PERSONAL DATA PRIVACY AND PROTECTION POLICY

Version: 001 / Issue date: 1 October 2026 / Effective date: 1 October 2026

Purpose and scope

Ban Mai School (the “School”) issues this Personal Data Privacy and Protection Policy (the “Policy”) to transparently inform parents, legal representatives, students, other users (“Users”) and relevant parties about the collection, processing, use, storage, protection of, and exercise of rights over personal data processed by the School through the application (the “Application”).

By accessing the Application or registering an account, Users agree to the terms of this Policy. Please read it carefully. The School’s operations continue to develop, and this Policy may be updated from time to time. Continued use of the Application means that the User accepts the updated Policy. Users are encouraged to check the School’s personal data protection policy regularly for changes.

Personal Data Controller and Personal Data Controller and Processor

For personal data processing through the Application in support of the School’s administration, education and services, the School acts as the Personal Data Controller and the Personal Data Controller and Processor, and is responsible for determining the purposes, scope and methods of processing in accordance with applicable law.

Scope and categories of personal data processed

Personal data is digital data or information in another form that identifies or helps identify a specific person, including basic personal data and sensitive personal data. Personal data that has been de-identified is no longer personal data. Personal data collected and processed by the School may include:

3.1. Basic personal data

Identification and contact information: Full name, date of birth, gender, phone number, email, contact address, ordinary portrait photographs, health insurance card information, student/User identification number.

Learning and conduct data: Academic results, grades, comments and conduct assessments, and learning progress information.

Registration and use of school services/utilities: Absence/attendance registration, student transportation, school meals, library, school supplies purchases, and other extracurricular/internal services or utilities provided by the School.

School payments and financial obligations: Fee and tuition information and payment amounts entered by the User.

Communications, feedback and suggestions: Messages exchanged through the Application, reports, complaints, suggestions or survey responses sent to the School, excluding information that is sensitive personal data.

Technical data: Technical information necessary to authenticate, secure and operate the Application, login times, IP address, device identifier and other technical data that is not sensitive personal data.

Images and files: Images and files voluntarily uploaded by Users or generated by functions deployed by the School, that do not contain sensitive personal data.

3.2. Other personal data

Student health data: Data reflecting a student’s health condition.

Location data: User location determined through location services when the relevant feature is enabled.

Data tracking Application usage behavior: Operation history, interaction logs, notification sent/received/read status and other usage logs when processed to track behavior or Application use in cyberspace.

The School does not automatically collect or process all the above data for every User. Data is processed according to the actual needs of each feature, only to the extent necessary for the specified purpose and where there is a lawful basis for processing.

Personal data of children and persons with limited or lost civil act capacity, or difficulty in cognition or behavioral control

a) Where the law requires consent to process personal data of these persons, consent will be given by their legal representative on their behalf. Disclosure of private-life or personal-secret information of a child aged seven or older will only be made with the consent of both the child and their legal representative.

b) Users undertake that information provided to the School is truthful, complete and accurate. Users agree that the School is not responsible for verifying the legality or validity of information or documents provided or confirmed by Users.

c) The School may verify information where it considers this necessary. If it refuses a User request, the School will respond in writing, stating the legal basis and why the request is not appropriate.

Legal bases and purposes of personal data processing

The School processes data for the following purposes based on consent or other legal bases, including performance of an agreement, compliance with legal obligations and other legal bases described below:

5.1. Processing based on the Data Subject’s consent:

a) Introduction and promotion: Using data to advise on, introduce, promote and personalize introductions or promotions for educational programs, products, services and activities provided by the School.

b) Research and development: Analyzing and compiling statistics to research and improve education quality, products, services, management activities and user experience beyond what is necessary to perform an agreement or legal obligation.

c) Other purposes (except where consent is not required by law): purposes notified by the School and supported by valid consent under applicable law.

5.2. Purposes for which the law permits processing without the Data Subject’s consent:

a) Performance of contracts and agreements: Managing accounts, providing and operating the Application; managing education, students, learning, tuition and school services/utilities; necessary administration; contacting, notifying and supporting students, parents and Users, and handling requests and complaints.

b) Compliance with legal obligations: Fulfilling obligations under law and complying with requests or decisions of competent State authorities.

c) Protection of lawful rights and interests: Protecting the life, health, rights and lawful interests of the Data Subject or another person in urgent cases; and taking necessary steps to protect the legitimate rights or interests of Users, the School or others from infringement.

d) Handling emergencies and preventing or combating violations of law.

đ) Other cases provided by law.

Methods of collecting and using personal data

6.1. Collection methods. The School collects personal data through:

a) Information Users provide directly when registering for or using the Application, or contacting or communicating with the School;

b) Information generated during learning, use of services and participation in School activities;

c) Technical data automatically recorded during use of the Application.

6.2. Use. The School processes personal data using methods appropriate to the purposes in this Policy and on a valid legal basis.

