Privacy Policy

1. This Policy specifically governs the following matters:

a. The scope and purposes of Processing the Data Subject’s Personal Data;

b. The parties participating in the Processing of Personal Data;

c. The rights and obligations relating to the Data Subject’s Personal Data;

d. The commencement and termination of Personal Data Processing;

e. The methods of Personal Data Processing;

f. Possible unintended consequences and damage; and

g. Other matters relating to Personal Data Processing.

2. By submitting an application to BLUEMARQ DEVELOPMENT and/or authorising BLUEMARQ DEVELOPMENT to use the Personal Data of the Data Subject and/or a Related Person, the Data Subject accepts all terms and conditions specified in this Policy (collectively, the “Personal Data Processing Terms and Conditions”).

3. By providing BLUEMARQ DEVELOPMENT with the Personal Data of a Related Person, the Data Subject represents and warrants to BLUEMARQ DEVELOPMENT that:

– The Related Person has been fully informed of this Policy; and

– The Data Subject has obtained the Related Person’s lawful consent and authorisation for the Processing of their Personal Data in accordance with the Personal Data Processing Terms and Conditions of this Policy.

4. The Personal Data Processing Terms and Conditions contained in this Policy constitute an integral part of the agreements, contracts, terms and conditions governing the relationship between the Data Subject and BLUEMARQ DEVELOPMENT. If any discrepancy and/or conflict arises between the Personal Data Processing Terms and Conditions and any terms and conditions governing the same purposes under an agreement and/or contract between the Data Subject and BLUEMARQ DEVELOPMENT, whether entered into before, on or after the effective date of this Policy, the Personal Data Processing Terms and Conditions shall prevail and automatically supersede the conflicting terms and conditions of such agreement and/or contract.

1. Scope of Processing

Depending on the circumstances, BLUEMARQ DEVELOPMENT may process all or part of the Data Subject’s Basic Personal Data and Sensitive Personal Data, including:

a. Basic Personal Data

– Full legal name, including surname, middle name and given name, and any other names or aliases;

– Date of birth and date of death or disappearance;

– Gender;

– Nationality;

– Place of birth, permanent residence, temporary residence, hometown and contact address;

– Telephone number, email address, citizen identification number, passport number, driving licence number, vehicle registration number, personal tax identification number, social insurance number, health insurance card number, work permit number, information contained in the work permit and visa information;

– Marital status and information concerning family relationships, including parents, spouse and children;

– Information concerning Related Persons;

– Résumé or CV, cover letter, relevant or previous work experience, educational qualifications, academic transcripts and other information provided by the Data Subject to BLUEMARQ DEVELOPMENT for registration, employment applications or the recruitment process;

– Reference information and information obtained through background checks, if any, including information provided by third parties;

– Personal Data reflecting the Data Subject’s employment, education and training, commendation and disciplinary history;

– Personal images, videos and audio recordings, including but not limited to photographs included in application documents, images or voices of the Data Subject recorded through online conferencing platforms, and images collected through security-surveillance equipment at offices or buildings;

– Workplace-location information and business-travel history;

– Information concerning the Data Subject’s personal skills, other talents and interests, if any;

– Results of any aptitude or personality assessment completed by the Data Subject and provided to BLUEMARQ DEVELOPMENT;

– Information concerning the Data Subject’s employment commencement, grade and position;

– Other information required by applicable laws or voluntarily provided by the Data Subject to BLUEMARQ DEVELOPMENT during the recruitment process and/or employment with BLUEMARQ DEVELOPMENT that is not classified as Sensitive Personal Data; and

– Other information associated with, or capable of identifying, a particular individual that is not classified as Sensitive Personal Data.

b. Sensitive Personal Data

– Bank account numbers;

– Political and religious views;

– Information concerning criminal offences or criminal conduct contained in criminal records;

– Financial information, including salaries, grants, allowances, bonuses and other benefits, as amended or adjusted from time to time;

– Health status and private information recorded in medical records;

– Racial and ethnic origin;

– Images and fingerprints;

– Personal location data determined through location services; and

– Other Personal Data classified by applicable laws as specific or sensitive and requiring appropriate security measures.

