Data Privacy Statement

Data Privacy Statement

This Data Privacy Statement (the “Statement”) is provided by Vietnam Technological and Commercial Joint-Stock Bank and its subsidiaries and affiliates (together as “Techcombank”, “The Bank”, "TCB", “us”, “our” or “we”) and describes Techcombank’s practices regarding personal data processing of Techcombank customers.

Scope of this Statement

This Statement governs the manner in which Techcombank collects and processes customer personal data regarding individuals who use or otherwise interact with Techcombank’s products, websites or services (“Customer”, “you”). We encourage you to read this Statement carefully, and to regularly check this page to review any changes we might make in accordance with the terms of this Statement.

This Statement is an integral part of the general terms and conditions and appendix of the Service Contract of each product or service that you have established with Techcombank.

Within the scope of this Statement, Vietnam Technological and Commercial Joint Stock Bank (“Techcombank”) acts as the Data Controller and Data Processor of personal data. In certain cases, Techcombank may act as the Data Controller while its subsidiaries, affiliates, service providers, or partners may act as Data Processors on the basis of contractual arrangements, legal requirements, and strictly in accordance with Techcombank’s instructions. 

Types of Personal data We Collect

The types of personal data that may be collected by, or on behalf of, Techcombank under this Statement may vary by jurisdiction and applicable laws. The categories listed below are indicative but not exhaustive, and may change depending on your interactions with Techcombank.

• Basic Personal Data includes, but is not limited to: full name (family name, middle name, and given name), other names or aliases (if any); date of birth; date of death or date of missing status; gender; place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current address, hometown, contact address; nationality; personal images; phone number; personal identification number, passport number, driver’s license number, vehicle registration number; marital status; information about family relationships (parent, child, spouse); personal account numbers; and other information associated with or used to identify a specific individual.
• Sensitive Personal Data includes, but is not limited to: data revealing racial or ethnic origin; political opinions, religion, or belief; information relating to private life, personal secrets, and family secrets; health status; biometric data, genetic characteristics; data revealing an individual’s sexual life or sexual orientation; criminal records or information on legal violations collected and stored by law enforcement authorities; location data obtained through location-based services; login credentials and passwords used for accessing an individual’s digital identity accounts; images of identity cards, citizen identification cards, or personal identification documents; login credentials and passwords for bank accounts, bank card information, banking transaction history, financial and credit information, and other financial, securities, and insurance activities or transaction history of customers at credit institutions, foreign bank branches, intermediary payment service providers, securities firms, insurance companies, and other licensed organizations; behavioral tracking data and data on the use of telecommunications services, social networks, online media services, and other services on cyberspace; as well as any other personal data required by law to be kept confidential or subject to enhanced security measures. 

How Personal data is Collected and Collection Methods

Techcombank may collect Personal data in the following circumstances:

Directly From You

• From our Sites:  Techcombank may collect or obtain personal data when you visit any Techcombank’s website (each a “Site”) or use any features or resources available on or through a Site. When you visit a Site, we collect information about your device and browser (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site and other technical communications information), all or some of which may constitute Personal Data.
• From Mobile Apps: Techcombank may collect or obtain personal data when you download or use a Techcombank’s mobile app (each an “App”). Techcombank Apps may record certain information (including App usage statistics, device type, operating system, App settings, IP address, language settings, dates and times of connecting to the App, location data, and other technical communications information) all or some of which may constitute personal data. An App used by Techcombank may have its own Privacy Policy, which you are encouraged to review before using the relevant App
• From Services: Techcombank may collect or obtain personal data when you register to use any service provided via a Site or an App, or log into a Site or an App; or make transactions directly at Techcombank's branches or transaction offices.
• From communications with you: Techcombank may collect or obtain personal data when you contact Techcombank (whether in person, by mail, by phone, online, via electronic communication or by any other means) including our customer surveys.
• From automated interactions or data collection technologies. Techcombank may collect information including IP address, referring URL, operating system, web browser and any other information automatically logged from the connection.
  • Cookies, flash cookies, pixel tags, web beacons, or other tracking technologies.
  • Third party cookies, plug-ins, or social media connectors.
  • Any technology capable of tracking individual activity across devices or websites.  
  • Location information or other meta-data provided by a device.
• Other Means: Techcombank may collect or obtain Personal Data when you interact with Techcombank via any other means.

