This Privacy Notice describes how Saigon Paper Corporation ('SGP' or 'we') collects and processes Personal Data about an individual (‘Personal Data’), how we use and protect Personal Data, and your rights in relation to your Personal Data.

1. Personal Data we use

Collected Personal Data refers to associated with an individual or used to identify an individual, on which may include general personal data (e.g., name/fullname, gender, date of birth, place of birth, nationnality, personal image, phone number, contact info, marital status, professional experience) and sensitive personal data (e.g., political and religious opinions, health condition and personal information, information on customers of credit institutions and and other licensed institutions).

This Privacy Notice applies to all your Personal Data we collect or process.

2. How to collect Personal Data

We will collect your Personal Data from a variety of sources. We may collect yourPersonal Data from you directly (e.g. when you contact us) or from other sources such as mass media, public registrars, credit research agencies, recruiting agencies or employment screening agencies.

We may be required by law or as a consequence of any contractual relationship we have with you to collect certain Personal Data about you. In such case, your failure to provide the information may prevent or delay the fulfilment of our obligations under the law or the contract.

Some of the categories of information that we collect are sensitive personal information. In particular, we may process Personal Data that may reveal your racial or ethnic origin, religion or that may relate to your health, such as your medical history and reports on medical diagnoses, injuries and treatment. We ensure that we solely collect such sensitive Personal Data when you give us an explicit consent or as permitted or required by law.

3. Purposes of our use of your Personal Data

We collect, process and disclose your Personal Data only for specific and limited purposes that officially announced in advance (under this Privacy Notice) or within the scope of use informed at the time of acquisition and to the extent necessary to carry out business.

Depending on Personal Data collected, we may use such Personal Data to:

• Perform and enforce any obligation under a contract/agreement to which you are or will be a party;

• Provide and personalise our products/services;

• Comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies (e.g., tax or social security obligations or reporting suspicious transactions);

• Deal with your enquiries and requests;

• Contact you with marketing and offers relating to products and services offered by us and/or other members of Sojitz Corporation (unless you have opted out of marketing, or we are otherwise prevented by law from doing so);

• Meet our legitimate interests, for example screening your background for anticorruption purpose or to understand how you use our products/services and to enable us to develop new products/services or other business analysis purposes. When we process Personal Data to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms;

4. Rights of Data Object

You have certain rights regarding your Personal Data, subject to provisions of laws and you can exercise these rights at any point. We provide an overview of these rights below together with what this entails for you. You can exercise your rights by contact us in the manner mentioned in Section 8 hereof or other manners in accordance with laws.

• Right to be informed: You have the right to be provided with clear, transparent and easily understandable information about how we use your Personal Data and your rights. Therefore, we’re providing you with the information in this Notice.

• Right to give consent or withdraw consent: You has the right to give consent to the processing of your Personal Data or not, but if you choose not to do so, we may not be able to provide you with our products/services, or respond to any queries you may have. If you have given your consent to anything we do with your Personal Data, you also can withdraw such consent at any time by contacting us with the details provided below, unless otherwise provided for by laws.

• Right to access and rectification: You has the right to access, request rectification or update your personal data at any point.

• Right to delete personal data: unless otherwise provided for by laws, you have the right to request us delete your Personal Data. Please refer to Section 7 (Personal  Information Security and Storage) for more information.

• Right to obtain restriction on processing or object to processing data: Under certain circumstances, you have the right to obtain restriction or object to processing your personal data in order to prevent or restrict the disclosure of Personal Data or the use of Personal Data for advertising and marketing purposes, unless otherwise provided for by laws.

• Right to obtain personal data: You has the right to request us provide your personal data, unless otherwise provided for by laws.

• Right to file complaints, denunciations and lawsuits: You have the right to lodge a complaint directly with any local authority in accordance with laws regarding the manner we process your Personal Data if there are grounds to believe that a violation of domestic laws on privacy has occurred.

• Right to claim damage: You has the right to claim damage as prescribed by laws if there is well-founded evidence that damages has been occurred to you from our collecting and processing of Personal Data, unless otherwise provided for by laws.

• Right to self-protection: You has the right to self-protection or request competent agencies and organizations to implement civil right protection methods according to regulations of law.

5. Personal Data sharing

We may share your Personal Information with selected third parties under the following circumstances:

• Service providers and business partners: For business and operational purposes, we may share your Personal Data with our service providers and business partners that perform functions on our behalf, such as companies that: provide storage space, process secure payments, analyse data, fulfil orders, provide customer service, postal or delivery services, etc. They have access to Personal Data needed to perform their functions but may not use it for other purposes. Further, they must process such Personal Data in accordance with this Privacy Notice and as permitted by applicable personal data protection laws and regulations.

• Our group companies: We work closely with other businesses and companies that fall under Sojitz Corporation (“Sojitz Group Companies”). We may share your Personal Data with Sojitz Group Companies for marketing purposes or anti-corruption compliance purposes. Because Sojitz Corporation operates its business globally, the recipients referred to above may be located outside the territory of Vietnam. See section 6 (International Data Transfer) for more information.

• Law enforcement agency, court, regulator, government authority or other authorized third party: We may share your Personal Data with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

• Business transfers: We may share your Personal Data with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your Personal Data uses it in a manner that is consistent with this Privacy Notice.

• To respond to an emergency, including but not limited to detect and protect against fraud, or any technical or security vulnerabilities.

6. International Data Transfer

As a member of the Sojitz Corporation – a global corporation, we may share Personal Data with management departments, Sojitz Group Companies and/or with third parties that operate in foreign countries for the purposes described in this Privacy Notice.

We shall fully comply with the provisions of Vietnam laws on outbound transfer of Personal Data and put in place appropriate safeguards (such as contractual commitments) to ensure that your Personal Data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

7. Personal  Information Security and Storage

We implement reasonable technical and organisational measures to ensure a level of security appropriate to the Personal Data we collect and process, ensuring that your Personal Data is not misused, interference, loss, unauthorized access, modification or disclosure. These measures are aimed at ensuring the on-going integrity and confidentiality of Personal Data. We evaluate and improve these measures on a regular basis to ensure the security of the processing.

We will keep your Personal Data within a period of time that is appropriate for the processing purposes as specified in this Privacy Notice and as long as we have a relationship with you. For clarification, once our relationship has come to an end, we will retain your Personal Data for a reasonable period of time that in our opinion will enable us to:

• Maintain business records for analysis and/or audit purposes;

• Comply with record retention requirements under the law or under applicable record retention policies;

• Defend or bring any existing or potential legal claims;

• Deal with any complaints regarding the goods/services, to the extent it is reasonably possible for us.

Unless otherwise provided for by law, we will delete your Personal Data when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

8. Contact us 

We are the Personal Data Controller-cum-Processor who are responsible for your Personal Data we collect and process.

If you have questions or concerns regarding this Privacy Notice and/or the way in which your Personal Data has been used and/or processed and/or if you would like to make a complaint about a potential violation of domestic laws on privacy, please contact via email contact@saigonpaper.com or submit a request via the “Contact Us” section of our website.

9. Changes to this Privacy Notice

We may modify or update this Privacy Notice from time to time.

If we change this Privacy Notice, we will amend the “last updated” at the beginning of this Notice. Where changes to this Privacy Notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will make a more conspicuous notice (including, where permitted, a notification of changes of Privacy Notice via your email) so that you have the opportunity to exercise your rights.