PERSONAL DATA PROCESSING POLICY

Welcome to the website www.thuduchouse.vn, operated by Thu Duc House Development Joint Stock Company ("TDH" and/or "we", "us") and TDH's affiliated companies.

This personal data processing policy ("Policy") is implemented by Thu Duc House Development Joint Stock Company to describe activities relating to the processing of Customers' personal data so that Customers better understand the purposes and scope of information we process, the measures TDH applies to protect information, and Customers' rights regarding those activities.

This Policy is an integral part of the contracts, agreements, terms, and conditions governing the relationship between TDH and the Customer.

SCOPE AND APPLICABILITY

• This Policy governs how TDH processes personal data (collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, retrieval, withdrawal, encryption, decryption, copying, sharing, transmission, provision, transfer, erasure, destruction of personal data, or other related actions) of Customers and persons related to Customers where the law requires data processing or who jointly use our products/services with the Customer ("Customer") when the Customer accesses or uses products or services or interacts with the Company through TDH transaction channels and/or directly at the Company and/or at our stores.
• The Customer is deemed to have read and agreed to the entire content of this Policy. If the Customer does not agree with part or all of this Policy (including after updates), the Customer may submit a request to withdraw consent.
• For the avoidance of doubt, this Policy applies only to individual Customers. TDH encourages Customers to read this Policy carefully and to check TDH transaction channels regularly for any changes we may make under the Policy.

DEFINITIONS

• "Customer" means an individual who directly accesses, explores, registers for, uses, or is otherwise involved in the process of operating or supplying TDH products and services.
• "Personal Data" means digital data or other information that identifies or helps identify a specific person, including basic personal data and sensitive personal data. Personal Data that has been de-identified is no longer personal data.
• "TDH" means Thu Duc House Development Joint Stock Company, head office: 57 Song Hanh, Quarter 5, Binh Trung Ward, Ho Chi Minh City, and its affiliated companies.
• A third party is any organisation or individual other than TDH and the Customer as explained in this Policy.
• "TDH transaction channels" include electronic channels (website www.thuduchouse.vn; Facebook fanpage facebook.com/thuduchouses), stores/showrooms/transaction points, or other channels for providing products/services or serving Customer needs, from time to time as we announce.

Basic personal data

"Basic personal data" means personal data reflecting common personal and background elements frequently used in transactions and social relations, not falling under sensitive personal data categories under the law, including without limitation: surname, middle name, and given name at birth, and other names (if any); date, month, and year of birth; date, month, and year of death or disappearance; sex; place of birth, place of birth registration, permanent residence registration, temporary residence registration, current residence, home town, contact address; nationality; individual's image; phone number, personal identification number, passport number, driving licence number, vehicle registration plate number; marital status; information on family relationships (parents, children, spouses); information on the individual's digital account; any other information tied to or helping identify a specific person, and any data or information classified as personal data but not within the definition in Clause 2.7 of this Article under applicable law from time to time.

Sensitive personal data

"Sensitive personal data" means personal data linked to privacy; unlawful infringement directly affects lawful rights and interests, including without limitation: data revealing racial or ethnic origin; political, religious, or philosophical beliefs; private life, personal secrets, family secrets; health status and private life recorded in medical records, excluding blood group information; biometric and inherited or acquired genetic data; physical attributes and distinct biological characteristics; data revealing sexual life or orientation; criminal or unlawful conduct data collected and stored by law enforcement; an individual's location via location services; usernames and passwords for electronic identification accounts; images of ID cards or citizen ID cards; banking usernames and passwords; card data and bank account transaction history; financial, credit, securities, and insurance transaction and activity information of customers, deposit and custodial asset information, transaction information, and information on guarantors at credit institutions, foreign bank branches, payment intermediaries, securities, insurance, and other licensed entities; behavioural tracking data and use of telecom, social media, online media, and other cyberspace services; other personal data classified as confidential or requiring strict security under law.

CATEGORIES OF PERSONAL DATA WE PROCESS

When you use or contact TDH transaction channels, depending on each specific transaction between us, we may collect one or more categories of your personal data appropriate to that transaction, including:

1. Basic personal data;
2. Sensitive personal data;
3. Other data derived from personal data in dealings with us, such as:
   • Transaction history, order information, warranty history;
   • Call and message information and call recordings where we (or a third party we hire) provide voice, messaging, or hotline services to you;
   • Image, audio, and video data from third-party camera services with data storage features used by us.
4. Information we obtain from other third parties you interact with and/or to which you consent to disclose data; from competent State authorities; or from public sources (such as telephone directories, advertising/flyers, electronic press). Whenever we collect such personal data, TDH will ensure lawful receipt from relevant third parties and require them to comply with personal data protection laws.
5. Certain technical information such as IP address, browser type, and cookies to optimise user experience on the website.