Techcombank may receive Personal data about you from other third parties

For example:  

• If you choose to interact with third party content or advertising on a Site or in an App, Techcombank may receive personal data about you from the relevant third party, in accordance with that third party’s applicable and legitimate privacy policy.
• If you choose to make an electronic payment directly to Techcombank, or through a Site or an App, Techcombank may receive personal data about you from third parties such as payment services providers, for the purposes of that payment.  
• In complying with its obligations under applicable laws, Techcombank may receive personal data about you from law enforcement agencies and public authorities.
• Techcombank may receive personal data about you from public sources (such as telephone directories, advertisement/flyers, public information on websites, etc.).

Whenever you provide any such personal data, you must ensure that any affected third parties have consented to: (i) the disclosure of their personal data to Techcombank; and (ii) Techcombank’s further Processing of the personal data in accordance with this Statement. If you cannot obtain such consent, please refrain from communicating the personal data to third parties.

Your rights and obligations regarding the personal data that Techcombank collects

Techcombank respects your personal data, and you have the following rights regarding how the Bank processes your information:

• Right to consent, refuse consent, or withdraw consent:
  You have the right to choose whether to provide consent, refuse consent, or withdraw your consent for the Bank to process your personal data. This is facilitated by the Bank in a convenient and transparent manner, in compliance with applicable laws, without affecting any contractual obligations you have committed to with the Bank. The Bank will also clearly inform you of any potential impacts arising from such withdrawal.
• Right to be informed about personal data processing:
  The Bank is committed to transparency in personal data processing and will provide you with sufficient information regarding the purposes, scope, methods, legal bases, and relevant parties involved, as well as support you in accessing and understanding such information upon request.
• Right to access and rectify personal data:
  You may access, review, and request corrections to your personal data held by the Bank. The Bank will update your information upon receiving valid requests to ensure your data remains accurate and complete.
• Right to request provision, deletion, restriction, or objection to the processing of personal data:
  The Bank will receive and consider your requests related to obtaining copies of your data, restricting processing, or objecting to the processing of your personal data.
  With respect to deletion requests, the Bank will implement them in accordance with applicable laws and relevant sector-specific regulations, as well as the Bank’s obligations in fulfilling any contractual commitments with you.
• Right to lodge complaints, denunciations, initiate legal actions, and request compensation:
  You have the right to file complaints, denunciations, initiate legal proceedings, or request compensation for damages related to personal data processing activities. The Bank respects and ensures the full exercise of these lawful rights.
• Right to request the application of personal data protection measures:
  The Bank will coordinate with and facilitate your requests to competent authorities or relevant organizations and individuals to apply necessary measures for the protection of your personal data in accordance with the law.
  
  

Your Obligations Regarding Your Personal Data

You also play a role in protecting your personal data by:

• Protecting your own personal data and requesting the Bank or other relevant organizations and individuals to safeguard your personal data.
• Respecting and protecting the personal data of others.
• Providing complete and accurate personal data when you have consented to the Bank’s processing of your personal data.
• Complying with applicable laws and regulations on personal data protection, and participating in preventing violations of such laws and regulations.
• Fulfilling other obligations as stipulated under applicable laws and regulations.
  
  

The Bank will respond to your requests to exercise your personal data rights in accordance with applicable laws. 

How Personal Data is processed

Techcombank processes your personal data only when it is genuinely necessary for lawful activities and/or based on one or more of the following legal bases:
(1) Your consent; (2) Compliance with legal obligations under applicable laws; (3) Performance of a contract to which you are a party; (4) Protection of the legitimate interests of Techcombank or a third party in accordance with the law; (5) Emergency circumstances necessary to protect the life or health of the Data Subject or another person as prescribed by law.

