PRIVACY POLICY

(Personal Data and Information Protection Policy – DeliEdu Platform)

This Privacy Policy (the “Policy”) is issued by DELI VIETNAM INFORMATICS SERVICES CO., LTD (Công ty TNHH Dịch vụ Tin học Deli Việt Nam; hereinafter “DeliVN”, the “Company” or “DeliEdu”), with its address at 791/21/2/13, Tran Xuan Soan, Khu Pho 4, Tan Hung Ward, Ho Chi Minh City, Vietnam. DeliVN owns and operates the online education platform at the website deliedu.vn (the “Platform” or “deliedu.vn”).

DeliEdu places the protection of Users’ information and personal data at the highest priority and strictly complies with the 2015 Civil Code, Decree No. 13/2023/ND-CP on Personal Data Protection, and other relevant laws of Vietnam.

This Policy helps Users and related parties clearly understand:

• The scope, types of data, and purposes of collecting and processing personal data;

• How data is secured, shared, and transferred;

• The data retention period and the rights and obligations of Users;

• The collecting/managing entity and the mechanism for receiving and resolving complaints.

I. GENERAL PROVISIONS

1.1. Definitions

• “DeliEdu” / the “Company”: Deli Vietnam Informatics Services Co., Ltd – owner of the DeliEdu Platform.

• “User” / “You”: an individual/organization that accesses, registers for, or uses DeliEdu’s products and services, including Learners, Instructors, and Organizations (Enterprises/Schools).

• “Personal Data” (PD): information in the form of symbols, letters, numbers, images, sound, or similar forms in the electronic environment that is associated with or helps to identify a specific individual; includes basic PD and sensitive PD.

• “Data Subject”: the individual to whom the Personal Data relates.

• “Processing of PD”: one or more activities affecting PD, such as collection, recording, storage, modification, disclosure, combination, access, retrieval, encryption, sharing, transmission, transfer, deletion, or destruction.

• “Third Party”: any individual or organization other than DeliEdu and the User.

1.2. DeliEdu’s role in data processing

Under Decree No. 13/2023/ND-CP, DeliEdu’s role is determined as follows:

• For B2C Customers (individual Learners, Instructors): DeliEdu is the Personal Data Controller and Processor, directly determining the purposes and means of processing.

• For B2B Customers (Enterprises, Schools, Organizations): the B2B Organization is the Data Controller of the data of its own staff and learners; DeliEdu acts as the Data Processor under authorization and within the scope of the service contract between the two parties.

1.3. Scope of application and updates to the Policy

This Policy is published on the Platform and applies to all Users. It is an integral part of the Terms of Use and other agreements between the User and DeliEdu.

DeliEdu may update, amend, or supplement this Policy from time to time. For material changes affecting Users’ rights, DeliEdu will give prior notice via the Platform, email, or an appropriate channel within a reasonable period before such changes take effect. Continued use of the services after the changes take effect constitutes acceptance of the updated content.

By registering for or using the services, signing a contract, or consenting to DeliEdu processing PD, the User confirms that they have read, understood, and accepted the entire content of this Policy.

II. COLLECTION AND PROCESSING OF PERSONAL DATA

2.1. Types of personal data collected

a) Basic personal data:

• Full name (including any other names); date of birth; gender; nationality; place of birth, permanent/temporary residence, contact address;

• Phone number, email; ID card/citizen ID/personal identification number; profile picture;

• Username, password (encrypted/securely hashed);

• Payment information: transaction history, personal tax code, beneficiary bank account/e-wallet number (only the secure payment Token is stored; card details are not stored directly);

• For Instructors: teaching experience, qualifications, professional certificates;

• Learning data: lecture viewing history, test/exam results, certificates issued, interactions/comments in class, course purchase history.

b) Data of B2B Customers (Organizations):

• Organization information: company/school name, tax code, head-office address, operating license (if any);

• Information of the representative/system administrator (Admin): full name, position, phone number, work email;

• Data provided/uploaded by the B2B party: list of learner accounts (full name, learner code, class), learning results, internal training history.

c) Automatically collected data:

• IP address, device type, operating system, browser; cookie data; location data (if enabled);

• Data reflecting the User’s activities and activity history in cyberspace.

d) Sensitive personal data:

DeliEdu does not proactively collect sensitive PD (political/religious views, racial/ethnic origin, health status, biometric data, location data, etc.). Where collection is unavoidable to provide a service, DeliEdu will clearly notify and only proceed with the Data Subject’s consent in accordance with the law.

DeliEdu undertakes to collect only the PD necessary for the purposes set out in Section 2.3 and not to collect data without the Data Subject’s consent, unless otherwise provided by law.

