This Personal Data Protection Policy (the “Policy”) is issued by Phat Dat Real Estate Development Corporation (“PDR”) to protect and safeguard Data Subjects’ rights in relation to their personal data in accordance with the Law on Personal Data Protection No. 91/2025/QH15 dated June 26, 2025, Decree No. 356/2025/ND-CP dated December 31, 2025 detailing certain articles of and measures for the implementation of the Law on Personal Data Protection, and any amendments, supplements and implementing/guiding documents issued from time to time (the “Personal Data Protection Law”). In processing Data Subjects’ Personal Data, PDR undertakes to comply with the Personal Data Protection Law and this Policy.

This Policy applies to individuals to whom the personal data relates and whose personal data is processed by PDR, including but not limited to all customers, partners, contractors, suppliers, applicants, collaborators, employees, shareholders and other individuals whose personal data is processed by PDR (the “Data Subjects” or “You”).

This Policy does not replace or restrict any rights granted to Data Subjects by law.

Personal Data Controller and/or Personal Data Controller and Processor:

• Organization name: Phat Dat Real Estate Development Corporation
• Enterprise registration number: 0303493756
• Head office: Phat Dat Building, No. 39 Pham Ngoc Thach Street, Xuan Hoa Ward, Ho Chi Minh City
• Contact information:
  Email: info@phatdat.com.vn
  Telephone: 1900 998888 or (028) 8889 8686

PDR’s subsidiaries, affiliated companies, companies within its group-company structure, branches and other related entities (collectively, the “PDR Group”) may jointly participate in the processing of personal data for the purposes set out in this Policy.

1. Types of Personal Data

1.1.   The types of personal data collected and processed by PDR under this Policy may vary depending on your relationship, transactions and interactions with PDR. Accordingly, the personal data processed includes basic personal data and sensitive personal data as prescribed by the Personal Data Protection Law.

1.2.   Basic personal data includes: identification and personal details; place of residence and contact address; telephone number, email address and identification numbers issued by state authorities; marital status and information about family relationships (father, mother, children, spouse); information about an individual’s digital account; personal images and signature; information about qualifications, experience and employment history; and other information associated with you or that helps identify you, which does not fall within the categories of sensitive personal data prescribed by law.

1.3.   Sensitive personal data will only be processed where necessary for the purposes set out in this Policy and to the extent permitted by law, and may include: images of identity cards, citizen identity cards or people’s identity cards; health information; information concerning private life, personal secrets and family secrets; data on crimes and violations of law collected and stored by law enforcement authorities; and other types of data classified as sensitive personal data by law.

1.4.   In relation to sensitive personal data, PDR will notify you of the sensitive nature of such data and obtain your separate consent, except where consent is not required by law.

1.5.   If you provide PDR with the personal data of a third party, this Policy will apply accordingly to that individual.

2. Purposes of Personal Data Processing

PDR may collect, process and share your personal data for the following purposes (the “Purposes”):

• Entering into and performing contracts, agreements and documents with you; managing payments and handovers; carrying out legal procedures and providing warranties in relation to products and services;
• Identifying, authenticating and verifying your information;
• Maintaining communications with you, providing advice, assistance and customer care, and improving your experience; responding to inquiries and receiving and handling feedback and complaints;
• Providing information about PDR’s products, projects, promotional programs, events and activities serving PDR’s sales and business operations;
• Conducting surveys, research and statistical activities to support PDR’s operations and business;
• Managing and operating projects and ensuring security and safety at projects;
• Recruiting, assigning, managing and administering employees, and resolving matters arising from employment relationships;
• Managing relationships with partners, contractors and suppliers; managing investor and shareholder relations; and fulfilling information disclosure obligations;
• Storing, managing, backing up and restoring data;
• Preparing reports and providing information as required by law;
• Resolving disputes and complaints; detecting, preventing and handling violations;
• Supporting PDR’s audit, internal control and professional advisory activities; and
• Other purposes as prescribed by law or with your consent.

3. Methods of Personal Data Processing

3.1.   From time to time and depending on each of the Purposes above, PDR may carry out one or more operations involving personal data, such as collecting, recording, analyzing, verifying, storing, editing, combining, accessing, retrieving, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting or destroying data, or other related operations.

