD for advertising and marketing purposes, unless otherwise provided by law.

3. Procedures and process for handling PDS requests

3.1. Receipt of PDS requests

3.1.1. Receiving channels

The Company receives requests from PDS through the following channels:

✓ Online by email: legal@appota.com. Hotline: (+84) 2435 191 618

✓ In person at the Company: Head office — Số 05 Trần Bình Trọng, phường Quy Nhơn, tỉnh Gia Lai, Vietnam; Hanoi office — Số 16-18 ngõ 71 Láng Hạ, phường Ô Chợ Dừa, thành phố Hà Nội, Vietnam.

✓ For Employees: requests may also be submitted through the internal channel (the Administration and Human Resources department) in addition to the above channels.

✓ Request form: as specified in the Appendix attached to this Procedure.

3.1.2. Confirmation of requests

Upon receipt of a request, the Company's Administration and Human Resources department (the Admin focal point) shall prepare a PDS Request Receipt Form and send it to the Company's Personal Data Protection Department ("DPO") within 24 hours of receiving the request. The DPO will confirm the request and respond to the PDS to verify the necessary information within the time limits set out in Section 3.1.3.

3.1.3. Response to requests

Where the processing time needs to be extended, depending on the nature and complexity of the request, the Company will notify the PDS by email of the appropriate extension of the processing time limit. The PDS must clearly state the reasons for the extension and is responsible for proving that the extension is necessary and reasonable.

PDS understand and agree that: (i) the Company will only fulfil a PDS's request within a time frame consistent with the law where the request is lawful, complete and valid, and the PDS pays any processing costs incurred (if any); and (ii) fulfilment is subject to the Company's right to invoke any exemptions and/or exceptions provided by law.

3.1.4. Notification and completion

The Company will send a written notice by email or by post to the PDS's address (if specifically requested), including: (i) the result of the processing (successful/unsuccessful); (ii) the reasons (if the request is refused in part or in full, together with guidance on lodging a complaint); (iii) the provision of data (in the case of an access request).

4. Notes on exercising the rights of PDS

4.1. General notes

4.1.1. The Company has the right to refuse to fulfil a PDS's request in certain cases, including but not limited to: (i) the PDS does not follow the sequence and procedures guided by the Company, or the request lacks information or is invalid; (ii) the PDS does not provide, or provides incomplete, papers and documents to verify his or her identity; (iii) the Company assesses that there are signs of fraud or violations of personal data protection; or (iv) the law does not permit fulfilment of the PDS's request.

4.1.2. Upon receiving a request from a PDS to exercise rights relating to PD, the Company will notify the PDS of the possible consequences of fulfilling the request. For security purposes, the PDS may need to make the request in writing or by other methods to prove and authenticate his or her identity. The Company may require the PDS to verify his or her identity before processing the request.

4.1.3. The Company will respond to the PDS's request within the time limit prescribed by law after receiving complete information on the request. If it cannot do so within the above time limit, the Company will promptly notify the PDS.

4.1.4. If the PDS has grounds to believe that the processing of his or her PD violates the law on PD protection, the PDS has the right to lodge a complaint, a denunciation or a lawsuit with the competent state authorities, or to claim compensation for damage in accordance with the law.

4.2. Specific notes on the right to erasure of data

4.2.1. Unless otherwise provided by law, PDS only have the right to erase or request the erasure of their PD that the Company is processing in the following cases: (i) the processing of the PD is no longer necessary for the purposes of collection to which the PDS consented; (ii) the PDS wishes to withdraw his or her consent to the Company's processing of PD; (iii) the PDS objects to the processing of the data because there is no longer a legitimate reason to continue processing; (iv) the PD is processed for purposes other than those previously consented to/notified or in violation of the law; (v) the PD must be erased in accordance with the law.

4.2.2. The Company has the right to refuse a request for erasure of PD if the PDS does not provide complete information and documents to verify his or her identity, or the reason for the erasure request does not fall within the cases set out above, or the PD may not be erased in accordance with the law, including where: (i) the law does not permit erasure of the data; (ii) the PD is processed by a competent state authority to serve the operations of state authorities in accordance with the law; (iii) the PD has been made public in accordance with the law; (iv) the PD is processed to serve legal requirements, scientific research or statistics in accordance with the law; (v) in a state of emergency concerning national defence, national security, social order and safety, natural disasters or dangerous epidemics; where there is a risk of threats to security or national defence; in the prevention and combat of riots, terrorism, crime and violations of the law; (vi) it is necessary to respond to an emergency threatening the life, health or safety of the PDS himself or herself or of another individual.

4.3. PDS may request the Company to give effect simultaneously to the rights that the law grants to PDS.

APPENDIX

(Re: Request Form for Exercising the Rights of a Personal Data Subject)

Socialist Republic of Vietnam

Independence - Freedom – Happiness

-----------------------------

REQUEST FORM FOR EXERCISING THE RIGHTS OF A PERSONAL DATA SUBJECT

A. INFORMATION ON THE INDIVIDUAL REQUESTING THE EXERCISE OF THE RIGHTS OF A PERSONAL DATA SUBJECT

1. Requester information

☐ I am the Personal Data Subject ☐ I am the representative/guardian of the Personal Data Subject

2. Personal Data Subject information (not to be completed if the Requester is the Personal Data Subject)

B. REQUEST TO EXERCISE THE RIGHTS OF THE PERSONAL DATA SUBJECT

As the Personal Data Subject (or the representative/ guardian of the Personal Data Subject), I request the exercise of the rights of the Personal Data Subject as follows:

NOTES

• Requests to exercise the rights of a Personal Data Subject are free of charge.

• Requests will be fulfilled within the time limits set out in the Procedure for Handling Personal Data Subject Requests after a valid request is received from the Personal Data Subject, unless otherwise agreed.

• By submitting the request and signing below, the Personal Data Subject confirms that the information provided in this Request Form is accurate, and the Personal Data Subject agrees that the Company may begin processing the request to exercise rights in accordance with the law, the Company's internal regulations and the Personal Data Protection Policy. In this case, the Personal Data Subject accepts all consequences and damage set out in the Company's Personal Data Protection Policy as publicly posted on the Company's website

..........., date ........., month......., year.........

Confirmed by the Applicant

(Signature and full name)