2.2. Methods of data collection

• Directly from the User’s declarations on the website/application upon registration, transactions, or surveys;

• Lawfully transferred by the B2B Organization (for learners/staff belonging to the organization);

• Automatically via cookies and analytics tools when the User accesses the Platform;

• From DeliEdu’s lawful service providers and partners supporting infrastructure, payment, and marketing.

2.3. Purposes of data processing

DeliEdu processes PD only for the following lawful purposes:

• Service provision: creating, maintaining, and managing accounts; granting access to lectures and courses; managing classes; issuing electronic certificates.

• Transaction and payment processing: verifying course purchase/renewal transactions; issuing invoices (VAT).

• User support and care: receiving and handling requests, complaints, and technical issues for both Admins (B2B) and Learners (B2C).

• Personalization and service improvement: analyzing learning behavior (anonymized where possible) to upgrade the interface, features, and lecture quality.

• Security and safety: identity verification, detection and prevention of fraud, cracking, impersonation, and system attacks.

• Communications and Marketing (only with consent): sending information on new courses, promotions, and events relevant to the User.

• Legal compliance: collecting, storing, and providing information at the lawful request of competent state authorities, and fulfilling reporting and retention obligations as required.

2.4. Data processing principles

• PD is processed only with the Data Subject’s consent, clearly expressed (in writing, by voice, by ticking a consent box, or by consent settings), unless otherwise provided by law;

• Processing for the notified purposes, lawfully, within the necessary scope, and in accordance with the laws of Vietnam;

• Applying and updating appropriate technical and organizational measures to ensure data security;

• Complying with regulations on the protection of children’s data and PD protection laws from time to time.

2.5. Data retention period

PD is stored only for as long as necessary for the processing purpose. DeliEdu will retain data until one of the following occurs (whichever comes first):

• DeliEdu receives a valid deletion request from the Data Subject (or from the B2B Admin for the organization’s internal accounts);

• The account has been inactive for 24 consecutive months, or the B2B service contract has fully terminated and all financial obligations and tax finalization have been completed.

After the retention period ends, PD will be deleted or anonymized, except where the law requires continued storage (tax, accounting, or authority-related obligations).

III. SHARING AND TRANSFER OF DATA

3.1. Sharing data with third parties

DeliEdu undertakes not to sell, lease, or trade Users’ PD to third parties for independent commercial purposes. DeliEdu shares data only in the following cases:

• Infrastructure and service providers: Cloud Server providers, payment gateways, technical partners, marketing and customer-care partners that have signed confidentiality commitments and process data only within the scope of the contract.

• Course-providing partners: sharing necessary learning data to improve teaching content (excluding email and personal account information).

• Between the B2B party and its learners: the learning results and attendance data of learners belonging to an organization are displayed only to that B2B management unit.

• Competent authorities: upon a lawful written request from a court, procedural authority, the police, or a state management agency in accordance with legal procedures.

3.2. Cross-border transfer of personal data

To carry out the purposes set out in this Policy, DeliEdu may store or transfer PD to third parties located in Vietnam or abroad (including cloud-computing storage solutions).

When transferring PD abroad, DeliEdu completes all procedures required by the laws of Vietnam (including preparing a Cross-Border Personal Data Transfer Impact Assessment Dossier) and requires the receiving party to ensure equivalent safety and security for the transferred PD.

IV. RIGHTS AND OBLIGATIONS OF USERS

4.1. Rights of the Data Subject

Under Decree No. 13/2023/ND-CP, Users have the following rights (unless otherwise provided by law):

• Right to be informed: to know about the processing of their PD.

• Right to consent / withdraw consent: to agree or refuse, and to withdraw consent given; withdrawal does not affect the lawfulness of prior processing.

• Right to access and rectify: to view and request correction of their PD.

• Right to erasure: to request deletion of PD. Note for B2B accounts: deleting a learner account must be confirmed or carried out by the Admin of the organization owning the service package.

• Right to restrict processing: to request restriction of PD processing; DeliEdu performs this within 72 hours of receiving a valid request.

• Right to data portability: to request that DeliEdu provide them with their PD.

• Right to object to processing: to object to the disclosure or processing of PD for advertising and marketing purposes; DeliEdu performs this within 72 hours of receiving the request.

• Right to complain, denounce, and initiate lawsuits: in accordance with the law.

• Right to claim compensation and right to self-protection: in accordance with applicable law.

Users exercise the above rights by sending a written/email request to the contact point in Section X.

