Personal Data Protection Policy For Partners

04/03/2026

Pursuant to the laws of Viet Nam, by means of this notice (hereinafter referred to collectively as the “PDP Notice”), Orient Commercial Joint Stock Bank (hereinafter referred to collectively as “OCB”) would like to inform its Partners (as defined below) of the processing of Personal Data (the “PDP”) under the detailed terms and conditions set out in this PDP Notice (hereinafter referred to collectively as the “PDP Terms and Conditions”).

The PDP Terms and Conditions are publicly announced on the website https://ocb.com.vn/en/news-events/news/personal-data-protection-policy-for-partners and enter into force on 04/03/2026, replacing OCB’s Personal Data Processing notice that took effect on 05/01/2026.

OCB reserves the right to amend or supplement these PDP Terms and Conditions at any time. OCB will inform Partners of any amendment or supplement to the PDP Notice through the communication channels it deems appropriate and will publish them on OCB’s website. OCB encourages Partners to review the PDP Terms and Conditions regularly in order to obtain the latest updates and to exercise their data‑subject rights.

A. DEFINITIONS AND INTERPRETATION

In this Privacy Policy, unless the context otherwise requires, the following terms shall have the following meanings:

1.   “Personal Data Controller” means the agency, organization or individual that decides on the purposes and means of Personal Data processing.
2.   “Personal Data Controller and Processor” means the agency, organization, or individual that decides on the purposes and means of Personal Data processing and directly processes Personal Data.
3.   “Personal Data Processor” means the agency, organization, or individual processing Personal Data as requested by the Personal Data processing party or Personal Data Controller and Processor under a contract.
4.   “Data Subject” means the individual whose Personal Data is reflected and refers to both the Partner (if an individual) and the Partner’s Contact Person(s), or to either of them.
5.   “Personal Data” or (“PD”) means digital data or information in other forms that identifies or assists the identification of a specific individual, including basic personal data and sensitive personal data. Personal data, once de-identified, is no longer considered personal data. PD includes Basic Personal Data and Sensitive Personal Data. Personal data, once de-identified, is no longer considered personal data.
6.   “Partner” refers to an individual or organizational partner that provides goods, services, collaborates, and/or has a commercial business relationship with OCB under a specific Contract/Agreement.
7.   “Contact Point” refers to individuals related to the organizational partner, including but not limited to representative(s), director(s), controller(s), officer(s), employee(s), and other relevant individual(s) of the Partner.
8.   “Personal Data Processing” or “PD Processing” or “Processing” is refers to activities impacting personal data, including one or more of the following: collection, analysis, summary, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities impacting personal data.

B. GENERAL PROVISIONS

1. This PDP Notice specifically sets out the following:

i.   The types of Personal Data that OCB and/or any Processor will Process and the methods of Processing;
ii.   The purposes of Processing;
iii.   The parties that will participate in the Processing;
iv.   The rights and obligations regarding Personal Data of the Data Subjects, OCB and the Processor(s);
v.   Possible unwanted consequences or damages;
vi.   The commencement and termination time of Processing; and
vii.   Other issues related to Processing.

2. OCB will process PD as a Personal Data Controller and Processor and, accordingly, will determine the purpose, means, and directly carry out the PPD processing.

3. The PDP Terms and Conditions in this PDP Processing Notice form an integral part of the agreements, contracts, terms and conditions governing the relationship between the Partner and/or the Data Subject with OCB. In the event of any differences and/or conflicts between the PDP Processing Terms and Conditions and the terms and conditions set forth for the same purposes in agreements and/or contracts between the Partner and/or the Data Subject and OCB whether concluded prior to, on the same date as, or after this PDP Processing Notice, the PDP Processing Terms and Conditions shall be prevailed and will automatically replace the relevant provisions in those agreements and/or contracts.

C. TYPES OF PERSONAL DATA THAT OCB AND/OR PERSONAL DATA PROCESSING PARTIES WILL PROCESS

1. To enable OCB to carry out and implement tasks, fulfill obligations as stipulated in agreements, contracts, terms, and conditions signed with the Partner, and comply with relevant legal regulations in Vietnam, including but not limited to banking operation regulations and anti-money laundering laws, OCB and the Personal Data Processing party(ies) will process the following basic types of personal data of the Partner and Contact Points:

Full name, middle name, and birth name; other names (if any);
Date of birth;
Place of birth, registered place of birth;
Gender;
Residential information (including permanent residence, temporary residence, current address, place of origin, contact address; work address, office address, other contact details);
Nationality;
Citizen identification number, identification number, personal identification number, passport number;
Email address; Phone number;
Personal tax number;
Any other data, information intentionally provided by the Partner to OCB during the execution and implementation task and responsibilities according to agreements, contracts, terms and conditions signed with Partner, which does not fall under the category of sensitive Personal data;
Other basic Personal data associated with a specific individual or enabling the identification of a specific individual.

