Data Privacy Statement

Data Privacy Statement

This Data Privacy Statement (the “Statement”) is provided by Vietnam Technological and Commercial Joint-Stock Bank and its subsidiaries and affiliates (together as “Techcombank”, “The Bank”, "TCB", “us”, “our” or “we”) and describes Techcombank’s practices regarding personal data processing of Techcombank customers.

Scope of this Statement

This Statement governs the manner in which Techcombank collects and processes customer personal data regarding individuals who use or otherwise interact with Techcombank’s products, websites or services (“Customer”, “you”). We encourage you to read this Statement carefully, and to regularly check this page to review any changes we might make in accordance with the terms of this Statement.

This Statement is an integral part of the general terms and conditions and appendix of the Service Contract of each product or service that you have established with Techcombank.

Types of Personal data We Collect

The types of personal data that may be collected by, or on behalf of, Techcombank under this Statement may vary by jurisdiction and applicable laws. The categories listed below are indicative but not exhaustive, and may change depending on your interactions with Techcombank.

• General personal data: Last name, middle name and first name, other names (if any); Date of birth; date of death or going missing; Gender; Place of birth, registered place of birth; place of permanent residence; place of temporary residence; current place of residence; hometown; contact address; Nationality; Personal image; Phone number; ID Card number, personal identification number, passport number, driver’s license number, license plate, taxpayer identification number, social security number and health insurance card number;  Marital status; Information about the individual’s family relationship (parents, children); Digital account information; personal data that reflects activities and activity history in cyberspace;  Information associated with an individual or used to identify an individual other than that specified in Sensitive personal data mentioned below.
• Sensitive personal data: Political and religious opinions; Health condition and personal information stated in health record, excluding information on blood group; Information about racial or ethnic origin; Information about genetic data related to an individual's inherited or acquired genetic characteristics; Information about an individual’s own biometric or biological characteristics; Information about an individual’s sex life or sexual orientation; Data on crimes and criminal activities collected and stored by law enforcement agencies; Information on customers of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including: customer identification as prescribed by law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service providers; Personal location identified via location services; Other specific personal data as prescribed by law that requires special protection.
• Data relating to Sites or Apps: technical data (as outlined above, including device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site, App usage statistics, App settings, dates and times of connecting to the App, location data, and other technical communications information); username; password; security login details; usage data, etc.  
• Marketing data: advertising interests; cookie data; clickstream data; browsing history; responses to direct marketing; and opt-outs from direct marketing, etc.

How Personal data is Collected and Collection Methods

Techcombank may collect Personal data in the following circumstances:

Directly From You

• From our Sites:  Techcombank may collect or obtain personal data when you visit any Techcombank’s website (each a “Site”) or use any features or resources available on or through a Site. When you visit a Site, we collect information about your device and browser (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site and other technical communications information), all or some of which may constitute Personal Data.
• From Mobile Apps: Techcombank may collect or obtain personal data when you download or use a Techcombank’s mobile app (each an “App”). Techcombank Apps may record certain information (including App usage statistics, device type, operating system, App settings, IP address, language settings, dates and times of connecting to the App, location data, and other technical communications information) all or some of which may constitute personal data. An App used by Techcombank may have its own Privacy Policy, which you are encouraged to review before using the relevant App
• From Services: Techcombank may collect or obtain personal data when you register to use any service provided via a Site or an App, or log into a Site or an App; or make transactions directly at Techcombank's branches or transaction offices.
• From communications with you: Techcombank may collect or obtain personal data when you contact Techcombank (whether in person, by mail, by phone, online, via electronic communication or by any other means) including our customer surveys.
• From automated interactions or data collection technologies. Techcombank may collect information including IP address, referring URL, operating system, web browser and any other information automatically logged from the connection.
  • Cookies, flash cookies, pixel tags, web beacons, or other tracking technologies.
  • Third party cookies, plug-ins, or social media connectors.
  • Any technology capable of tracking individual activity across devices or websites.  
  • Location information or other meta-data provided by a device.
• Other Means: Techcombank may collect or obtain Personal Data when you interact with Techcombank via any other means.

Techcombank may receive Personal data about you from other third parties

For example:  

• If you choose to interact with third party content or advertising on a Site or in an App, Techcombank may receive personal data about you from the relevant third party, in accordance with that third party’s applicable and legitimate privacy policy.
• If you choose to make an electronic payment directly to Techcombank, or through a Site or an App, Techcombank may receive personal data about you from third parties such as payment services providers, for the purposes of that payment.  
• In complying with its obligations under applicable laws, Techcombank may receive personal data about you from law enforcement agencies and public authorities.
• Techcombank may receive personal data about you from public sources (such as telephone directories, advertisement/flyers, public information on websites, etc.).

Whenever you provide any such personal data, you must ensure that any affected third parties have consented to: (i) the disclosure of their personal data to Techcombank; and (ii) Techcombank’s further Processing of the personal data in accordance with this Statement. If you cannot obtain such consent, please refrain from communicating the personal data to third parties.

Your rights and obligations regarding the personal data that Techcombank collects

Techcombank may assist you in accessing and correcting your personal data held by the Bank.

When you want access to your personal data which we hold, or when you believe that the personal data held by us is inaccurate, incomplete, misleading or not updates, you may ask us through our affiliates or through other channel(s) as we may establish from time to time.

The Bank will, with reasonable efforts, comply with your request to access or correct your personal data upon receipt of a complete, valid request and related processing fee (if any) from you.

Please note that Techcombank may, at its sole discretion, permit the required correction and/or may request additional documentation of new data to avoid fraud and inaccuracies.

Techcombank undertakes to process your data based on your consent for the purposes of this Statement unless otherwise provided by law.

In the event that you become aware of a breach in the processing of your personal data, you have the right to request the Bank to assist in processing, to the extent permitted by the Bank, to prevent or limit your personal data disclosure, unless otherwise provided by law.

Please kindly note that your other rights such as your right to complain, denounce, sue, claim, and defend yourself will be subject to the law, unless otherwise agreed between you and the Bank.

How Personal Data is processed

Techcombank may process your personal data for the following purposes, including but not limited to:

• Provide Techcombank Products/Services to you, including but not limited to analysis and data processing activities to develop, operate, improve and optimize Products/ Services, protecting customer information, preventing fraud/money laundering, terrorist financing, ensuring compliance with internal regulations of Techcombank and competent state management agencies, laws and regulations. domestic and international industry standards in providing banking products/services; and in any other manner that the Bank informs you, at the time of collecting your personal data and/or before starting the relevant data processing or otherwise requested or allowed by applicable law.
• Provide, deploy, implement promotional programs, incentives, manage content and support Customers when participating and using Techcombank Products/Services;
• Consult and introduce products and services of Techcombank and/or trusted partners that have signed cooperation and data security agreements with TCB.

Protection of your Personal Data

Techcombank is committed to processing your personal data in a safe, confidential manner and ensuring your rights to personal data processing activities in accordance with the provisions of the current Law.

We adopt appropriate data processing practices, and appropriate technical and organizational security measures, to protect against unauthorized access, read, use, alteration, disclosure, destruction or other processing of personal data.

The Internet is not, in itself, a secure environment and we cannot provide an absolute assurance that your personal data transferred using the Internet will be secure at all times. Transmission of personal data over the Internet is at your own risk and you should only use secure systems to access Sites, Apps or Devices. You are responsible for keeping your access credentials for each Site, App and Device safe and confidential. You should notify Techcombank promptly if you become aware of any misuse of your access credentials, and immediately change your passwords.

