PERSONAL DATA PROTECTION POLICY
As the owner and manager of the commercial center and office tower in Indochina Plaza Hanoi Project located at No. 241, Xuan Thuy Street, Dich Vong Hau Ward, Cau Giay District, City Hanoi, Vietnam (the “Building”), Hanoi Residential and Commercial Centre – HRCC Limited (“HRCC”) respectfully announces our Personal Data Protection Policy (the “Policy”) as follows:
1. Scope of application
This Policy applies to organizations and individuals who provide personal data and/or have personal data received by HRCC and its authorized parties, including but not limited to:
(i) all individuals visiting, shopping, entering, exiting, working or performing other transactions at the Building;
(ii) all those who access, contact through the website(s) and/or mobile application(s) and/or other official contact/information channels of HRCC;
(iii) all individuals participating in events, promotions, advertising, marketing and other forms of trade promotion held by HRCC;
(iv) employees, managers, contractors of tenants, and all people working with HRCC under the authorization, assignment, permission, or appointment of the tenants;
(v) workers, managers, supervisors of HRCC’s contractors and of their sub-contractors, and all other persons acting on behalf of these contractors in the performance of the contract with HRCC;
(vi) employees and managers of HRCC;
(vii) other idividuals whose personal data is provided to HRCC.
2. Definition: In this Policy, the following terms and expressions shall have the following meanings:
a. “personal data” is the information in the form of symbols, letters, numbers, images, sounds or similar forms in the electronic environment that is associated with a specific person or can help identify a specific person. Personal data includes basic personal data and sensitive personal data.
For the avoidance of doubt, personal data shall not include information created by HRCC for the employees to work and in the possession of HRCC, including but not limited to name or title, business phone number, business address, business email address or business fax number and any other similar information.
b. “Data subject” is the individual to whom the personal data reflects.
3. Type and sources of personal data
a. Depending on the purposes of processing personal data, HRCC may collect and process your personal data including:
+ Surname, middle name, birth name, other names (if any); date, month, year of birth, place of birth; sex; permanent residence, temporary residence, current residence, contact address; nationality
+ Personal images;
+ Phone number, identity card number, citizen identification number, passport number, driver’s license number, license plate number, personal tax code, social insurance number, medical insurance card number;
+ Information about individual digital accounts when you have a transaction with us;
Additionally, for the purpose of the best service for you, HRCC, from time to time, may request you to provide some other information voluntarily and in accordance with the law.
b. HRCC and/or its authorized party may collect such data from a variety of sources, including but not limited to:
+ Provided directly by the data subjects when accessing the Building, using HRCC’s services, participating in surveys, contests and promotional programs organized by HRCC;
+ Provided by the supplier, partners, consultants, and tenants of HRCC
+ Provided by third parties having relationship with the data subject, including but not limited to the data subject’s employer; relatives, spouse, children, parents, siblings, guardians, blood/caring/support relatives, friends, acquaintances of the data subject;
+ From audio and video recording devices located at the Building.
c. When service providers, partners, consultants, tenants and other third parties provide personal data to HRCC (collectively, “data providers”), the data providers must warrant that:
(i) The data provider has obtained and will immediately, upon HRCC's written request, provide confirmation that: (1) the data subject is fully aware of and agrees to all contents of the Policy; and (2) the data subject authorizes the data provider to carry out procedures with HRCC related to the provision and processing of personal data; and (3) the data subject agrees to exempt HRCC from all obligations and liabilities for any risks that may occur during the processing of personal data, including but not limited to data leaks due to system errors or other objective causes beyond HRCC's control; and
(ii) The data provider agrees that HRCC is not responsible for assessing the legality and validity of the above consent/approval. HRCC is exempted from liability and has the right to request compensation for damages and related costs when the data provider fails to comply with the provisions of this Article.
4. Purpose of processing personal data
General purposes:
a. To identify and authenticate information about customers, partners, contractors, and employees;
b. To manage the compliance, security, safety at the Building and for other management purposes of HRCC;
c. To exchange information related to the performance of the contracts and transactions to which HRCC is a party;
Other purposes depending on the relationship between HRCC and you:
d. To take care of and to support the customers when working and shopping in the Building;
e. To notify the customers of the promotions, incentives, advertising and/or other trade promotion activities;
f. To check result of the market surveys, statistics and analysis of information and customer habits conducted by marketing researcher for HRCC;
g. To comply with legal regulations and requirements of competent state agencies including but not limited to the obligation to disclose information, to report on results of promotion programs, to keep filling, and auditing;
h. To carry out procedures related to employees such as: signing labor contracts, paying salaries, bonuses and other allowances and benefits, compulsory insurance, personal income tax, health insurance or other issues related to the employment or job application.
For the avoidance of doubt, HRCC does not buy or sell personal data in any manner.