4.2. Obligations of Users

• Provide truthful, accurate information and update it promptly upon change; bear responsibility for damage caused by inaccurate information due to their own fault;

• Keep their account and password confidential; not share login information; promptly notify DeliEdu upon detecting any abnormality;

• Not commit fraud, distribute malware, hijack accounts, or unlawfully interfere with the system;

• For B2B Customers: ensure that the collection and transfer of PD of their officers, employees, and learners to DeliEdu has the lawful consent of the data subjects under Decree 13;

• When providing a third party’s PD, ensure the lawful consent of that party has been obtained and bear responsibility for the lawfulness of such consent.

V. SECURITY AND INCIDENT RESPONSE

5.1. Security measures

• Encryption of transmitted data using the SSL/TLS protocol;

• User passwords are strictly hashed;

• Internal access control: only authorized personnel may access customer data;

• Firewalls and continuous network-security monitoring to prevent attacks.

5.2. Incident response and breach notification

In the event of a security incident posing a risk of PD disclosure or loss, DeliEdu will apply timely remedial measures; notify the competent authority (the Ministry of Public Security) within 72 hours of detection in accordance with Decree No. 13/2023/ND-CP; and notify affected Users to cooperate in preventing damage.

DeliEdu is not liable for damage arising directly from a User providing inaccurate or falsified information or from the User exposing their own account information.

VI. PROTECTION OF CHILDREN’S DATA

DeliEdu places particular importance on protecting children’s PD. Under Vietnamese law, a child is a person under 16 years of age (2016 Law on Children). Processing of a child’s PD is carried out on the basis of the consent of both the child (aged 7 and above) and the parent or legal guardian in accordance with Decree No. 13/2023/ND-CP.

For Users who are children, DeliEdu applies enhanced protection measures:

• Collecting only the minimum PD necessary to operate the Platform;

• Not sending marketing/promotional emails and not using children’s PD for personalized advertising;

• Parents or legal guardians may request access to, correction, or deletion of the child’s data and report any abuse; such requests are handled within 72 hours as required.

DeliEdu will verify age and immediately delete a child’s PD if it detects collection without the valid consent of a parent or legal guardian. Any report may be sent to the contact point in Section X.

VII. UPDATING PERSONAL DATA

Users may review, update, and amend their PD as follows:

1. Log in to your account on deliedu.vn;

2. Select “Account information” → “Account management”;

3. Update personal information: select “Update” to edit details, or “Save” when changing the password.

VIII. COOKIE POLICY

8.1. What are cookies?

Cookies are small text files stored on your device when you access the Platform. Cookies help DeliEdu recognize your device, remember your preferences, keep you logged in, remember your learning path, and improve the user experience.

8.2. What types of cookies does DeliEdu use?

a) Strictly necessary cookies (mandatory) – required for the Platform to function correctly and cannot be turned off:

b) Analytics cookies (Google Analytics) – measure traffic, page views, and interactions to improve the Platform:

c) Advertising/marketing cookies (activated only with your consent) – personalize content and measure advertising effectiveness:

8.3. Legal basis and consent

Strictly necessary cookies are applied by default to ensure the Platform’s basic functions. For analytics and advertising/marketing cookies, DeliEdu activates them only when you consent through the cookie banner shown on your first visit. You may change or withdraw your choice at any time.

8.4. How to control and delete cookies

You have the right to accept or reject each type of cookie (necessary, analytics, advertising) through the cookie management tool on the Platform, or by changing your browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data.

• Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data.

• Microsoft Edge: Settings → Cookies and site permissions.

• Safari (macOS): Preferences → Privacy → choose how to block or allow cookies.

Note: blocking strictly necessary cookies may cause some functions to work incorrectly (e.g., losing the logged-in state).

8.5. Cross-border data transfer via cookies

Some third-party cookies (e.g., Google Analytics) may transfer data to providers whose servers are located abroad. Such transfers are carried out in accordance with Section 3.2 of this Policy.

8.6. Changes to the Cookie Policy

DeliEdu may update this Cookie Policy from time to time. Any changes will be posted on the Platform and take effect immediately upon publication. For any questions regarding cookies, please contact: info@deliedu.vn.

IX. RECEIPT AND RESOLUTION OF COMPLAINTS

• How to submit: the User sends a written/email complaint to the contact point in Section X, clearly stating the violation and attaching evidence.

• Handling process: DeliEdu verifies, reviews the system, responds, and guides the steps to restore and re-secure the information.

• Resolution time: no later than 15 (fifteen) working days from the date of receiving a valid complaint.

X. CONTACT INFORMATION

For any questions, requests to exercise Data Subject rights, or reports on information security, please contact DeliEdu’s Personal Data Protection Department:

Deli Vietnam Informatics Services Co., Ltd

Address: 791/21/2/13, Tran Xuan Soan, Khu Pho 4, Tan Hung Ward, Ho Chi Minh City, Vietnam

Email: info@deliedu.vn

Website: deliedu.vn

Version: 1.0