PURPOSES OF PROCESSING

TDH processes your personal data for one or more of these purposes:

1. To purchase and use services provided by TDH or by partners collaborating with TDH. For this purpose, providing your information is necessary; we may be unable to meet your requests if requested information is incomplete. In some cases we also collect personal data to comply with law, including without limitation: account registration, issuance, and authentication; order confirmation, updates, delivery, warranty, and order handling; identity verification and security of your personal data; prevention of fraud, identity theft, and other unlawful acts.
2. To improve Customer experience: customer care and after-sales programmes; meeting service and support requests; internal measurement and analysis and other processing to improve quality of products/services or communications and marketing; adjusting, updating, securing, and improving products, services, applications, and devices we provide.
3. Market research and opinion surveys to improve products/services or develop new ones. We will run such programmes separately and seek your consent before you provide information.
4. Legal obligations such as VAT invoices; disclosure to State authorities when required or in disputes, complaints, or litigation; protecting lawful rights and interests. This may include sharing data with other companies and organisations to prevent and detect fraud and reduce credit risk.
5. Communications and marketing: notifying you about new products/services or changes to policies and promotions for products/services we offer.
6. Any other purpose TDH notifies you at collection or before related processing, or as otherwise permitted by law.
7. Other purposes consistent with law where prior consent is not required.

PARTIES WHO MAY PROCESS PERSONAL DATA

Personal data may be accessed for these purposes by:

1. Thu Duc House Development Joint Stock Company;
2. Subsidiaries, affiliates, units, and branches under common TDH control;
3. Contractors, agents, partners, and operational service providers of TDH;
4. Organisations involved in TDH promotional programmes;
5. Professional advisers such as auditors and lawyers, as required by law;
6. Courts and competent State authorities under applicable law and/or where required and permitted.

RETENTION PERIOD

We retain your personal data until the earliest of the following occurs:

1. You request erasure or restriction and accept risks and damage that may result; the request must fully comply with principles under Vietnam's Personal Data Protection Law 2025;
2. The processing purpose has been fulfilled;
3. Statutory retention periods expire;
4. A competent State authority so decides;
5. An agreement provides otherwise;
6. Other cases under law.

DATA SUBJECT RIGHTS AND OBLIGATIONS

Your rights:

• To know about personal data processing activities;
• To consent or not, and to withdraw consent for processing;
• To access, rectify, or request rectification of your personal data;
• To request provision, erasure, restriction of processing, or to object to processing;
• To complain, report, sue, or claim damages under law;
• To request competent authorities or relevant processors to take measures to protect your personal data under law.

Your obligations:

• To protect your own personal data;
• To be responsible for information, data, and consents you create or provide online, and for leakage or infringement caused by your fault;
• To respect and protect others' personal data;
• To provide accurate, complete personal data as required by law, contract, or consent;
• To provide accurate, complete information when registering or placing orders;
• To keep account credentials confidential;
• To notify us promptly of errors, unauthorised access, or suspected personal data breaches;
• To comply with personal data protection law and help prevent infringements;
• To cooperate with us, competent authorities, or third parties where matters affect the security of your personal data;
• To review TDH rules and policies as published or notified from time to time and to follow our instructions to show acceptance or refusal of processing purposes we communicate;
• Other obligations under law.

POTENTIAL CONSEQUENCES AND LOSS

• TDH applies various security measures to protect personal data we hold or control. While we strive to apply appropriate safeguards under law, we cannot guarantee absolute security against risks outside reasonable control or force majeure, including unauthorised access, cyberattacks, viruses, malware, or sophisticated intrusion by third parties.
• If an incident affects personal data, we will take necessary steps under law to mitigate harm and notify competent authorities and affected parties where required.
• You understand and agree that, to the extent permitted by law, we are not liable for damage from cybersecurity incidents or third-party misconduct outside our reasonable control or from force majeure.

SECURITY COMMITMENTS

• TDH endeavours to de-identify data where appropriate and commits that sharing or joint processing occurs only as needed for the purposes in this Policy or as required by law. Recipients must comply with this Policy and applicable personal data protection law.
• TDH does not sell, share, or exchange Customer information with third parties for commercial purposes except with your consent or as required by law. We recommend that you keep access passwords confidential and do not share them with others.

GENERAL TERMS

• This Policy is effective from 6 May 2026. We may amend or supplement it to comply with law or operational needs. Updated versions will be published on our official TDH transaction channels and take effect when posted unless otherwise stated.
• Within 48 hours of receiving a request to exercise your rights, TDH will take necessary steps to verify and identify the requester before fulfilling the request. Where needed to verify identity and protect your data, we may match data you provide with data we hold. If we erase, destroy, or restrict use of data on your request, benefits under contracts or service agreements with TDH that depend on that data may be interrupted, changed, or terminated.

CONTACT

For questions about this Policy, exercising data subject rights, or our processing of your personal data, you may contact us as follows:

1. Post: 57 Song Hanh, Quarter 5, Binh Trung Ward, Ho Chi Minh City, Vietnam.
2. Hotline: 070 567 62 64
3. Email: tdh@thuduchouse.vn
4. Website: www.thuduchouse.vn