INFORMATION PRIVACY POLICY

I. General Provisions

• 1.1 Personal Data: refers to information in the form of symbols, characters, digits, images, sounds, or similar electronic formats attached to or identifying a specific natural person. Personal Data comprises Basic and Sensitive Personal Data.
• 1.2 Data Subject: refers to the natural person reflected by the Personal Data, including individual customers utilizing Company products/services, employees, shareholders, and individuals establishing legal relationships with HEVO.
• 1.3 Personal Data Processing: refers to one or multiple operations on Personal Data, such as collecting, recording, analyzing, confirming, storing, modifying, disclosing, combining, accessing, retrieving, encrypting, decrypting, sharing, transferring, deleting, or destroying data.
• 1.4 Related Persons: When providing personal data of related individuals (dependents, spouses, children, emergency contacts), the Data Subject guarantees that lawful consent has been obtained. HEVO bears no obligation to verify such consent.
• 1.5 Policy Acceptance: By registering, purchasing, or using HEVO products/services, the Data Subject unconditionally accepts all terms herein and periodic updates.
• 1.6 Policy Amendments: This Policy may be updated periodically on the official website (www.hevoauto.vn). Customers are encouraged to review updates regularly.
• 1.7 Processing Principles: Compliant with Vietnamese laws; clear and lawful purpose specification; implementing technical and cybersecurity measures; strictly protecting children's data.

II. Categories of Processed Personal Data

To provide electric motorcycles and charging services, HEVO processes the following data categories:

III. Purposes of Personal Data Processing

Personal data is collected and processed for the following legitimate purposes:

• 3.1 Verification & Assessment: Identity verification; evaluating vehicle purchase dossiers, battery subscriptions, and approving contracts.
• 3.2 Contract Performance: Delivering EV products, charging services; activating digital warranty; diagnosing issues; resolving complaints.
• 3.3 Service Improvement: Analyzing driving behavior, battery SOH/performance; optimizing HEVO App UX/UI; expanding charging infrastructure.
• 3.4 Operational Management: Financial accounting, tax reporting, audit compliance, and statutory enterprise operations.
• 3.5 Corporate Restructuring: Lawful data transfer during mergers, acquisitions, or project transfers as prescribed by law.
• 3.6 Marketing & Loyalty: Introducing promotional campaigns, battery swap programs, charging station offers, and tailored services.
• 3.7 Crime Prevention & Safety: Protecting physical assets, preventing warranty fraud, and assisting law enforcement in vehicle theft investigations.
• 3.8 Regulatory Compliance: Fulfilling reporting duties required by competent state authorities under Vietnamese law.

IV. Personal Data Processing Methods

• 4.1 Collection: Directly via hevoauto.vn, HEVO App, sales contracts, handover reports, hotline, CCTV, and vehicle IoT telematics.
• 4.2 Storage: Stored securely in database servers within Vietnam, compliant with enterprise-grade data security standards.
• 4.3 Transfer & Sharing: HEVO does not sell personal data. Sharing is limited to affiliated entities, authorized service centers, software partners, and statutory authorities.
• 4.4 Analysis & Encryption: Processed internally and encrypted according to standard cryptographic protocols during storage and transmission.
• 4.5 Data Deletion: Data will be deleted or anonymized upon valid customer request, unless statutory retention is mandatory by law (tax, accounting, legal warranty obligations).

V. Processing of Children's Personal Data

• 5.1 HEVO strictly processes children's personal data in accordance with the best interests and statutory rights of children.
• 5.2 Processing requires explicit consent from parents or legal guardians. For children aged 7 and above, the child's own consent is also mandatory pursuant to law.

VI. Potential Undesirable Risks

• 6.1 Despite multi-layered security measures (firewalls, access control, encryption), residual risks may arise from sophisticated cyberattacks or force majeure hardware failures.
• 6.2 Customers are responsible for safeguarding their HEVO App passwords, OTPs, and personal devices. Sharing credentials is strictly discouraged.
• 6.3 In the event of a verified data breach, HEVO will promptly notify competent authorities and affected users within the statutory timeframe.

VII. Processing Timelines

• 7.1 Processing commences upon lawful receipt of personal data.
• 7.2 Processing terminates once processing purposes are fulfilled or upon valid customer deletion requests.
• 7.3 Mandatory data retention may continue post-contract termination to comply with statutory legal and accounting obligations.

VIII. Data Processing Entities

• 8.1 HEVO acts as Data Controller and Data Processor.
• 8.2 Involved parties: HEVO Authorized Service Centers, cloud/datacenter partners, payment gateways, legal counsels, auditors, and state agencies.
• 8.3 All third-party recipients are contractually bound by confidentiality and HEVO data protection standards.

IX. Rights of Data Subjects

Pursuant to Article 9 of Decree 13/2023/ND-CP, customers are entitled to:

X. Obligations of Data Subjects

• 10.1 Safeguard your own personal data; maintain device and credential security.
• 10.2 Provide accurate, truthful, and updated personal information.
• 10.3 Respect and protect the personal data of other ecosystem participants.
• 10.4 Comply with statutory personal data protection laws.

XI. Miscellaneous Provisions & Contact

This Policy takes effect from the date of issuance. For any inquiries, feedback, or requests regarding data protection, please contact: