PRIVACY POLICY

APPLICATION ZILCODE - GETCAR

​

1. TERMS

The Contract includes the Information Software Service Provision Contract, the Appendices and other relevant documents (if any), signed between Zillion and the Customer. Pursuant to the Contract, Zillion provides the Service to the Customer and acts as the Personal Data Processor at the request of the Data Controller. The Service is a service provided by Zillion to the Customer to support the Customer in organizing operations and internal management through websites, applications and other related services provided by Zillion. Specifically, in this policy, the Service includes:

• Zillion's website at: https://zilcode.com and related linked websites;

• Downloaded applications, mobile applications (including applications on tablets);

• Other services provided by Zillion.

Zilcode Site is Zillion's website located at: https://zilcode.com.

Zilcode Customer Data includes data, reports, addresses and other directories and documents stored electronically by Zillion Customers or Users on the Services provided by Zillion. Personal data is any information that is associated with a specific person or helps to identify a specific person. Personal data includes basic personal data and sensitive personal data Basic personal data and sensitive personal data include information and data specified in Clause 3, Clause 4, Article 2 of Decree No. 13/2023/ND-CP dated April 17, 2023 on personal data protection (hereinafter referred to as “Decree 13”). Data subject is the individual whose personal data is reflected. In the policy, data subject includes: Customer (in the case of individual customers), User and/or Guest. Depending on the specific case, the data subject may be one or more of the subjects as stated above. The common area is the area of ​​the Zilcode Site that can be accessed by both Users and Guests without logging in. The restricted area is the area of ​​the Zilcode Site that can only be accessed by Users through logging into the system. The term of use of the service by the Customer using Zilcode is the period of use of the Service according to the Contract and Appendices (if any) signed between Zillion and the Customer.

2. INFORMATION AND DATA WE COLLECT

We collect various types of information from or through the Service. In addition to the information and data that Zillion publicly collects below, we may also collect and process data of Users and Guests, as deemed appropriate and with the consent of the data subject.

2.1 Data provided by Customers

When a Customer signs a Contract with Zillion, depending on the contracting entity (individual, legal entity, organization, etc.), Zillion may request information including: name, email address, information about phone number, bank account and other basic data to confirm information and draft and sign related documents.

2.2 Data provided by Users

Users understand that Users can only log in and use the Service when the Customer grants access to the Customer's account system during the Customer's Service Term. The Zilcode Service and system have features that allow Users to proactively post and share more of their personal data information, and the regulation and decision of which data is shared on the Service will depend on the Customer's regulations on using the Zilcode Service for the User and/or depending on the User's intention. Zillion provides features that allow Users to edit and/or change this personal data at any time during the Customer's Service Term. Please note that the data and personal information shared by this User with other Users in the same Service system (through applications in the Service such as Zilcode Attachment,...) are not collected by Zillion and will not be within the scope of this provision. The above data will be managed by the User and may be shared with certain subjects as prescribed in Article 4.2 of this policy.

2.3 Automatically Collected Data

Zillion does not automatically collect Customer data.

2.4 Integrated Services

Users have the right to choose to log in or register to use the Service by using the login name and password of the service provided by a third party (hereinafter referred to as “Integrated Services”), such as logging in to the Service with a Google account, AppleID; or, Users allow one (or more) Integrated Services to provide personal data or other information to Zillion. In this case, Users are recommended to check and review the privacy options of each Integrated Service to know and understand what types of information and data the Integrated Service will provide to Zillion in order to make appropriate adjustments and changes. By allowing Zillion to connect to the Integrated Services, the User agrees that Zillion has the right to access and store the name, email address, date of birth, gender, place of residence, URL leading to personal images, and other information and data that the Integrated Services and/or the User allows Zillion to access, use and/or disclose as prescribed in this policy. Please carefully read each service terms and privacy policy of each Integrated Service before using and connecting the Integrated Service with the Services provided by Zillion.