3.2.   Processing may be carried out by automated or non-automated means, electronically or manually, through PDR’s information technology systems, paper records and other storage media.

3.3.   Personal data is collected directly from you through your communications, contacts and interactions with PDR, including but not limited to through PDR’s official website; from your representative, authorized person or related persons who provide it to PDR; from third parties, provided that such third parties confirm to PDR that they have obtained your consent to provide the data to PDR and for its processing for the Purposes set out in this Policy; and from competent state authorities or other lawful public sources.

4. Processing of Personal Data by Other Relevant Parties

4.1.   From time to time and in accordance with the Purposes set out in this Policy, PDR may disclose, share, provide or transfer your personal data to relevant parties, whether in or outside Vietnam, including:

• The PDR Group;
• Distributors, real estate exchanges, agents, consultants and PDR’s business partners;
• Credit institutions, guarantors, insurers and project management and operation units;
• Contractors and suppliers of goods and services engaged by PDR to support its business operations or fulfill its legal obligations;
• Competent state authorities and dispute resolution bodies, including mediation organizations, courts and judgment enforcement authorities; and
• Other third parties where permitted by law or with your consent.

4.2.   PDR does not purchase or sell personal data in any form. PDR requires data recipients to undertake to protect personal data, process it only within the authorized scope and not use it for their own purposes. Personal data transfers are made on the basis of written agreements clearly specifying the purposes, types of data, retention period, legal basis and responsibilities of the parties in accordance with law. For sensitive personal data, PDR will apply access-control measures to restrict access, together with prescribed processing procedures and security measures.

4.3.   Where personal data is transferred to or stored outside the territory of Vietnam, PDR will fully complete the procedures required by law.

5. Commencement and Termination of Data Processing

5.1.   Unless otherwise provided by law, personal data processing may commence at any time after PDR lawfully receives your personal data.

5.2.   Your personal data will be retained for the period necessary to fulfill the Purposes or for the period prescribed by law, whichever is later. PDR may need to retain the data even after a specific contract or agreement has expired or been terminated in order to comply with legal obligations, resolve disputes or meet the requirements of competent authorities.

5.3.   Upon termination of processing, PDR will delete or destroy the data, or convert it into a form that no longer allows individuals to be identified, in accordance with applicable regulations.

6. Notice and Consent

6.1.   Your consent must be expressed through a clear affirmative action in a manner recognized by law, such as ticking a consent box, signing or fingerprinting a consent document, sending a text message using a prescribed consent syntax, or taking another action that clearly indicates consent. Your silence or failure to respond will not be regarded as consent.

6.2.   Consent is obtained separately for each Purpose. You have the right to give partial consent or consent subject to conditions. PDR will retain evidence of consent and is responsible for proving that consent has been obtained upon request.

6.3.   You may withdraw your consent at any time in accordance with law. Such withdrawal will not affect the lawfulness of processing carried out before the withdrawal. Before acting on your withdrawal request, PDR will notify you of any potential consequences.

6.4.   Under law, certain cases of personal data processing do not require your consent, including emergencies to protect life or health; public disclosure of data as prescribed by law; processing by competent state authorities in cases prescribed by law; performance of contractual obligations where you are a party to the contract; and other cases prescribed by law.

6.5.   If you provide PDR with another individual’s information, you represent and warrant that you have notified that individual and obtained their valid consent to the provision of such information for the Purposes.

6.6.   Consent in respect of children and persons who have lost or have limited civil act capacity will be obtained in accordance with the Personal Data Protection Law.

6.7.   PDR may send this Policy and updated versions to you by email, text message, application, website or other contact channels that you have registered with PDR.

7. Rights and Obligations of Data Subjects

7.1.   Your rights under the Personal Data Protection Law include the right to be informed, the right to consent, the right to access, the right to withdraw consent, the right to request data deletion, the right to restrict data processing, the right to provide data, the right to object to data processing, the right to lodge complaints and denunciations and initiate lawsuits, the right to claim compensation for damages, and the right to protect yourself.