5. Organizations and individuals involved in personal data processing
In order to acchieve the purposes and to carry out the personal data processing activities stated in this Policy, HRCC may process by ourselves and/or provide personal data to the following parties for coordination:
a. HRCC’s service providers and HRCC’s cooperators in providing services, such as security service providers, event organizers, human resource consultant, payroll consultant, accountant, banker, legal consultant, health insurer, and other necessary services;
b. Competent authorities;
c. Other third parties authorized by you.
6. Method of personal data processing
From time to time and depending on the purpose, the personal data may be processed in whole or in part in the manners consistent with legal regulations such as collecting, recording, confirming, storing, retrieving, providing, analyzing, editing, deleting, etc.
7. Personal data processing time
Depending on specific activity, the personal data processing may be commenced as soon as the data is provided, collected and will be terminated upon acchievement of the purpose, and/or will be conducted within other period of time necessary for the exercise of the rights and obligations of HRCC and the relevant partners or until the personal data is deleted at your written request or in accordance with the law.
8. Risks and safety measures
Personal data processing always carries the risk of data leakage or inappropriate processing. HRCC recognizes the importance of protecting personal data and will apply appropriate management and technical measures (including but not limited to establishing internal regulations and standard procedures related to personal data processing, using firewalls, setting file passwords, locking file cabinets, controlling and restricting data access, etc.) to ensure safety for personal data, meeting requirements of the law. However, we cannot guarantee or undertake to completely eliminate the risks associated with the processing of any personal data that you transmit to or allow us to collect. In the event of an incident or discovery of a breach of personal data, HRCC will trigger an emergency response to report and notify breaches or incidents to relevant parties and competent authorities according to applicable law within 72 hours after such violation or incident occurs. At the same time, HRCC will endeavor to take measures to remedy, minimize and prevent consequences and damages within our ability.
9. Your rights and obligations
a. You have the following rights regarding the processing of their personal data: (1) To know; (2) To agree; (3) To access; (4) To withdraw consent; (5) To delete the data; (6) To restrict the data processing; (7) To provide data; (8) To object the data processing; (9) To complain, report and sue; (10) To claim for damages; (11) To self-protect.
Your requests to exercise the rights must be made in writing according to the form set out by us and sent to HRCC at the address specified in Article 11 of this Policy.
b. You have the following obligations: (1) To protect your own personal data; request other relevant organizations and individuals to protect their personal data; (2) To respect and protect the personal data of others; (3) To provide complete and accurate personal data when agreeing to process personal data; (4) To participate in propagating and disseminating personal data protection skills; (5) To implement legal regulations on personal data protection and participate in preventing and againsting violations of personal data protection regulations; (6) To immediately notify HRCC upon discovery or suspection of the exposure of their personal data, which may lead to any violation of this Policy; (7) Other obligations as prescribed by law.
10. Your right to choose
a. Please read this Policy carefully before providing personal data to HRCC and/or performing any work at the Building or dealing with HRCC.
b. This Policy may be updated and amended by HRCC from time to time and posted by HRCC on our website and/or notified to the you through other means appropriate to the actual situation.
c. You are not required to provide any personal data to HRCC. You will provide personal data only if you voluntarily agree to this entire Policy and will provide confirmation to HRCC online or in writing according to the form we provide.
d. When providing personal data to HRCC by (i) accessing, contacting through our website, fanpage and/or application and/or other official contact/information channels of HRCC; (ii) participating in HRCC’s events, promotion programs, advertising, marketing and other forms of trade promotion; (iii) accessing the Building and/or contacting and transacting with HRCC; (iv) providing personal data to HRCC through other means, you accept this Policy in its entirety and does not impose any other conditions.
e. By accepting this Policy, you acknowledge that this Policy is considered a notification from HRCC to you, and HRCC does not need to re-notify these contents before processing personal data.
f. If you refuse to provide personal data, HRCC may consider and decide to refuse your access to the Building, refuse your participation in promotion programs, and HRCC may exercise legitimate rights and remedies under the contract and/or applicable law.
g. If you withdraw consent, request data erasure and/or exercise other rights that restrict the data processing so that the purpose of data processing cannot be achieved, HRCC may also consider and make decision similar to the case where you refuse to provide data as above. In this case, you confirm that there is no need for HRCC to send any further notifications and undertake to only take these actions when:
(1) you have clearly understood and are willing to take responsibility for all consequences and damages that may occur to you, to HRCC and to any third parties involved in the personal data processing, including but not limited to: affecting the ability to perform the contract and/or the ability to implement promotion programs and/or security and safety of the Building, and
(2) you agree to exempt HRCC from all liability if we do not continue to perform the relevant contract (if any).
h. Where you provide information of any third party to HRCC, you must warrant that you have obtained necessary consent and permission from that third party to share and transfer the personal data to HRCC and to allow us to collect, store, use, disclose and/or process that data in accordance with this Policy. In that case, you must submit to HRCC legal documentation evidencing such consent and authorization.
11. Contact
If you have any questions regarding this Policy, please contact HRCC at:
- Indochina Plaza Hanoi No. 241, Xuan Thuy Street, Dich Vong Hau Ward, Cau Giay District, City Hanoi, Vietnam
- Tel: +84 24 3768 9550