2.5 Data, information collected from other sources

Zillion does not collect data from other sources

3. RIGHTS AND OBLIGATIONS OF DATA SUBJECTS

3.1 Rights of data subjects

Zillion respects the privacy and personal data of data subjects, ensuring the legitimate interests of these subjects in accordance with current relevant legal provisions. Data subjects have the following rights with respect to their personal data:

• (i) Right to know

• (ii) Right to consent

• (iii) Right to access

• (iv) Right to withdraw consent

• (v) Right to delete data

• (vi) Right to restrict data processing

• (vii) Right to provide data

• (viii) Right to object to data processing

• (ix) Right to complain, denounce, initiate a lawsuit

• (x) Right to request compensation for damages

• (xi) Right to self-protection.

To exercise their rights in accordance with legal provisions, data subjects should refer to the provisions of Decree 13 and carefully read the provisions below before providing their personal data to the Personal Data Controller.

❖ Personal data collected and processed in the event that Zillion is the Personal Data Controller

For personal data collected and processed by Zillion as the Personal Data Controller, the data subject may request Zillion to exercise his/her legal rights through the available features and options provided on the Service or send a direct written request to Zillion or contact Zillion via email: contact@zillion.com. Upon receiving a legal request from the personal data subject, Zillion will carry out the subject's request within its capacity and within a reasonable time (up to 30 working days from the date of receipt of the request) and notify the data subject of the implementation results after processing the request. Please note that, depending on each specific case, due to technical and system issues, Zillion may not be able to absolutely fulfill the data subject's requests; However, in such cases, Zillion commits to carry out the requests with maximum effort and goodwill to ensure the legitimate rights and interests of the data subject, for example: the data subject requests Zillion to completely delete his/her data on the Service, due to some technical problems, Zillion cannot delete all documents and folders related to the data subject's personal data. In this case, Zillion ensures that the remaining data that cannot be deleted of the data subject will not be accessible, disclosed and/or processed in any other form without the consent of the data subject. The provisions in this section do not apply to personal data that is part of Zillion Customer Data. In this case, please refer to the provisions below on the Rights of the data subject in the event that Zillion is the Personal Data Processor.

❖ Personal Data in Zillion Customer Data and processed by Zillion in the event that Zillion is a Personal Data Processor As stated in this policy, in addition to its role as a Personal Data Controller

Zillion also acts as a Personal Data Processor at the request of Zillion Customers (who are Personal Data Controllers) through Contracts signed in connection with the provision of Zillion system software. Zillion, as a Personal Data Processor, does not own, control or directly use any Zillion Customer Data through the Service. In this case, the responsibility to meet and ensure the rights of the data subject shall belong to the Zillion Customer and the Zillion Customer shall be obliged to ensure compliance with the regulations and privacy policies that the Zillion Customer self-publishes to the User and relevant legal regulations. Therefore, in case the data subject (whose personal data is reflected on the Service registered and used by Zillion Customers) wants to exercise his/her rights, please contact the corresponding Zillion Customer for support. Any requests and responses from the data subject in this case, if sent directly to Zillion, will be forwarded by Zillion to the Zillion Customer who is managing and using the Service with the same system as the data subject.

3.2 Obligations of the data subject

In addition to the obligations stipulated in Article 10 of Decree 13, during the use of the Service, the User also has the following obligations:

• Be responsible for the correctness and legality of the information and data created and provided by him/her on the Service;

• Respect and comply with the regulations on personal data protection of the Data Controller and/or the relevant Personal Data Processor, after agreeing to allow these Parties to process the personal data provided by them;

• Self-protect and bear related responsibilities in case their personal data or that of other data subjects is illegally exploited or processed due to their fault;

• Promptly notify and coordinate with Zillion to resolve and handle cases showing signs of violations of personal data protection in accordance with the law.

4. SERVICES PROVIDED BY THIRD PARTIES

The Services provided by Zillion may include features or links to websites and services provided by third parties. Any information provided by Zillion Customers, Users or Guests on third party websites or services will be sent directly to and subject to the policies and regulations of that third party.

For example:

Zillion may integrate some services of a gift service provider into the list of applications displayed on the Service (in the event that a Zillion Customer is a user of Zillion's Services and at the same time, uses the gift service of that third party), with the consent of the Zillion Customer, to enhance the experience and convenience for the User. In this case, if the User provides his/her personal information and data to a third party through such integration, the User's data will be sent directly to the third party and will comply with and apply the regulations and policies of that third party. Zillion will not have any rights, obligations related to and will not be responsible for any risks arising from the User providing data to a third party.