2. OCB and/or Personal Data Processing Parties may collect Personal Data of Partners and/or Data Subjects from various legal sources, including but not limited to:

i.   Directly provided by the Partner and/or Contact Point to OCB when signing agreements, contracts, terms and conditions with OCB;
ii.   Provided by the Partner and/or Contact Point to third parties (organizations or individuals outside of OCB and the Personal Data Processing Parties but authorized to process personal data) and agreed to be shared with OCB. For the purposes of this provision, third parties may include but are not limited to service providers in communications, market research, marketing, credit referencing, fraud prevention, data aggregation, and/or other third parties related to OCB’s activities;
iii.   From competent state authorities and/or agencies/entities under competent state authorities in Vietnam and/or abroad, including but not limited to the State Bank of Vietnam;
iv.   From any other sources and/or third parties not mentioned above, provided that such sources and/or third parties process personal data in accordance with Vietnamese legal regulations and have obtained consent from the Data Subject to share the data with other parties, including OCB.

D. PERSONAL DATA PROCESSING PURPOSES

OCB and/or the Personal Data Processing party(ies) may process Personal Data for one or more of the following purposes:

i. To fulfill OCB's rights and obligations under agreements and contracts signed with Partners and agreements and contracts signed with other third parties, including but not limited to deciding whether to continue, suspend, or terminate the provision of any goods, products, services, or collaborations with the Partner;
ii. To carry out OCB's internal operations, including but not limited to:

a.   Auditing;
b.   Risk management;
c.   Compliance with legal regulations;
d.   Crime prevention (including crimes related to money laundering, cyberattacks, terrorism, bribery, corruption, and/or any other criminal acts);
e.   Organizing internal meetings and approving decisions, resolutions of the board of directors, executive board, and/or other internal committees and councils within OCB;

iii. To fulfill requests for investigation, information provision, reporting, and statistical requirements from competent state authorities, including but not limited to the State Bank of Vietnam, investigation police agencies, and/or other criminal procedure authorities, courts, and enforcement agencies;
iv. For any other purposes permitted under Vietnamese law.

E. METHODS OF PERSONAL DATA PROCESSING

1. Collection and processing of Personal Data
OCB may collect Partner and Contact Point's Personal Data through the following methods:

When the Partner enters into agreements, contracts, terms and conditions with OCB to provide goods, services, cooperate, and/or engage in other commercial business relationships.
From interactions, communications, and exchanges with Partner and Contact Point's (in person, via mail, phone, online communication, electronic messaging, social media, surveys, or any other means).
From other lawful methods and means of collecting Personal Data.

After collecting Personal Data, OCB will carry out one or more appropriate Personal data processing activities, including collection, recording, analysis, verification, storage, modification, disclosure, combination, access, retrieval, recovery, encryption, decryption, duplication, sharing, transmission, provision, transfer, deletion, destruction of Personal Data, or other related actions. These activities are conducted to fulfill Processing Purposes or meet Partner and/or Contact Point requests regarding their rights as Data Subjects (e.g., rights to amend, update, provide, restrict Personal Data processing, etc.) in accordance with applicable laws and regulations.

2. Deletion of Partner and/or Contact Point’s Personal Data
OCB will permanently delete Partner and/or Contact Point’s Personal Data in the following cases:

Data processing does not align with the intended purpose.
The processing purpose for which the Partner and/or Contact Point’s provided consent has been fulfilled.
Personal Data storage is no longer necessary for OCB’s operations.
OCB is dissolved, ceases operations, declares bankruptcy, or terminates business activities as required by law.

OCB will take necessary measures to prevent access to or usage of Personal Data for any purpose other than complying with this PDP Notice or for safety, security, fraud detection, and risk prevention related to information system security, cybersecurity, and Partner and/or Contact Point’s Personal Data protection.

3. Transfer of Personal Data abroad
OCB may transfer or grant access to Partner and/or Contact Point’s Personal Data to foreign authorities, organizations, and management entities (including partners and service providers abroad) for processing in accordance with the Processing Purposes agreed upon by Partner and/or Contact Point. In some cases, OCB’s partners or service providers located in Vietnam may use data processing device, systems situated outside Vietnam’s territory to process Personal Data on behalf of OCB. These situations are considered cross-border transfers of Partner and/or Contact Point’s Personal Data.

It is important to note that some countries may have different levels or practices regarding Personal Data protection, which could be lower or higher than those in Vietnam. In all cases of transferring Personal Data abroad, OCB will strive to implement appropriate measures to safeguard Clients' Personal Data including entering into agreements and commitments regarding data protection, selecting suitable Data Processors with clearly defined responsibilities, and ensuring that such entities maintain adequate security practices.

F. PARTIES INVOLVED IN THE PERSONAL DATA PROCESSING PROCESS

1. In full compliance with Vietnamese law, OCB may share part or all of the Personal Data of Data Subjects with the following parties:

i.   OCB’s subsidiaries and/or affiliates (if any);
ii.   Organizations and individuals acting as Personal Data Processor Parties, including but not limited to suppliers of goods and services to OCB, professional consulting firms (including but not limited to lawyers, legal advisors, financial consultants, accountants, auditors, and/or other professional consulting firms);
iii.   Any competent State authority and/or entities affiliated with such State authorities in accordance with Vietnamese law;
iv.   Any other third party not listed above that Vietnamese law permits OCB to share Personal Data with.