BLUEMARQ DEVELOPMENT processes the Data Subject’s Personal Data for the following purposes (collectively, the “Processing Purposes”):

– To verify the Data Subject’s identity and the accuracy of the information provided and to conduct reference and background checks where necessary;

– To assess and determine an Applicant’s eligibility and suitability for the position applied for or for similar employment opportunities that may arise in the future and to identify potential conflicts of interest;

– To take preparatory steps for entering into probationary contracts, employment contracts, vocational training contracts, internship agreements and other agreements permitted by applicable laws and to enter into and perform the obligations arising from such contracts and agreements;

– To carry out procedures and processes relating to the recruitment of the Data Subject, including assessing whether the Applicant satisfies the relevant requirements and making an employment offer;

– To fulfil obligations relating to tax, social insurance, employment, trade unions and employee health examinations in accordance with applicable laws and to provide Employees’ information and Personal Data to competent state authorities upon request, including but not limited to labour, insurance, statistics, trade union, state banking and tax authorities;

– To pay salaries and bonuses and administer employment policies, benefits and welfare programmes in accordance with BLUEMARQ DEVELOPMENT’s internal labour regulations, collective labour agreements and other internal policies, including managing insurance and other benefits for Employees and their dependants;

– To provide courses and training programmes designed to improve soft skills and other skills or knowledge required for recruitment, talent and succession planning, job-related training or the performance of probationary and employment contracts with BLUEMARQ DEVELOPMENT;

– To arrange business trips, events, activities, training programmes, vocational training and internal employee transfers or rotations;

– To assess an Employee’s capability and suitability for a new position, including for promotion purposes;

– To conduct internal human-resources administration, maintain databases for BLUEMARQ DEVELOPMENT’s operational requirements, and compile and update Employee information; and to communicate disciplinary measures internally to foster an effective and disciplined workplace culture;

– To conduct internal controls, risk management and investigations, impose disciplinary measures where violations occur, and resolve employment disputes;

– To conduct audits, settlements, reporting, statistical analysis, surveys and data analysis relating to personnel, employment, payroll, tax, social insurance and health insurance;

– To enter into, perform and comply with agreements and contracts between BLUEMARQ DEVELOPMENT and other parties;

– To share an Employee’s business contact information with customers, suppliers and/or partners where relevant to the Employee’s position and duties;

– To obtain professional advice, including but not limited to legal advice, concerning any matter relating to BLUEMARQ DEVELOPMENT and/or the Data Subject;

– To compile statistics and determine which officers and Employees are eligible for preferential loans from BLUEMARQ DEVELOPMENT in a given year;

– To provide the Data Subject with information concerning BLUEMARQ DEVELOPMENT and its products and services;

– To provide Personal Data to BLUEMARQ DEVELOPMENT’s business units and branches, if any, service providers and other relevant third parties authorised to process Personal Data on behalf of BLUEMARQ DEVELOPMENT for the Processing Purposes;

– To assist Employees in obtaining immigration visas or work permits where necessary and to establish emergency-contact arrangements;

– To manage and ensure workplace security and safety;

– To carry out other activities relating to the employment relationship or for other purposes required or permitted by applicable laws, regulations or guidance issued by competent state authorities; and

– For any other purpose permitted by Vietnamese law.

The Processing Purposes specified above may continue to apply for a reasonable period after the Data Subject withdraws their application to BLUEMARQ DEVELOPMENT, where the Data Subject is an Applicant, or terminates or changes their employment relationship with BLUEMARQ DEVELOPMENT, where the Data Subject is an Employee. Such period includes any time reasonably necessary for BLUEMARQ DEVELOPMENT to exercise or enforce its rights under a contract with the Employee or under applicable laws.

If BLUEMARQ DEVELOPMENT processes the Data Subject’s Personal Data for any purpose other than the Processing Purposes specified in this Article, BLUEMARQ DEVELOPMENT shall inform the Data Subject of how the relevant Personal Data will be processed and obtain any additional consent required before processing the Personal Data for such purpose, in accordance with applicable laws and regulations.

