Personal data protection Policy (“Policy”) is issued by Phu Hung Fund Management Joint Stock Company Company (“PHFM”, “We”) and is addressed to individuals with whom we interact, including but not limited to: investors, clients, personnel of corporate clients or investors, personnel/employees of PHFM, vendors, or any individual or organization visit our websites (“Sites”) as well as use our services (together, “You”).

This Policy explains the manner in which PHFM collects, utilizes, maintains and processes your personal data in accordance with applicable law.

This Policy applies to your investment (or potential investment) in any funds managed by PHFM your use (or potential use) of any of the other services provided by PHFM, or any relationship (or potential relationship) established between You and PHFM.

This Policy may be amended or updated from time to time to reflect changes in our practices with respect to the Processing of personal data, or changes in applicable law. We encourage you to read this Policy carefully and regularly check this page to review any changes we might make per the terms of this Policy.

2. PROCESSING OF PERSONAL DATA

The processing of personal data is one or more activities affecting personal data, such as: collection, recording, analysis, confirmation, storage, correction, disclosure, combination, access, retrieval, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction of personal data or other related actions.

a. Requirement and necessity of collection and Processing of personal data

We collect personal data about you because, for various purposes set out below, We are required or authorized by law to collect and process it. There are laws applicable to fund management companies, which require us to collect and process your personal data. For example, we require your personal data to verify your identity under the regulations on securities and anti-money laundering law of Vietnam. If you do not provide your personal data to us, we are not able:

• Provide you with a requested service or perform your instructions/requests;
• Maintain our provision of services to You;
• Perform the contractual rights and obligations in accordance with the agreements entered into between PHFM and You;
• Verify your identity (including for the purpose of protection of your confidential information);
• Provide You with necessary information related to your investment during the course of our provision of services to You;
• Personalize your experience with us; or
• Inform You of our products and services that may be of your interest or needs.

b. Personal data that We may process

Personal data is information in the form of symbols, letters, numbers, images, sounds or the like on an electronic medium that is associated with a particular person or helps to identify a particular person. Personal data that we may process are basic personal data and sensitive personal data in accordance with applicable law.

Basic personal data information includes:

• Basic information: surname, middle name and birth name, other names (if any); date of birth; date of dead or missing; gender; place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence, hometown, contact address; nationality; the image of the individual; phone number, identification number/passport number and its place and date of issuance, photos of identity card, passport; tax code; social insurance number; and health insurance number;
• Marital status; family relationship (parents, children);
• Information about the individual’s digital account; personal data reflecting activities, history of activities on cyberspace;
• Occupation, title, income and sources of your investment funds;
• Contact details such as telephone number, email address, residential address, and contact address;
• IP address, logs, online identifiers, device IDs, and geolocation;
• Bank account details, transaction details; and
• Other information that may be required or necessary for PHFM to provide its services to You or to exercise/perform relevant contractual rights/obligations in accordance with applicable law.

Sensitive personal data is personal data associated with an individual’s privacy that, when violated, will directly affect an individual’s legitimate rights and interests, including:

• Political views, religious views;
• Health status and private life recorded in medical records, excluding blood type information;
• Information related to racial or ethnic origin;
• Information about an individual’s inherited or acquired genetic characteristics;
• Information about the individual’s physical attributes and biological characteristics;
• Information about an individual’s sex life and sexual orientation;
• Crime and criminal data collected and stored by law enforcement agencies;
• Customer information of credit institutions, foreign bank branches, payment intermediary service providers, and other authorized organizations, including customer identification information as prescribed by law, account information, deposit information, information about deposited assets, transaction information, information about organizations and individuals who are guarantors at credit institutions, payment service providers and branches;
• Personal location data identified through location services;
• Other personal data that is required by law to be specific and require necessary security measures.