5. DATA PROTECTION

Zillion applies necessary, organizational and technical protection measures to protect personal data, Zillion Customer Data being processed at Zillion from incidents, destruction, risks of loss, access, changes, adjustments or disclosures in violation of the law. However, no electronic transmission or storage method is absolutely secure. Zillion cannot guarantee that the data and personal information of Users and Customers will never be affected by the violations as stated above. The security and integrity of Customer data is implemented according to the Contracts signed between Zillion and Zillion Customers and/or in accordance with Zillion's Terms of Service. At present, we are using the following security measures and/or providing the following features for Zillion Users/Customers to proactively ensure the safety of their data.

5.1 Measures Zillion uses to secure and protect data on Zillion's Services and systems​

• Zillion's servers and Services operate on cloud computing infrastructure from leading reputable providers in the world and in Vietnam. The main components of the system are deployed through Viettel Cloud Platform services, in compliance with Viettel's security regulations for data storage on its services. Viettel's security regulations are shown at https://viettelidc.com.vn/ho-tro/dieu-khoan-su-dung-dich-vu-tren-website

• Zillion encrypts password data and personal information (if any). All Zillion Services are securely accessed via the HTTPS protocol (SSL/TLS) to ensure that transmitted information is encrypted before being transferred to the Zillion Site and Services. As for the User's system login password, the system uses a token-based security mechanism according to the OAuth 2.0 standard.

5.2 Possible unintended consequences and damages

Despite applying the data protection measures as stated above, Zillion does not guarantee that Zillion's system or the processing of data of Zillion Customers, Users and/or Guests will never encounter unexpected incidents, risks or losses. Some unexpected consequences and damages that may occur include:

• (i) Hardware and software errors during data processing;

• (ii) Security vulnerabilities beyond Zillion's control leading to the system and Services being exploited and attacked by hackers;

• (iii) the server system being damaged by natural disasters such as earthquakes, fires, lightning, etc. and other unexpected consequences and damages that cannot be foreseen at the time Zillion processes data.

When unexpected incidents as mentioned above occur, Zillion will notify all Zillion Customers, Users and Guests of Zillion as soon as possible and commit to making efforts to implement remedial measures, prevent consequences to minimize possible damages, and at the same time, coordinate with competent state agencies and related organizations and individuals to resolve, handle, and ensure the legitimate rights and interests of Zillion Customers, Users and Guests of Zillion.

6. DATA STORAGE

Zillion only stores personal data collected from Users while the User's account on the Service is active or for a limited period of time necessary to fulfill the original purpose of data collection, unless otherwise provided by Zillion's terms of service or otherwise required by law. Zillion does not own any data or content posted by Users, Zillion Customers or Visitors to the Service.

7. DATA TRANSFER

Zillion may transfer, process and store personal data collected through the Service in centralized databases and on servers, provided by third parties, located in Vietnam. When Zillion transfers personal data from overseas to Vietnam and vice versa, we will ensure that the data is protected in accordance with the provisions of this policy and ensure compliance with current relevant laws. At present, Zillion stores Zillion Customer Data (including personal data) at GCP Singapore and servers located in Vietnam.

8. UPDATE AND ADJUSTMENT OF POLICY

Zillion will update and adjust this policy from time to time, based on actual implementation, requirements, technical issues, legal requirements and other related factors. In case the update changes the important contents and terms of this policy, we will notify all Zillion Customers, Users and Guests before updating through available information and communication channels, for example: posting notices, articles on Zillion's website or contacting Zillion Customers, Users and Guests directly via the Service, email or other appropriate methods and Zillion will notify the effective date of each policy version. Zillion Customers, Users and Guests' continued use of the Service after the updated, amended and supplemented policy takes effect means that Zillion Customers, Users and Guests have read, understood and accepted the terms and contents of the amended policy version. Zillion recommends that Zillion Customers, Users and Guests should regularly monitor and update the contents of this policy to grasp the most accurate information about Zillion's collection and processing of data and information.

9. CONTACT ZILLION

If Zillion Customers, Users and Guests have any questions, queries, exchanges or any issues arising related to data, regulations in this policy, please contact us via email contact@zillion.vn for support. This policy is interpreted, interpreted, and complies with the regulations of the Socialist Republic of Vietnam and is effective from July 1, 2023.