PERSONAL DATA PROTECTION POLICY

 

1. Introduction

This Personal Data Protection Policy (“Policy”) outlines how Vong Tron Do Company Limited (“CKVN”) Processes the Personal Data provided by Customers. Any updates to this Policy will be posted on CKVN’s Website and Application.

2. Definitions

2.1. “Customer/You”: Any individual who provides Personal Data to CKVN when searching, accessing, purchasing Products or Services.

2.2. “Platform”: CKVN’s mobile applications (“Application”) and/or website (“Website”).

2.3. “Products, Services”: Goods and services provided by CKVN as described on CKVN’s Platform.

2.4. “Personal Data”: Information in the form of symbols, letters, numbers, images, sounds, or similar electronic formats that is associated with or helps identify a specific Customer. Personal Data includes Basic Personal Data and Sensitive Personal Data.

2.5. “Basic Personal Data” includes:

• Full name, middle name, birth name, and aliases (if any);
• Date, month, and year of birth; date, month, and year of death or disappearance;
• Gender;
• Place of birth, registered birth location, permanent residence, temporary residence, current address, hometown, and contact address;
• Nationality;
• Personal images;
• Phone number, personal identification number (ID), passport number, driver’s license number, and vehicle license plate number;
• Marital status;
• Email address; IP address; Product/Service feedback, complaints, repair requests, troubleshooting data, and other usage information;
• Online activity data and history, including data related to websites/social media/Applications; technical data (device type, operating system, browser details, IP address, language, connection timestamps, usage statistics, configurations, and other technical communications); account names, passwords, secure login details, usage data, cookies, and browsing history;
• Other information associated with or helping identify a specific Customer that does not fall under Sensitive Personal Data.

2.6. “Sensitive Personal Data”: Personal Data linked to a customer’s privacy which, if violated, directly harms their legitimate rights and interests, including:

• Geolocation data via tracking services;
• Credentials (usernames, passwords) for electronic identification accounts; images of National ID cards or Citizen ID cards;
• Credentials for bank accounts; bank card details and transaction history; financial, credit, transaction, securities, and insurance data at credit institutions, foreign bank branches, payment intermediaries, and other authorized organizations;
• Behavioral data and tracking of telecommunications, social media, online media, and cyberspace service usage;
• Other personal data classified by law as confidential or requiring strict security measures.

2.7. “Processing of Personal Data” (or “Processing“): One or more operations performed on Personal Data, such as collection, recording, analysis, verification, storage, modification, disclosure, combination, access, retrieval, recovery, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction, or other related actions.

2.8. “Personal Data Controller”: The organization or individual that determines the purposes and means of Processing Personal Data.

2.9. “Personal Data Processor”: The organization or individual that Processes Personal Data on behalf of the Personal Data Controller under a contract.

2.10. “Personal Data Controller and Processor”: The organization or individual that simultaneously determines the purposes, means, and directly Processes Personal Data.

2.11. “Contract”: Any contract, agreement, terms, conditions, or other documents executed between You and CKVN in accordance with the law.

3. Methods of Data Collection

3.1. Via Website: CKVN may collect Personal Data when You access CKVN’s Website or use any features or resources available on or through the Website. CKVN collects information about Your device and browser (e.g., device type, operating system, browser type, browser settings, IP address, language settings, connection timestamps, and other technical communications).

3.2. Via Application: CKVN may collect Personal Data when You download or use the Application. The Application may record certain information (e.g., Application usage statistics, device type, operating system, Application settings, IP address, language settings, connection timestamps, and other technical communications).

3.3. Via Communications: CKVN may collect Personal Data through interactions between CKVN and You (in person, by mail, telephone, online, call center systems, electronic communications, or any other means), including Customer surveys.

4. Types of Data Collected and Processed

The Personal Data processed includes data provided by You when searching, accessing, or registering for Products and Services, as well as data generated during Your purchase of Products and Services, use of the Platform, or interaction with CKVN. Such data includes:

(i) Basic Personal Data as specified in Section 2 of this Policy; and

(ii) Sensitive Personal Data as specified in Section 2 of this Policy.