Sharing of personal data and persons or organizations that may access it

The School does not sell Users’ personal data. The School may share or allow the following organizations or persons to access personal data to the extent necessary for the processing purposes in this Policy:

The School’s internal departments and personnel, within their assigned functions and duties.

Competent State authorities and other organizations or persons where required or permitted by law, or where another corresponding lawful basis for processing exists.

In the course of its operations, the School may undergo organizational changes, including division, separation, merger or consolidation as permitted by law. In such cases, personal data and rights to use related information may be transferred and/or further processed for those activities, provided that no new processing purpose arises beyond those in Article 5 of this Policy and the recipient continues to comply with legal personal data protection requirements.

Data sharing must comply with personal data protection laws.

Storage and retention period

The School stores personal data for as long as necessary to fulfill the processing purposes stated in this Policy or as required by applicable law.

Retention periods may differ by data type and purpose. When data is no longer necessary or there is no longer a legal basis to retain it, the School will delete, destroy or otherwise process it appropriately, unless the law requires or permits continued storage.

Personal data security and protection measures

The School and entities engaged by the School to process data are responsible for applying appropriate administrative, technical and other measures to protect personal data, control access and reduce the risk of loss, destruction, alteration, disclosure or unauthorized use.

Users are responsible for keeping login information confidential, using secure devices and promptly notifying the School if they discover unauthorized account access or an incident affecting personal data.

If a personal data incident occurs, the School and the processor will coordinate response and remediation and provide notices and reports in accordance with applicable law and agreements between the parties.

Given the nature of technology and the Internet, no security measure can guarantee absolute safety. Although the School strives to apply appropriate measures, it cannot absolutely guarantee that your personal data will always be secure in every circumstance.

Rights, obligations and process for exercising Data Subject rights

10.1. Data Subject rights include:

a) The right to know about personal data processing;

b) The right to consent or withhold consent, and to withdraw consent to processing;

c) The right to view, correct or request correction of personal data;

d) The right to request provision, deletion or restriction of processing of personal data, and to object to processing;

10.2. Data Subject obligations include:

a) Protecting their own personal data;

b) Respecting and protecting other persons’ personal data;

c) Providing complete and accurate personal data as required by law or contract, or when consenting to processing of their data;

d) Complying with personal data protection laws and participating in the prevention of personal data violations.

10.3. When exercising their rights and obligations, Data Subjects must:

a) Act in accordance with law and their contractual obligations. Exercise of rights and obligations must aim to protect the Data Subject’s own lawful rights and interests;

b) Not hinder the legal rights or obligations of a Personal Data Controller, Personal Data Controller and Processor, or processor;

c) Not infringe the lawful rights and interests of the State or other agencies, organizations or persons.

10.4. Agencies, organizations and persons must facilitate the exercise of Data Subject rights and obligations and must not obstruct them, in accordance with law.

10.5. How to exercise rights:

a) Data Subjects may exercise rights concerning their personal data by submitting a request to the School using the contact details in Article 14 of this Policy, directly in writing, by email or through other electronic means.

b) A request must state at least the requester’s full name, email or phone number, the specific right to be exercised and the relevant category of personal data, reasons (if any), and supporting information or documents (if any).

c) After receiving a request, the School will verify identity and the request’s validity, completeness and accuracy under applicable law, and assess whether it can be fulfilled. The School may request additional verification information or refuse to process a request if:

The Data Subject does not provide sufficient information to verify identity and the validity of the request; or

Applicable law does not permit the School to fulfill the request; or

There is a specific request from a competent State authority.

Receiving and resolving feedback and complaints

Feedback or complaints concerning personal data processed outside the stated purposes, scope or applicable law may be sent to the School using the contact details in Article 14 of this Policy.

The School is responsible for receiving, verifying and handling feedback and complaints under applicable law and internal procedures. Where necessary, it will coordinate with its software provider or relevant parties to resolve and remediate the matter.

Location, image, audio, video and file features

For features that request access to location, camera, microphone, photo library or files on a device, the Application uses the relevant permissions only to the extent necessary for features deployed by the School and in accordance with the device permission controls.

Users may only provide or upload images, audio, video or files containing another person’s data when they have the right or an appropriate basis to do so. Data is processed for the relevant feature’s purpose and under this Policy.

Amendments and updates

The School may update, amend, supplement or replace this Policy from time to time, provided that such changes do not violate Vietnamese law and/or are intended to better protect Data Subjects’ information.

Any update, amendment, supplement or replacement will be published in the Application or made public through an appropriate method so Users can access it in accordance with applicable law. Users should access and check the Application regularly for the latest changes.

Notice

This Policy constitutes notice before the School processes personal data. Accordingly, the School and organizations or persons involved in processing personal data are not required to provide a separate notice before processing.

Effectiveness

This Policy takes effect on 1 October 2026.