Techcombank may process your personal data for the following purposes, including but not limited to:

• Providing Techcombank’s Products/Services to you and/or carrying out activities within the scope of a legally licensed commercial bank, including but not limited to:  
  • Providing, operating, maintaining, and improving Techcombank’s Products/Services;
  • Conducting customer identification, account and transaction management, and customer care activities;
  • Preventing and combating fraud, money laundering, terrorism financing, and other violations of the law;
  • Fulfilling regulatory reporting, inspection, supervision, and management requirements of competent state authorities;
  • Performing Techcombank’s legal obligations and contractual obligations;
  • Conducting data analysis to assess and enhance product and service quality;
  • Managing risks and ensuring system and customer information security;
  • Conducting verification, credit assessment, and determining your creditworthiness;
  • Collecting audio recordings, video recordings, and process biometric data for the purposes of facilitating transactions, ensuring security, and meeting compliance requirements;
  • Carrying out internal governance activities in accordance with applicable laws.
• Marketing, Advisory, and Product/Service Introduction
  • Providing information about Techcombank’s products, services, promotional programs, and special offers;
  • Introducing products and services offered by Techcombank’s partners, based on your consent and subject to Techcombank’s confidentiality commitments and personal data processing agreements in accordance with applicable laws. 

Protection of your Personal Data

Techcombank is committed to processing your personal data in a safe, confidential manner and ensuring your rights to personal data processing activities in accordance with the provisions of the current Law.

We adopt appropriate data processing practices, and appropriate technical and organizational security measures, to protect against unauthorized access, read, use, alteration, disclosure, destruction or other processing of personal data.

However, the transmission of data over the Internet carries inherent risks and cannot be guaranteed to be completely secure. When using online channels to provide personal data, you are advised to use secure devices and connections, and you are responsible for safeguarding your login credentials and authentication factors.

You should promptly notify Techcombank if you detect any unauthorized use of your login information or suspect that your data may have been compromised. Techcombank will receive, assess, and handle the incident in accordance with applicable laws, and will cooperate with you to mitigate risks and protect your personal data. 

Disclosure of your Personal Data

We will not sell, trade, or rent your personal data to others without obtaining your consent in accordance with Applicable Law. We may share or disclose your personal data to third parties in the following circumstances:

• Employees, staff members, candidates, agents, and authorized representatives of Techcombank, within the scope of their assigned functions and duties, for the purpose of carrying out the data processing activities described in this Statement;
• External data recipients, including but not limited to:
  • Business partners, service providers, and subcontractors of such partners;
  • Techcombank’s subsidiaries and affiliates;
  • Trusted third parties that have a cooperative relationship with Techcombank, provided that these parties have entered into written agreements or commitments on personal data confidentiality and comply with applicable regulations on personal data protection and your privacy under Vietnamese law.
• Partners with whom Techcombank enters into product distribution agreements, in which Techcombank acts as a distribution agent/organizational agent, for the purposes of advising on and providing products (including but not limited to insurance products) based on your needs and at your request;
• Third‑party service providers engaged by Techcombank to:
  • Support the operation of banking activities, information technology systems, websites, applications, or devices;
  • Provide you with the products and services you have selected;
  • Perform activities on behalf of the Bank, such as sending notifications, newsletters, surveys, customer care communications, or other relevant support activities;
  • Provide payment services, payment intermediaries, or related services in cases where you carry out transactions or payments via websites, applications, or directly with Techcombank, for the purposes of supporting, validating, and completing such payment transactions.
• Assignees, potential buyers, or their representatives, in the event that Techcombank considers, proposes, or carries out any sale, merger, consolidation, division, restructuring, or transfer of all or part of its business or assets (including dissolution or liquidation), provided that Techcombank has taken and will continue to take reasonable and necessary measures as required by law to ensure the safety and confidentiality of your personal data;
• Competent government authorities, upon receiving a lawful request in accordance with applicable laws or in other circumstances permitted by law

Techcombank is committed to ensuring that any sharing and processing of your personal data is carried out in accordance with the stated processing purposes, the principles of data minimization, the prescribed processing duration, and the rights of data subjects as required under personal data protection laws. 