7.2.   To the extent permitted by law, you may exercise your rights by contacting PDR using the contact details set out in this Policy. PDR will fulfill your lawful and valid requests within the time limits prescribed by law for each type of right, starting from receipt of a complete and valid request, and will not charge any fee unless permitted by law.

7.3.   If further verification is required, PDR will notify you of the reasons and the progress of processing. If PDR rejects all or part of a request in accordance with law, it will respond in writing and state the reasons.

7.4.   Your obligations include protecting your own personal data; respecting and protecting the personal data of others and not infringing upon the lawful rights and interests of the State or other agencies, organizations or individuals; not obstructing or hindering the exercise of the legal rights and obligations of personal data controllers, personal data controllers and processors, or personal data processors; providing complete and accurate personal data when consenting to its processing; and promptly notifying PDR of any changes to the data you have provided.

8. Rights and Obligations of PDR

8.1.   PDR’s rights include processing your personal data within the scope of the Purposes and retention periods set out in this Policy; correcting and updating data where there are valid grounds to do so without your consent; and retaining data for the period necessary to fulfill legal obligations or resolve disputes.

8.2.   PDR’s obligations include processing personal data in accordance with law and this Policy; applying appropriate administrative, technical and organizational measures to protect personal data; ensuring that your rights are exercised; and, in the event of a violation of personal data protection regulations, taking remedial measures to mitigate damage, reporting the matter to competent state authorities and notifying you as required by law.

9. Potential Unwanted Consequences and Damage

9.1.   You understand that the processing of personal data is necessary to fulfill the Purposes, including establishing and maintaining transactional, employment and cooperative relationships between you and PDR.

9.2.   PDR applies necessary measures to protect personal data in accordance with law. However, PDR hereby informs you that no system can absolutely eliminate all risks. Potential unwanted consequences and damage may include unauthorized access to, disclosure, alteration or destruction of data; misuse of data; data errors resulting in inaccurate communications or transactions; and data loss due to technical incidents, cyberattacks or force majeure events. If an incident involving personal data occurs, PDR will take necessary measures to control and remedy the incident and mitigate its consequences, and will provide notifications and fulfill other relevant obligations as required by law.

9.3.   If you fail to provide necessary personal data, provide inaccurate data or withdraw your consent, PDR may be unable to fulfill some or all of the Purposes. This may include being unable to establish or maintain a cooperative relationship, provide certain products or services, or continue performing contracts or transactions with you.

10. General Provisions

10.1.   This Policy governs the processing of personal data in the course of establishing, maintaining and performing the relationship between you and PDR. PDR recommends that you carefully read the entire Policy before providing your personal data to PDR.

10.2.   PDR may amend, supplement or revise this Policy from time to time to ensure consistency with applicable laws and its actual operations. The revised version will be published on PDR’s website or other official information channels, together with its version number and effective date, and will be posted a reasonable period before its effective date, except where immediate amendment is required by law or a competent state authority.

10.3.   Any amendment to this Policy will not expand the scope of the Purposes to which you have consented, unless you consent to such expansion.

10.4.   PDR recommends that you regularly review this Policy to stay informed of any updates, revisions or changes.

10.5.   In the event of any inconsistency between this Policy and the personal data protection provisions in a contract or agreement executed between PDR and you, the provisions of that contract or agreement will prevail to the extent of the inconsistency, provided that they do not contravene applicable law.

10.6.   Filing a complaint with PDR is not a mandatory prerequisite and does not restrict your right to lodge complaints or denunciations with competent state authorities or initiate legal proceedings before a court in accordance with law.

10.7.   This Policy is governed by and construed in accordance with the laws of Vietnam. Any dispute arising out of or in connection with this Policy shall first be resolved through good-faith negotiations. If the parties fail to reach an agreement through negotiations, the dispute shall be submitted to a competent People’s Court for resolution.

10.8.   This Policy is made in Vietnamese. If it is translated into another language, the Vietnamese version shall prevail in the event of any discrepancy.

10.9.   If you have any questions regarding this Policy or wish to exercise your rights or fulfill your obligations relating to personal data protection, please contact PDR using the contact details set out at the beginning of this Policy.