During the course of our relationship with You, We may collect and process additional personal data about You, subject to your consent or as required or permitted under applicable laws.

c. Collection of personal data

We collect personal data about You from a variety of sources as follows:

• We obtain your personal data when You provide it to us (e.g., via the account opening form and other documentation).
• We collect your personal data in the ordinary course of our relationship with you (e.g., in the course of managing your transactions or your investment in our funds).
• We receive your personal data from third parties who provide it to us (e.g., your employer; the organizations or individuals that you act as their authorized representatives or contacts) our customers/vendors; recruitment agencies; law enforcement authorities).
• We receive your personal data from third parties service providers, where you purchase any of our products or services through such third parties or where you are referred to us by such third parties (e.g., our fund certificate distribution agents; transfer agents; custodians; paying agents).
• We obtain your personal data from other sources as permitted by law for the purposes of verification of the information provided by you (e.g., the national population database, your employers).
• We collect or obtain personal data when you visit any of our Sites or use any features or resources available on or through a Site. When you visit a Site, your device and browser may automatically disclose certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site and other technical communications information), some of which may constitute Personal.

d. Purposes for which we may process your personal data

The purposes for which we may process your personal data are:

• Fulfilling the regulatory compliance obligations before client onboarding, including ‘Know Your Client’ checks and other required processes in accordance with applicable laws and our internal policies and procedures;
• Provide our financial professional services to you including fund management services, investment advisory services and portfolio management services;
• Processing your trade orders and investment instructions as well as the performance of tasks necessary for our provision of the requested services;
• Provide customer care services;
• Provide information on funds/services managed/provided by PHFM;
• Communicating with you via any means (eg. email, telephone, text message, social media, post or in person) subject to ensuring that such communications are provided to you in compliance with applicable law; and maintaining and updating your contact information where appropriate;
• Introducing new products and services provided by PHFM;
• Performing contractual rights and obligations in accordance with the agreements entered into between PHFM and you;
• Operation and management of our Sites; providing content to you; displaying advertising and other information to you; and communicating and interacting with you via our Sites;
• Management of our communications systems; operation of IT security; and IT security audits;
• Physical security of our premises (including records of visits to our premises and CCTV recordings); and electronic security (including login records and access details, where you access our electronic systems);
• Detecting, investigating and preventing breaches of policy, and criminal offenses, in accordance with applicable law;
• Establishing, exercising and defending legal rights;
• Complying with the legal and regulatory obligations applicable to fund management companies in accordance with applicable law; and
• Other lawful purposes in accordance with applicable law.

3. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

We may share and disclose your personal data to:

• Other entities within the Phu Hung group, for legitimate business purposes (including providing services to you and operating our Sites);
• Our vendors, service providers, partners (e.g. supervising banks, custodian banks, fund administrators, transfer agents, paying agents, HR service providers, cloud services providers) located anywhere in the world for processing of personal data by such vendors/service providers/partners for the processing purposes mentioned in this Policy; and
• State authorities, other organizations and individuals as required under or permitted by any applicable law or State authorities.

If We engage a third-party processor to process your personal data, the processor will be subject to binding contractual obligations to: (i) only process the personal data in accordance with our prior written instructions; and (ii) use measures to protect the confidentiality and security of the personal data; together with any additional requirements under applicable law.

Our Sites, application may use third-party plugins or content. If you choose to interact with any such plugins or content, your personal data may be shared with the third-party provider of the relevant social media platform. We recommend that you review that third party’s privacy policy before interacting with its plugins or content.

4. INTERNAL TRANSFER OF PERSONAL DATA

Transfer of personal data abroad is an activity using cyberspace, equipment, electronic means or other forms of transferring personal data of Vietnamese citizens to a location outside the territory of The Socialist Republic of Vietnam. The Socialist Republic of Vietnam or use a location located outside the territory of the Socialist Republic of Vietnam to process the personal data of Vietnamese citizens.

We may need to transfer your personal data within the Phu Hung Group, or our management in overseas and to third parties as noted in Section 3 above, in connection with the purposes set out in this Policy. For this reason, we may transfer your personal data to other countries outside Vietnam and when we transfer your personal data to other countries, we do so in compliance with the required procedures and requirements under applicable laws.

5. DATA PROTECTION

The protection of your personal data is important to us and therefore We have implemented appropriate technical and organizational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other unlawful or unauthorized forms of Processing, in accordance with applicable law. These could include:

• Applying up-to-date electronic security systems, such as firewalls and data encryption on our processing systems;
• Maintaining necessary and appropriate data security policies and procedures;
• having and implementing data security and confidentiality requirements and regular training for our employees;
• Ensuring access to personal data is granted and permitted to authorized persons only;
• Requesting third-party service providers, vendors, and partners to apply and satisfy our privacy Requirements and standards and to comply with applicable law; and
• Conduct regular checks and verification of the data processing safety and apply appropriate measures to prevent potential incidents in the course of processing personal data.

However, in practice, the Processing of personal data via electronic systems, the internet and other information technology solutions may not be completely secured without any potential risks. Although we always try our best to ensure and protect your personal data, we are not able to guarantee complete and perfect security when your personal data is processed and transmitted to our system or a third-party service provider’s system that you may use. Therefore, you are responsible for ensuring that any personal data that You send to us is sent securely. Furthermore, We recommend You take the necessary steps to protect your personal data (including your account and trading information) and not accidentally share or disclose such information to any unauthorized persons.

6. DATA ACCURACY

We take reasonable steps designed to ensure that:

• Your personal data that We process are accurate and, where necessary, kept up to date; and
• Any of your Personal Data that we Process that are inaccurate (having regard to the purposes for which they are Processed) are erased or rectified without delay. From time to time We may ask You to confirm the accuracy of your Personal

7. DATA MINIMISATION

We take reasonable steps designed to ensure that the personal data that we Process is limited to the personal data reasonably required in connection with the purposes set out in this Policy.

8. DATA RETENTION

We take reasonable steps to ensure that your personal data are only processed for the period necessary for the purposes set out in this Policy (including for PHFM’s provision of requested services to you) or as required by law (including any regulatory period during with PHFM, its vendors and service providers perform their obligations on the retention of information as required by law), whichever is longer.

9. YOUR LEGAL RIGHTS AND OBLIGATIONS

Subject to applicable law, You may have a number of rights regarding the Processing of your personal data, including:

• The right to request access to or copies of, your personal data that we process or control, together with information regarding the nature, processing and disclosure of those Personal Data;
• The right to request rectification of any inaccuracies in your Personal Data that we process or control;
• The right to request:

– Erasure of your personal data that we process or control unless otherwise requested by law; or

– If our personal data processing is subject to your consent in accordance with applicable law:

+ Restriction of Processing of your personal data that we Process or control;

+ Objection to the Processing of your Personal Data by us or on our behalf (including for marketing purposes); or

+ Withdraw your consent; and

• The right to lodge complaints with a competent State authority in accordance with applicable law.

To exercise one or more of these rights, or to ask a question about these rights or any other provision of this Policy, or about our processing of your personal data, please use the contact details provided in section 12 below.

• When you provide personal data to us for processing in accordance with this Policy, You are responsible for:

– Ensure the accuracy of the provided personal data;

– Timely informing us of any changes to the provided Personal Data; and

– Complying with all requirements applicable to your provision of personal data in accordance with applicable law.

10. INFORMATION SHARING AND REPORTING

We may process your personal data to contact You, primarily by email and also on occasion by telephone, so that we can share you with information concerning our products and services that may be of interest to You, in accordance with applicable law.

If You do not wish to receive such communications from us you can opt-out at any time by contacting your regular contact, or by electronically unsubscribing from emails we have sent to you. After you unsubscribe, we will not send you further promotional emails, but we may continue to contact you to the extent necessary for the purposes of any services you have requested from us.

11. GENERAL TERMS

This policy is effective as of July 1, 2023. This Policy may be amended from time to time and updated on our Website. Your continued use of the service after the notice period of amendments and supplements from time to time means that You have accepted such amendments and supplements by us.

Each Party has fully understood and agreed that this Policy is also the notice of personal data processing specified in Article 13 of Decree 13/ND-CP/2023 on the protection of personal data and is amended and supplemented from time to time before PHFM conducts personal data processing. Accordingly, PHFM does not need to take any further measures for the purpose of notifying you of the processing of personal data.

This policy is interpreted and governed by the laws of Vietnam.

This Policy represents the entire policy between the Parties and supersedes any prior understanding or policy, written, oral or otherwise with respect to the matters mentioned above.

To protect personal data per the law, this Policy will also apply to contracts, agreements, documents, etc. between the Parties that are signed before, during and after the effective date of this Policy.

In the event any provision of this Policy is found by a court of competent jurisdiction to be invalid, that provision shall automatically be void and no longer binding upon the Parties, however such judgment shall not invalidate the remaining provisions of this Policy, and such provision shall remain in full force and effect.

12. CONTACT DETAILS

If you have any questions or concerns about any of the information in this Policy, or any other issues relating to the processing of personal data by PHFM, please contact your regular PHFM client service contact or our official customer service channels at:

• Phone: 028. 54137991 – Ext: 0 (from 9:00 AM – 5:00 PM Monday to Friday)
• Email: cskh@phfm.vn