Third party services

You may encounter advertising or other content on any Site, App or Device that may link to websites or services of Techcombank’s partners, advertisers, sponsors, or other third parties.

We do not control the content or links that appear on these third party websites or services, and we are not responsible for the practices employed by third party websites or services linked to or from any Site, App or Device.

These websites and services may be subject to their own privacy policies and terms of use.

Direct Marketing

The Bank, its direct marketing partners, or authorized service providers will only conduct direct marketing communications with your prior, explicit, and specific consent in accordance with the Personal Data Protection Law. 

Once you have provided consent, the Bank may contact you via email, text message, phone call, or other appropriate electronic means to provide information about products, services, and promotional programs that the Bank believes may be suitable for your needs. 

You may refuse or withdraw your consent to direct marketing at any time through the communication channels announced by Techcombank. 

Your withdrawal of consent will be processed as soon as practicable in accordance with applicable laws, and from that point onward, the Bank will cease sending direct marketing communications to you. 

Withdrawing consent for direct marketing does not affect the Bank’s ability to contact you for other purposes based on a valid legal basis, including but not limited to: performing transactions, operating services, providing updates on product or service features, sending transaction notifications, securing your account, or fulfilling legal obligations. 

Cookies

When you use or visit our websites, we may place one or more cookies on your device. A “cookie” is a small file that is placed on your device when you visit a website. It records information about your device, your browser and, in some cases, your preferences and browsing habits. We may use this information to recognize you when you return to our websites, to provide personalized services on our websites, to compile analytics in order to better understand website activity, and to improve our websites. You can use your browser settings to remove or block cookies on your device. However, if you decide not to accept, or to block, cookies from our websites, you may not be able to take advantage of all of the features of our websites.

We may process your personal data through cookie technology, in accordance with the provisions of this Statement. We may also use remarketing tags to serve advertisements to people who we know have previously visited our websites

To the extent that third parties have embedded content on our websites (e.g., social media features) those third parties may collect your personal data (e.g., cookie data) if you choose to engage with such third party content, or otherwise use third party services.

Data retention

Your personal data will be processed at any time based on your consent, unless otherwise required under applicable laws, and such processing will cease when you withdraw your consent or when required in accordance with prevailing regulations.

The Bank will retain your personal data for business or legal purposes for as long as you maintain a relationship or conduct transactions with the Bank, and for an additional period thereafter to serve the purposes set out in this Statement, in compliance with the Bank’s data retention policies and applicable laws.

Unless otherwise required under applicable laws and regulations, the Bank will delete, anonymize, destroy, and/or cease using your personal data once it is no longer needed. 

Amendments to this Statement

Techcombank may amend or update this Statement when necessary to comply with legal requirements or to reflect changes in the Bank’s products and services. Any material modifications relating to your rights and obligations will be communicated through the Bank’s website and/or the communication channels you have previously registered.

Where amendments materially affect the way your personal data is processed, the Bank will provide appropriate information in accordance with the Personal Data Protection Law so that you may review and provide consent for any purposes that require your explicit agreement. 

Glossary in this Statement

Applicable Laws means all binding laws, statutes or regulations applicable to Techcombank.

Personal data processing refers to one or multiple activities that impact on personal data, including collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, traceability, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction or other relevant activities.

Third party is an organization or individual that has a written agreement (service contract, cooperation contract) with Techcombank for the purpose of providing goods and services to Techcombank, implementing cooperation agreements with Techcombank. Techcombank, including but not limited to:

• Independent individuals or companies;
• Organizations that Techcombank directly or indirectly owns