1. Subject to full compliance with Vietnamese laws, BLUEMARQ DEVELOPMENT may share all or part of the Data Subject’s Personal Data with the following parties:

a. BLUEMARQ DEVELOPMENT entities: Business units, branches, transaction offices, subsidiaries and affiliated companies, if any.

b. Personal Data Processors: Organisations and individuals acting as Personal Data Processors, including but not limited to:

– Goods and service providers, including courier service providers, human-resources service providers, and work-permit and visa service providers;

– Recruitment agencies, candidate-search firms and employment-referral service providers;

– Training and coaching providers;

– Healthcare providers, medical examination providers and hospitals;

– Travel and transportation service providers;

– Cloud-storage and information-technology service providers;

– Analytics and advisory service providers;

– Professional advisers, including but not limited to lawyers, legal advisers, financial advisers, accountants, auditors and/or other professional consulting firms;

– Notary offices and bailiff service providers; and

– Insurance companies and insurance brokers.

c. Authorised third parties: Any third party that the Data Subject authorises BLUEMARQ DEVELOPMENT to share Personal Data with, including but not limited to the Data Subject’s Related Persons.

d. State authorities: Any competent state authority and/or subordinate body of such authority in accordance with Vietnamese laws.

e. Business transfers: BLUEMARQ DEVELOPMENT may share Employees’ Personal Data with other parties in connection with any consolidation, acquisition, merger, cooperation arrangement, restructuring, financing or other business transaction.

f. Other third parties: Other third parties that BLUEMARQ DEVELOPMENT considers necessary for the Processing Purposes or as required by applicable laws.

2. BLUEMARQ DEVELOPMENT shall otherwise treat the Data Subject’s Personal Data as private and confidential. Except for the parties specified above, BLUEMARQ DEVELOPMENT shall not disclose Personal Data to any other party unless:

a. The Data Subject has provided consent;

b. BLUEMARQ DEVELOPMENT is required or permitted to make the disclosure under applicable laws;

c. The disclosure is required or authorised by a decision of a competent state authority;

d. BLUEMARQ DEVELOPMENT transfers its rights and obligations under one or more agreements between the Data Subject and BLUEMARQ DEVELOPMENT; and/or

e. BLUEMARQ DEVELOPMENT is required to fulfil its obligations to a competent state authority.

1. Unless otherwise provided by applicable laws, the Data Subject has the following rights concerning their Personal Data:

a. Right to Be Informed: The Data Subject has the right to be informed of activities involving the Processing of their Personal Data.

b. Right to Consent: The Data Subject has the right to consent or refuse to consent to the Processing of their Personal Data, except where applicable laws permit Personal Data to be processed without the Data Subject’s consent.

c. Right of Access: The Data Subject has the right to access and view their Personal Data, rectify it or request its rectification.

d. Right to Withdraw Consent: The Data Subject has the right to withdraw their consent.

e. Right to Deletion: The Data Subject has the right to delete or request the deletion of their Personal Data.

f. Right to Restrict Processing: The Data Subject has the right to request restrictions on the Processing of their Personal Data.

g. Right to Request the Provision of Personal Data: The Data Subject has the right to request that their Personal Data be provided to them.

h. Right to Object to Processing: The Data Subject has the right to object to the Processing of their Personal Data to prevent or restrict its disclosure or its use for advertising and marketing purposes.

i. Right to Complain, Denounce Violations or Initiate Legal Proceedings: The Data Subject has the right to lodge complaints, denounce violations or initiate legal proceedings in accordance with applicable laws.

j. Right to Claim Compensation for Damage: The Data Subject has the right to claim compensation for damage arising from a violation of regulations governing the protection of their Personal Data.

k. Right to Self-Protection: The Data Subject has the right to protect themselves in accordance with the Civil Code, other relevant laws and Decree No. 13/2023/ND-CP on Personal Data Protection and to request a competent authority or organisation to apply measures for the protection of their civil rights.

2. If the Data Subject wishes to exercise any right concerning Personal Data controlled and processed by BLUEMARQ DEVELOPMENT, the Data Subject must notify BLUEMARQ DEVELOPMENT through one of the methods specified in this Policy. Upon receiving a complete and valid request, BLUEMARQ DEVELOPMENT shall use reasonable efforts to fulfil the request within the period prescribed by applicable laws. If BLUEMARQ DEVELOPMENT is unable to fulfil the request for any reason, it shall notify the Data Subject, except where Vietnamese law prohibits such notification.