2. On the other hand, OCB will consider the Personal Data of Data Subjects to be private and confidential. Except for the parties mentioned above, OCB will not disclose Personal Data to any other parties unless:

i.   With the consent of the Data Subject;
ii.   When OCB is required or permitted to disclose under legal regulations;
iii.   When OCB is required or permitted by a decision of a competent State authority;
iv.   When OCB transfers rights and obligations under the agreement(s) between the Data Subject and OCB; and/or
v.   When OCB is compelled to fulfill its obligations to any competent State authority.

G. RIGHTS AND OBLIGATIONS REGARDING PERSONAL DATA OF DATA SUBJECT, OCB AND PERSONAL DATA PROCESSOR PARTY(IES)

1.   Data Subjects, OCB, and Personal Data Processor Party(ies) shall have rights and obligations concerning Personal Data Processing in accordance with the relevant provisions of Vietnamese law.
2.   When Data Subjects wish to exercise any of their rights regarding their Personal Data that is controlled and processed by OCB, they must notify OCB by using one of the methods specified in this PDP Notice. Upon receiving a complete and valid request, OCB will make efforts to fulfill the request within the legally required period of time and, if unable to do so for any reason, will inform the Data Subject unless Vietnamese law prohibits such notification.
3.   To comply with relevant legal regulations of Vietnam, OCB has the right to restrict and/or deny requests from Data Subjects, including but not limited to requests for access, modification, deletion, and/or destruction of Personal Data, in cases where OCB cannot verify the identity of the Data Subject or in situations where legal provisions do not permit OCB to fulfill such requests.
4.   If a Data Subject withdraws their consent or requests modification, deletion, and/or destruction of their Personal Data, resulting in OCB being unable to continue executing or implementing tasks and obligations under agreements, contracts, terms, and conditions signed with the Partner, OCB shall consider such a request as the Partner's unilateral termination of the signed agreements and contracts. This shall also be deemed a contractual violation by the Partner. Consequently, OCB has full discretion to enforce safeguard measures and/or other measures stipulated in the agreements and contracts to protect OCB’s legal rights and interests.
5.   To clarify, when Data Subjects withdraw their consent:

i. The withdrawal shall only take legal effect for OCB from the time the request is submitted and OCB has completed identity verification of the Data Subject. The withdrawal shall not be retroactive to any consent given before this point; and
ii. The withdrawal of consent shall only apply to specific Personal Data Processing purpose(s) and shall not apply to all Personal Data Processing purposes outlined in this PDP Notice unless explicitly specified by the Data Subject.

6. The implementation of Personal Data Processing may involve certain risks such as data leaks or improper data processing, potentially causing harm not only to Data Subjects but also to OCB itself. Therefore, OCB shall apply Personal Data protection measures in accordance with legal regulations and international standards. Additionally, OCB shall regularly update its management and protection measures to enhance data security during Personal Data Processing execution.

H. START AND END TIME FOR PERSONAL DATA PROCESSING

OCB processes Partner and Contact Point's Personal Data from the moment OCB signed the agreements, contracts, terms and conditions with Partner. Partner and Contact Point's Personal Data will be stored for the necessary period to achieve the Processing Purposes, unless a longer retention period is required or permitted by applicable laws and regulations (e.g., for tax and audit purposes) or to fulfill obligations that OCB has notified the Partner about. Certain types of Personal Data may be retained longer than others.

I. HUNINTENDED CONSEQUENCES AND DAMAGES THAT MAY OCCUR

Please note that although OCB strives to ensure that Partner and Contact Point's Personal Data is protected in accordance with legal regulations, OCB cannot completely and absolutely eliminate all risks associated with Personal Data processing. The transmission of information over the Internet or OCB’s internal information systems may still carry certain risks due to force majeure events or cybersecurity incidents, such as cyberattacks, cyber terrorism, unauthorized cyber espionage, disruptions in data processing, or Personal Data leaks. In such cases, OCB will immediately take the necessary actions to prevent, remediate, and minimize any unintended damages that may arise concerning Personal Data and will cooperate with competent government authorities to address violations. Partner and/or Contact Point also acknowledge that, to the extent OCB has implemented reasonable measures to mitigate these risks, OCB shall not be held liable for damages caused by third-party actions that negatively impact Partner and/or Contact Point's Personal Data beyond OCB’s control.

J. CONTACT OCB TO EXERCISE THE RIGHT REGARDING PERSONAL DATA

If Data Subjects have any questions and/or requests related to this PDP Notice or regarding their Personal Data, they may contact with contact point mentioned in agreements, contracts, terms and conditions signed with Partner or reach out through the following channels:

ORIENT COMMERCIAL JOINT STOCK BANK