5. Purposes of Processing Personal Data

CKVN may Process your Personal Data for one or more of the following purposes:

5.1. Account & Transaction Processing: Reviewing and processing account registration applications, and executing transactions with You, including but not limited to purchasing Products/Services, participating in promotions, and receiving rewards.

5.2. Platform & Account Management: Managing and administering Your use of and/or access to the Platform, Your preferences, and Your account relationship with CKVN.

5.3. Order Fulfillment & Support: Responding to, processing, or completing transactions and/or fulfilling Your requests for Products and Services, including handling inquiries or complaints.

5.4. Service Notifications: Notifying You of Product/Service issues and unusual account activities.

5.5. Policy Enforcement: Enforcing CKVN’s terms of service or any applicable agreements and terms of use on the Platform.

5.6. Software Maintenance: Maintaining and managing software/application updates.

5.7. R&D and Analytics: Conducting research, analysis, and development activities (including data analysis, surveys, and Product/Service profiling) to analyze Your usage, thereby improving Products, Services, and/or user experience.

5.8. Marketing & Promotions: Conducting advertising, marketing, and promotional activities related to Products and Services (including third-party products/services partnered with CKVN). You may periodically receive SMS, push notifications, and emails regarding new products/services, special promotions, and upcoming events (e.g., contests, anniversaries). CKVN may also conduct surveys to seek Your feedback on current or potential services.

5.9. Loyalty Program: Tracking purchases to calculate loyalty points and upgrade membership tiers (e.g., Silver, Gold) in accordance with general policies, enabling You to enjoy tier-specific benefits and privileges.

5.10. Statistical & Risk Analysis: Performing statistical analysis on trends, adjusting Products/Services, and conducting risk and cost assessments regarding Platform operations.

5.11. Legal Compliance: Complying with legal proceedings, applicable laws, and requests from competent state authorities.

5.12. Internal Record-Keeping: Compiling statistics and research for reporting requirements and/or internal record-keeping.

5.13. Other Consent-Based Purposes: Any other purpose notified to You at the time of obtaining Your consent.

6. Methods, Timeline, and Storage of Personal Data

6.1. Processing Methods: Personal Data shall be processed in compliance with applicable laws using methods including, but not limited to, documents, software, electronic devices, network systems, or any technical tools applied to Personal Data.

6.2. Processing Timeline: Personal Data processing shall commence immediately upon collection and continue until the processing purposes specified in Article 5 herein are fulfilled.

6.3. Data Storage: Data shall be retained for as long as necessary, even after the expiration or termination of the Contract between the Customer and CKVN, to: (i) comply with CKVN’s internal regulations and policies, or (ii) satisfy statutory requirements.

7. Authorized Data Processors and Related Parties

During its business operations, CKVN may need to use, process, disclose, and/or transfer the Customer’s Personal Data to service providers, third parties, agents, affiliates, associated companies of CKVN, and/or other third parties for one or more purposes outlined in Article 5. Such disclosure shall strictly comply with applicable laws and procedures. These third parties include:

• Partners and Service Providers: Entities providing products, goods, services, and/or collaborating with CKVN, including banks, insurance companies, consultants, auditors, lawyers, notarization offices, business partners, IT solution providers, software/application developers, delivery, maintenance, troubleshooting, and infrastructure development services.
• Brand Owners and Affiliates: Owners, managers, or operators of the Circle K brand; Circle K franchisors and franchisers; and other entities related to CKVN, including but not limited to companies directly or indirectly holding CKVN’s charter capital.
• Authorized Representatives: Any individual or organization acting as the Customer’s representative or authorized proxy.
• Payment Services: Providers of payment and intermediary payment services, subject to the Customer’s authorization or consent.
• Competent Authorities and Legal Obligations: Any individual, competent state authority, or third party to whom CKVN is permitted or obligated to disclose information by law, court order, or other contracts/agreements.

8. Data Security and Potential Risks/Damages

8.1. Security Commitment: CKVN commits to ensuring the security of your data and strictly prohibits the sale or exchange of your information with third parties for commercial purposes. In the event of a data breach resulting from a hacker attack on the storage servers, CKVN shall promptly report the incident to competent authorities for investigation and notify you accordingly.

