Personal data policy

1. Purpose of personal data processing

☐ Collect, evaluate and store personal information relevant to determining whether to establish a commercial relationship and conclude, maintain, manage and perform insurance contract.

☐ Underwrite, conclude, perform, maintain, manage insurance contract (including modification and update)

☐ Share, transmit and provide information of data subject to third parties (including overseas parties) if necessary (including to fulfill obligations of relevant Laws and international Treaties, etc.)

☐ Analyze information for the purpose of providing insurance products and other related services, developing new products and services or improving existing ones (transactions related to statistical processing, civil handling, dispute settlement, credit transactions)

☐ Update or correct the data subject's information;

☐ Insurance event investigation (including insurance fraud investigation) and insurance claim underwriting and payment.

☐ Implement subrogation after payment of insurance claim and recovery activities.

☐ Implement other purposes related to business operations of the company.

2. Types of personal data allowed to be processed

▣ General personal data

◦ Surname, middle name, birth name, and other name (if any);

◦ Date, month, year of birth; date, month, year of dead or missing;

◦ Gender

◦ Place of birth, place of birth registration, place of permanent residence, place of temporary residence, current residence, hometown, contact address;

◦ Nationality

◦ Education level, information, email address;

◦ Personal images

◦ Phone number, identification number, personal identification number, passport number, driver's license number, personal tax code, marital status;

◦ Information about family relationships (parents, children);

◦ Personal’s digital account information; personal data reflecting activities, history of activities on cyberspace;

◦ Other information associated with a person or used to identify a particular person.

▣ Sensitive personal data

◦ Biometric (fingerprint) information, employment status including at new workplace (if applicable), income, monthly repayment obligations, monthly expenses and living costs, credit information during past and present at credit institutions, loan information to be disbursed at credit institutions, information about deposit assets;

◦ Personal information at credit institutions, foreign bank branches, payment intermediary service providers, and other authorized organizations, including: customer identification information as prescribed by laws, information on accounts, information on deposits, information on deposited assets, information on transactions, information on organizations and individuals as guarantors at credit institutions, bank branches, payment intermediary service providers;

◦ Other personal data required by law is unique and requires necessary security measures.

3. Subject performing data processing:

☐ Seoul Guarantee Insurance Company and Seoul Guarantee Insurance Company Hanoi Branch (“SGI Hanoi”) shall assume the role of a controller and/or controller cum processor of personal data of the data subject

☐ Third parties designated by SGI Hanoi to process the personal data for the purpose of underwriting, signing, maintaining, managing and implementing insurance contract

☐ relevant authorities in Vietnam, organizations or individuals requesting personal information in accordance with Vietnamese laws and regulation.

4. Rights and obligations of data subject

☐ Unless otherwise provided by law, data subject has the following rights in relation to personal data: right to know, right to consent, right to access, right to withdraw consent, right to delete personal data, right to request restriction of processing, right to provide data, right to object to data processing, right to complain, denounce, sue, right to claim damages, and the right to self-defense in accordance with the legal provisions on protection of personal data.

☐ Withdrawal of consent must be sent in writing by the data subject with valid signature and seal (if any) to SGI Hanoi (direct or via postal service). Withdrawal of consent will not affect the legality of the data processing that was agreed prior to the withdrawal of consent.

☐ Data subject has the following obligations in relation to personal data: to protect their own personal data; request other relevant organizations and individuals to protect their personal data; respect and protect the personal data of others; fully and accurately provide personal data when agreeing to allow the processing of personal data; participate in propagating and disseminating personal data protection skills; comply with the provisions of the law on protection of personal data and participate in the prevention and combat of violations of regulations on personal data protection.

5. Data processing method:

☐ Collect and access personal data provided by the data subject for evaluation, analysis and/or sharing with third parties (including overseas parties).

☐ Edit, retrieve, revoke, encrypt, decrypt, copy, transfer, delete, destroy personal data.

☐ Store, search and combine data provided within SGI Hanoi to process for underwriting, conclusion, maintenance, management and performance of other insurance contracts, deletion of personal data at the end of the data processing period, provide it to a third party or transfer it to the required location for the conclusion, maintenance, management and performance of insurance contract.

☐ Disclose the data subject’s personal data to the following individuals, companies and organizations in accordance with the relevant Vietnamese laws and regulation.

 - The Credit Information Center of Vietnam (CIC) or any other authority or body established by the State Bank of Vietnam or any other authority having jurisdiction over SGI Hanoi

 - Any rating agencies, insurer or insurance broker or direct or indirect provider of credit protection;

 - Any credit reporting agencies or credit reference agencies;

 - Any other individuals, companies and/or organizations that in a specific situation, the purpose of such disclosure is permitted or required by relevant applicable laws.

6. Information of other organizations and individuals related to the purpose of personal data processing

☐ SGI Hanoi may collect information from the following agencies, organizations and units that have been storing or knowing information of data subject; agencies, units, organizations and individuals that SGI Hanoi considers necessary to be used for the purpose of processing personal data during underwriting, signing, maintaining, managing and implementing insurance contract.

 - From the State Bank of Vietnam, the Credit Information Centre (CIC) or other competent authorities in Vietnam or overseas;

 - From credit information organizations, credit reference agencies and Government agencies, or from publicly available sources, directories or registries;

 - From other third parties’ sources, which Customer consents to and authorizes for the SGI Hanoi to collect; and/or From other sources permitted or required under the laws.

7. Adverse results and damages related to data processing

☐ The conclusion of an insurance contract will not be possible without consent to the processing of this personal data. Based on the results of the information processing, SGI Hanoi reserves the right to refuse or continue to sign the insurance contract.

☐ Information leakage is a possible risk during information processing, but SGI Hanoi has prepared appropriate internal controls to prevent such incidents.

8. Data processing duration (start and end date):

☐ From the date of submission of Consent to personal data processing until 5 years after completing the insurance contract transaction.

☐ In the event of a dispute over an insurance contract that takes a longer time to resolve than specified in the above clause, data processing duration will be extended until the dispute is resolved.