Personal Data Processing Agreement

Article 1. Parties and scope

• 1. Party A (data processor): VNBOT Artificial Intelligence Solutions Company Limited, tax code 0111582441.
• 2. Party B (data controller): the organization or individual using the Service under the Terms of Service.
• 3. This Personal Data Processing Agreement (“Agreement”) is an integral annex to the Terms of Service, made under the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.
• 4. The Agreement covers Customer Data under Article 8 of the Terms of Service, takes effect when Party B accepts the Terms of Service and lasts until Party A has deleted Customer Data under Article 5 of this Agreement.

Article 2. Purposes of processing

Party A processes Customer Data only for the following purposes, according to Party B’s settings and instructions:

• -replying automatically with an AI assistant on the channels Party B connects;
• -storing and showing conversations so Party B’s staff can follow up and reply;
• -creating search data (embeddings) from questions, documents, products and messages so the chatbot finds the right information;
• -recording contact details, orders and appointments provided by customers;
• -sending reminders, satisfaction surveys and other messages when Party B turns those features on;
• -suggesting new FAQ entries for Party B to review;
• -making AI calls when Party B uses the calling feature;
• -keeping the system secure, fixing incidents and responding to competent authorities.

Party A does not sell Customer Data, does not use it for advertising or for Party A’s own purposes, and does not use it to train AI models.

Article 3. Data subjects and categories of data

• 1. Data subjects: Party B’s customers and contacts, including people who message, comment, answer AI calls, or are added manually or imported from a file by Party B.
• 2. Categories of data:
• a) channel identifiers: display name, Facebook and Zalo user IDs, profile picture;
• b) conversation content: messages, comments, attachments, images and voice notes sent by customers;
• c) contact and transaction details: phone number, email, address, notes, labels, orders, appointments, survey results;
• d) AI calls, if used by Party B: phone number, call content and recordings.
• 3. Conversations may contain sensitive data sent by customers themselves, such as health information. Party B takes this into account when using the chatbot in areas such as healthcare or beauty services.

Article 4. Legal basis

• 1. Party B transfers Customer Data to Party A for processing under Article 17(1)(d) of the Personal Data Protection Law.
• 2. Party B warrants that it has customers’ consent or another lawful basis for each purpose in Article 2, and has informed customers that their data is processed automatically by AI, through Party A as service provider, and partly abroad under Article 8 of this Agreement.

Article 5. Retention and deletion

• 1. Party A keeps Customer Data for as long as Party B uses the Service, except data Party B has deleted or requested to delete.
• 2. When Party B requests deletion of a specific customer’s data, Party A carries it out within 05 working days.
• 3. When Party B requests deletion of its organization or account, Party A deletes Customer Data within 20 days, except for data the law requires to be kept longer. Before deletion, Party B may export its contacts, products and FAQs to Excel.
• 4. Backups, if any, are overwritten on the backup cycle and are not used for any other purpose.

Article 6. Security measures

• -encryption of data in transit;
• -access control, role-based permissions and support for two-step verification at sign-in;
• -separation of data between organizations;
• -Party A’s staff access Customer Data only when needed to operate the Service, fix incidents or support Party B on request, and are bound by confidentiality;
• -periodic review and update of security measures.

Article 7. Sub-processors

Party A uses the following categories of sub-processors when processing Customer Data:

• -server and database infrastructure providers;
• -artificial intelligence service providers: writing replies, reading images and voice notes, and creating search data;
• -cloud storage providers for images, videos and files;
• -the Facebook and Zalo messaging platforms Party B chooses to connect; processing on those platforms follows the terms Party B has accepted with them;
• -telephony providers, only if Party B uses AI calling.

The specific list of sub-processors and processing locations is provided to Party B on request at support@vnbot.vn. When adding or replacing a sub-processor, Party A notifies Party B by email at least 15 days in advance. If Party B objects on reasonable data protection grounds and the parties cannot find a solution, Party B may terminate and receive a refund for the remaining period under Article 5 of the Terms of Service.

Article 8. Transfers outside Vietnam

• 1. Part of the Customer Data is processed on systems of sub-processors located outside Vietnam. This is a cross-border transfer of personal data under Article 20 of the Personal Data Protection Law.
• 2. Party A fulfils its obligation to prepare a cross-border transfer impact assessment for the data flows it performs. Party B determines and fulfils its own filing obligations, if applicable; Party A provides the necessary documents under Article 12 of this Agreement.
• 3. The artificial intelligence service providers Party A uses do not use data sent through paid service plans to train their models.

Article 9. Assistance with data subject rights

• 1. Party B can view and edit customers’ contact details and export its contact list to Excel in the account.
• 2. For other customer requests, such as providing chat history, deleting or restricting processing of data, Party B sends instructions to support@vnbot.vn. Party A carries them out within 05 working days of receipt, so Party B can meet the deadlines under Decree 356/2025/ND-CP.
• 3. If a customer contacts Party A directly, Party A forwards the request to Party B within 02 working days and does not act on it without Party B’s instructions, unless the law provides otherwise.

Article 10. Data incidents

• 1. Party A notifies Party B within 24 hours of discovering a leak, loss or unauthorized access to Customer Data, with the information required by Article 28 of Decree 356/2025/ND-CP available to Party A.
• 2. Party A cooperates with Party B to report to the competent authority within 72 hours, record the incident, remedy its effects and notify customers where necessary.

Article 11. Party B’s instructions and requests from authorities

• 1. Party A processes data according to Party B’s instructions given through account settings and requests sent from the registered email. If an instruction appears unlawful, Party A notifies Party B and may decline to carry it out.
• 2. When a competent authority lawfully requests Customer Data, including requests to be met within 24 hours, or 03 hours in emergencies, under the Law on Cybersecurity, Party A complies and informs Party B where the law allows.

Article 12. Records for inspections

• 1. Party A provides Party B with the data flow description, the list of sub-processors and processing locations, the security measures and this Agreement when Party B prepares a data processing impact assessment or a cross-border transfer impact assessment, or when authorities carry out an inspection.
• 2. This Agreement can be printed or saved as a PDF from this page.

Article 13. Liability

• -Liability between the parties follows Article 12 of the Terms of Service, under which the limit for damage caused by Party A breaching its Customer Data protection commitments is three times the general limit.

Article 14. Party A’s contact details

• -Personal data protection contact: support@vnbot.vn.