8.2. Information Sharing & Public Spaces: CKVN guarantees that all customer information stored in its database will not be shared with any individual or business, except as provided in Article 7 of this Policy. However, if you voluntarily engage in interactive activities on the Platform (e.g., chatting, commenting, posting in forums, liking posts, submitting feedback, or responding to surveys), any information disclosed in these public areas becomes accessible to all logged-in users and falls outside the scope of CKVN’s confidentiality commitments under this Policy.

8.3. Risk Management: Personal Data processing may carry inherent risks of data leaks or inappropriate handling. Recognizing the vital importance of data protection, CKVN treats your information as an asset and implements robust administrative and technical measures to safeguard it. These security measures are reviewed and updated regularly.

9. Your Rights and Obligations Regarding Collected Data

9.1 Your Obligations: Provide and update your Personal Data fully and accurately upon consenting to CKVN’s data processing.

9.2 Your Rights: Unless otherwise provided by law, you have the following rights:

 

a. Be informed of Personal Data processing activities.	b. Access, review, or request correction of Personal Data.
c. Consent, withhold consent, or withdraw consent to Personal Data processing.	d. File complaints, denunciations, or lawsuits, and claim damages in accordance with the law.
e. Request data provision, erasure, or restriction of processing; object to Personal Data processing.	f. Request competent authorities or relevant entities/individuals to implement protective measures for your Personal Data.

 

Note: The rights must be exercised in accordance with applicable laws. You may exercise the rights under items a, b, c, and e by emailing [email protected] and providing necessary identification for verification.

If withdrawing consent, objecting to, or restricting Personal Data Processing impacts the performance of the Contract between CKVN and you, CKVN’s legal obligations, or the life, property, and legitimate rights of any party, or national security and public order, CKVN reserves the right to restrict, suspend, terminate, or cancel the Contract in whole or in part. In such cases, CKVN shall not be held liable for any resulting losses incurred by you.

9.3 CKVN will process your requests to exercise your rights in the following order and procedures:

 

Request	Feedback	Proceed	Maximum extension
Withdraw consent/ Restriction/ Objection to the processing of personal data	02 working day	15 days	Once, not exceeding 15 days
View/Edit/Provide Personal Data		10 days	Once, not exceeding 10 days
Delete your personal data		20 days	Once, not exceeding 20 days
Request for Personal Data Protection Measures		15 days	Once, not exceeding 15days

 

10. Third-Party Links

CKVN Platforms may display links to third-party websites, software, or mobile applications (“Third-Party Links”). Access and use of these links are governed by their respective terms and conditions and are entirely at your own risk.

CKVN’s inclusion of any Third-Party Link does not imply endorsement, recommendation, or verification of its content, products, or services. Consequently, CKVN is not liable for:

• Any information, materials, products, or services (or the lack thereof) available on or through Third-Party Links.
• The security practices (or lack thereof) and activities of these third parties.

To protect the integrity of our Platforms, CKVN welcomes user feedback regarding these Third-Party Links.

11. Rights and Obligations of CKVN

(As the Personal Data Controller or Joint Controller and Processor, as applicable)

11.1 Process Personal Data in compliance with this Confirmation and applicable laws.

11.2 Notify the user of the reasons and demonstrate the necessity and reasonableness if extending the processing time for user requests under Section 6.

11.3 Implement appropriate technical and organizational measures to protect Personal Data; review and update these measures as necessary.

11.4 Notify competent authorities of any Personal Data breaches in accordance with the law.

11.5 Select appropriate Personal Data Processors.

11.6 Prevent unauthorized collection of Personal Data from CKVN’s systems. Remain liable to the user for any damage caused by Personal Data processing.

11.7 Cooperate with competent state authorities to protect Personal Data and provide information for investigations into data protection violations.

11.8 Exercise other rights and perform other obligations as prescribed by law.

12. General Provisions

This Policy takes effect from the date the Customer signs or electronically confirms it. The Customer acknowledges that they have read, fully understood, and unconditionally agreed to abide by this Policy. Any matters not specified herein shall be governed by applicable laws, guidelines of competent state authorities, and/or subsequent amendments to this Policy.