Disclosure of your Personal Data

We will not sell, trade, or rent your personal data to others without obtaining your consent in accordance with Applicable Law. We may share or disclose your personal data to third parties in the following circumstances:

• We may share your personal data with employees and agents of Techcombank, for the purposes set out in this Statement.
• Recipients outside Techcombank, including partners/subcontractors of partners, subsidiaries/affiliated companies of Techcombank and all or any trusted partners having cooperation relationship with Techcombank without Techcombank has agreed on the obligations of Customer data security and data privacy compliance, for the purposes set out in this Statement;
• The partner that Techcombank signs a product distribution agreement with (Techcombank as the partner's institutional agent) for the purpose of providing insurance products according to the needs of the Customer;
• Third-party service providers to help the Bank operate operations, operate websites, applications or devices, provide you with products or services you have selected or to manage activities on behalf of the Bank, such as sending newsletters or surveys, etc.;
• If you pay via websites, apps or pay directly to Techcombank, your personal data may need to be provided to third parties (e.g. payment service providers). payments) for the purpose of supporting such payments;
• In the event of a proposal or completion of the sale, merger or transfer of all or part of the Bank's business or assets (including in the event of a reorganization, dissolution, liquidation or restructuring) or change of control), the Bank may provide your personal data to a potential seller or buyer, or their representative, provided that the Bank has taken reasonable steps, legal first to ensure the safety and security of your personal data;
• Competent state agencies in accordance with the provisions of law and/or as permitted by law.

Third party services

You may encounter advertising or other content on any Site, App or Device that may link to websites or services of Techcombank’s partners, advertisers, sponsors, or other third parties.

We do not control the content or links that appear on these third party websites or services, and we are not responsible for the practices employed by third party websites or services linked to or from any Site, App or Device.

These websites and services may be subject to their own privacy policies and terms of use.

Direct Marketing

As set out in this Statement and in accordance with requirements under Applicable Law, we, our direct marketing partners, or our service providers, may contact you via email, text message, or other electronic means, from time to time, to provide you with information relating to products or services that may be of interest to you.

If you wish to unsubscribe from these communications, we include detailed unsubscribe instructions in each such communication. Alternatively, you may use the unsubscribe features provided through our Sites and Apps. Please note that, in the event that you unsubscribe from receiving communications relating to marketing or advertising, we may nevertheless continue to contact you for the purposes of carrying out your instructions, enabling you to make any request, sending you transactional messages, administration of your account, or as required or permitted by Applicable Laws.

Cookies

When you use or visit our websites, we may place one or more cookies on your device. A “cookie” is a small file that is placed on your device when you visit a website. It records information about your device, your browser and, in some cases, your preferences and browsing habits. We may use this information to recognize you when you return to our websites, to provide personalized services on our websites, to compile analytics in order to better understand website activity, and to improve our websites. You can use your browser settings to remove or block cookies on your device. However, if you decide not to accept, or to block, cookies from our websites, you may not be able to take advantage of all of the features of our websites.

We may process your personal data through cookie technology, in accordance with the provisions of this Statement. We may also use remarketing tags to serve advertisements to people who we know have previously visited our websites

To the extent that third parties have embedded content on our websites (e.g., social media features) those third parties may collect your personal data (e.g., cookie data) if you choose to engage with such third party content, or otherwise use third party services.

Data retention

We will only retain your personal data for as long as we require it in connection with the purposes set out in this Privacy Statement. We may also be required to retain your personal data for additional periods of time, for example, where required to do so by Applicable Laws.

Amendments to this Statement

Techcombank may amend, revise or update this Statement at any time.

Notice of any amendments will be posted on our website and/or other means of communication as we deem appropriate. Techcombank recommends that you regularly monitor this Notice to stay up-to-date with changes and stay informed about how the Bank is protecting your personal data.

Your continued use of products, services or applications is considered that you have read and understood this Statement and its related amendments.

Glossary in this Statement

Applicable Laws means all binding laws, statutes or regulations applicable to Techcombank.

Personal data processing refers to one or multiple activities that impact on personal data, including collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, traceability, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction or other relevant activities.

Third party is an organization or individual that has a written agreement (service contract, cooperation contract) with Techcombank for the purpose of providing goods and services to Techcombank, implementing cooperation agreements with Techcombank. Techcombank, including but not limited to:

• Independent individuals or companies;
• Organizations that Techcombank directly or indirectly owns