Personal Data Collection and Processing Policy.

Summary

Tin & Partners Law Firm ("the Law Firm") receives the contact details and enquiry information that you voluntarily provide through tinpartners.vn, including contact forms, office-service enquiries and the Build Your Vietnam Setup Plan tool, to contact you, clarify your needs, assess the scope of support and send a quotation. When your request concerns a service provided by Tin & Partners Services Company Limited ("Tin & Partners Services"), such as accounting, employment services or office rental, the Law Firm passes the information needed to respond to that request to Tin & Partners Services. In this Policy, "the Company" means each company in respect of the data it processes.

The Company does not trade personal data or use it to send advertising.

1. Personal data controller and processor

The Law Firm is the single point that receives data submitted through the website. Each company determines the purposes and means of processing and directly processes data within the scope of its own services. Each is therefore the personal data controller and processor of that data under Article 2(9) of the Law on Personal Data Protection.

2. Data collected and purposes of processing

The Company processes your name, email address, selected service and enquiry message as required by the form and, where you choose to provide them, your telephone number and company or organisation. Office-service forms may also include your preferred city, area, type of premises, approximate size, budget and timing. The planning tool may include information about investors or accompanying persons, nationality or country of incorporation, intended activities, investment structure, location and your business, work or residence needs. Some information concerns a business; where it relates to an identifiable individual, the Company treats it as personal data. Please provide only the information necessary for the enquiry.

The data is used for the following purposes:

• Contact you to confirm and clarify your legal or business-service requirements, review the enquiry and assess the appropriate scope of support.
• Prepare and send a quotation for the services you request, arrange a discussion and communicate the next steps.

How data moves between the two companies:

• Enquiries about legal advice, investment, corporate matters, contracts, disputes, employment law and personal data are handled by the Law Firm and are not passed to Tin & Partners Services.
• Enquiries about office services, accounting, employment services and other business services are passed to Tin & Partners Services.
• Enquiries about work permits, visas and residence may be handled by either company, depending on the scope of work. We tell you which company is handling your request when we reply or send a quotation.
• Plans submitted through the Build Your Vietnam Setup Plan tool are reviewed in full by both companies to prepare a combined quotation.
• Where a contact enquiry covers both, each company receives only your contact details and the part of the request within its own services.
• Information about a legal matter is not passed to Tin & Partners Services unless you ask for this or agree to it.

The Company does not use the data for other purposes, including newsletters or advertising. Any new purpose requires your separate consent before processing begins.

Providing data is voluntary. Without the contact details and minimum information required for your enquiry, the Company may be unable to contact you or prepare a quotation through the form. You may still contact the Company directly at its office or by telephone.

Please do not submit sensitive information through the forms, such as health information, personal financial information, identity documents or case files. Do not provide another person's personal data unless you are authorised to do so. Such information should be discussed through an appropriate channel after the Company contacts you. Budget or investment estimates requested by a tool should be limited to what is necessary to describe your requirements.

Planning drafts may be stored in your browser on your device so you can continue later. Creating a plan, downloading a PDF or printing does not send the data to the Company. You can remove locally stored data using your browser’s website-data settings. The Company receives a plan only when you actively submit it and the submission confirms success; if submission is unavailable, no enquiry is confirmed as sent.

Submitting a form does not establish a lawyer–client relationship. That relationship arises only when the parties enter into a legal services agreement.

3. Legal basis and consent

The Company processes data on the basis of your consent under the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP, both effective from 1 January 2026.

• How consent is given: you actively select the consent checkbox and initiate the submission. The checkbox is not pre-selected. Silence or failure to respond does not constitute consent. For direct-submission forms, information is processed through the website and email service when you actively submit it; the form displays the sending status. An unconfirmed status does not mean that the Company has received the enquiry. For forms that create an email draft, you review and send the email yourself; creating or copying a draft alone does not send the enquiry to the Company.
• Scope of consent: consent covers only the purposes in Section 2 and is not conditional on agreeing to any other purpose.
• Consent records: where a submission records the consent timestamp, wording or version, these details accompany the enquiry received by the Company and are retained for verification. Information entered only on your device and not submitted is not treated as an enquiry received by the Company.
• Withdrawal of consent: you may withdraw consent at any time using the method in Section 8. The Company will then stop contacting you and processing the data. Withdrawal does not affect processing already carried out.

The website is not intended to collect data from minors. Minors seeking legal assistance should contact the Company through a parent or legal representative.

4. Retention and deletion

The Company retains enquiry data for 12 months from the most recent communication about the enquiry or quotation, after which it deletes the data.

The Company deletes data earlier where:

• You request deletion or withdraw consent; or
• The purposes of contact and quotation have been fulfilled and the data is no longer necessary.

If you enter into a legal services agreement, the data is transferred to the client file. Processing is then governed by the agreement and the record-retention requirements applicable to law practices, and the Company will provide a separate notice.

The Company may retain data for longer where required by law or necessary for an ongoing complaint or dispute. Data is deleted securely to prevent unauthorised recovery.

5. Data sharing and transfers

The Company does not trade personal data. Access is limited to the following parties:

Outside these cases, the Company provides data to another party only with your consent.

The website uses Cloudflare infrastructure. Technical data necessary to serve visits and protect the system may be processed by these infrastructure providers. The locally stored drafts described in Section 2 remain on your device until you actively submit them.

Cross-border transfers: both companies share Microsoft Corporation's Microsoft 365 cloud services for email and document storage, with servers outside Vietnam. Website infrastructure and other necessary technical services may also involve processing outside Vietnam. Each company prepares the required cross-border personal data transfer impact assessment dossier and requires the relevant providers to apply corresponding safeguards. Where you choose an external booking or messaging service, that provider's privacy policy also applies to its processing.

6. Data security

The Company protects data through the following technical and organisational measures:

• Encryption of communications between your browser and the website (HTTPS);
• Access controls that restrict data access to personnel with assigned responsibilities;
• Written confidentiality commitments from lawyers, employees and service providers.

In addition to its obligations under personal data protection legislation, the Company keeps your information confidential under the legislation governing lawyers and the Vietnamese Lawyers' Code of Ethics and Professional Conduct.

In the event of a personal data leak or loss, the Company notifies the specialised personal data protection authority and affected individuals within the period required by law, together with remedial measures.

7. Your rights and obligations

Under Article 4 of the Law on Personal Data Protection, you have the following rights in relation to your data:

• Be informed about personal data processing.
• Consent, refuse consent or request withdrawal of consent.
• View, correct or ask the Company to correct your data.
• Request provision or deletion of data, restriction of processing, or object to processing.
• Make complaints or denunciations, bring legal proceedings and claim compensation as provided by law.
• Ask the Company or a competent authority to take measures to protect your data.

You also have the following obligations:

• Provide complete and accurate contact information;
• Protect your own personal data;
• Respect other people's personal data and do not enter their information without their permission;
• Comply with personal data protection legislation.

8. Exercising rights and making complaints

Send your request to tinduong@tinpartners.vn or in writing to the Company's registered office, stating your full name, the email address used for the enquiry and the details of your request. The Company does not charge a fee and may request identity verification before acting. This contact point handles requests about data processed by either company. Where a request concerns data passed to Tin & Partners Services, the Law Firm forwards it promptly, and both companies meet the time limits below.

Processing periods under Article 5 of Decree No. 356/2025/NĐ-CP:

Completion may take longer where the Company needs a service provider to participate or a one-time extension is required under the applicable rules. The Company will inform you of the reasons.

If you are not satisfied with the Company's handling of your request, please contact the responsible person in Section 1. You may also raise the matter or make a complaint to the specialised personal data protection authority under the Ministry of Public Security through the National Personal Data Protection Portal, or bring proceedings before a competent court.

9. Policy amendments and contact

The Company publishes all amendments to this Policy on the website; the version on this page is the one in force. If the types of data collected or purposes of processing change, the Company will obtain your renewed consent before applying the changes.

For questions about this Policy, contact Công ty Luật TNHH Tín và Thành Viên (Tin & Partners Law Firm), Room 2.01, 2nd Floor, 31C Ly Tu Trong, Sai Gon Ward, Ho Chi Minh City, Vietnam; email tinduong@tinpartners.vn; telephone 028 3838 6989.

Version V1.