3. If an Applicant withdraws consent to the Processing of their Personal Data or requests the rectification, deletion and/or destruction of their Personal Data, and such request prevents BLUEMARQ DEVELOPMENT from continuing the interview or recruitment process, BLUEMARQ DEVELOPMENT shall treat the request as the Applicant’s decision to withdraw their application for the relevant position.

4. If an Employee withdraws consent to the Processing of their Personal Data or requests the rectification, deletion and/or destruction of their Personal Data, and such request prevents BLUEMARQ DEVELOPMENT from entering into an employment contract with the Employee, BLUEMARQ DEVELOPMENT shall treat the request as the Employee’s refusal to enter into the employment contract. If the exercise of such rights prevents BLUEMARQ DEVELOPMENT from performing its obligations to the Employee under a contract or agreement, BLUEMARQ DEVELOPMENT shall not be liable to the Employee for any resulting loss or damage.

5. For the avoidance of doubt, when the Data Subject exercises the right to withdraw consent:

a. The withdrawal shall take legal effect with respect to BLUEMARQ DEVELOPMENT only after the request has been submitted to BLUEMARQ DEVELOPMENT and BLUEMARQ DEVELOPMENT has completed the identity-verification process necessary to confirm the Data Subject’s rights. The withdrawal shall not have retroactive effect on any consent granted before that time; and

b. The withdrawal shall apply only to the specific Personal Data Processing Purpose or Purposes identified by the Data Subject. It shall not automatically apply to all Personal Data Processing Purposes specified in this Policy unless the Data Subject expressly states otherwise.

The Data Subject has the following obligations concerning their Personal Data:

1. To protect their Personal Data and request that relevant organisations and individuals also protect such Personal Data. If Personal Data is disclosed due to the Data Subject’s carelessness or fault, the Data Subject shall accept the risks and potential damage arising from such disclosure.

2. To respect and protect the Personal Data of other individuals.

3. To provide BLUEMARQ DEVELOPMENT with complete and accurate Personal Data when consenting to its Processing.

4. To participate in communication, awareness and training activities concerning Personal Data protection skills organised by BLUEMARQ DEVELOPMENT or its partners and service providers and to acknowledge that any failure to comply may create risks to the Data Subject’s Personal Data.

5. To promptly notify BLUEMARQ DEVELOPMENT of any change to the Personal Data previously provided by the Data Subject.

6. At BLUEMARQ DEVELOPMENT’s request, to provide legally valid documentation demonstrating that the Data Subject has obtained all necessary consent and authorisation from a Related Person to provide that Related Person’s Personal Data.

7. To comply with applicable Personal Data protection laws and participate in the prevention and combating of violations of Personal Data protection regulations.

BLUEMARQ DEVELOPMENT shall commence Processing the Data Subject’s Personal Data upon receiving the Data Subject’s Consent to such Processing. The Data Subject’s Personal Data shall be processed for the period necessary to:

– Fulfil the Processing Purposes;

– Perform the obligations communicated by BLUEMARQ DEVELOPMENT to the Data Subject; and/or

– Perform the agreements and/or contracts entered into between BLUEMARQ DEVELOPMENT and the Data Subject.

Personal Data may be retained for a longer period where such retention is required or permitted by applicable laws, including for inspection, tax, employment and auditing purposes. Certain categories of Personal Data may be retained for longer periods than others.

1. Collection of Personal Data

BLUEMARQ DEVELOPMENT and/or its Personal Data Processor(s) may collect the Data Subject’s Personal Data from various lawful sources, including but not limited to:

a. Information provided directly by an Applicant to BLUEMARQ DEVELOPMENT during the interview process;

b. Information provided directly by an Employee to BLUEMARQ DEVELOPMENT when entering into a contract with BLUEMARQ DEVELOPMENT and during their employment with BLUEMARQ DEVELOPMENT;

c. Communications, correspondence and interactions with the Data Subject;

d. Audio-recording and video-recording equipment connected to security systems installed at BLUEMARQ DEVELOPMENT’s business units, branches, transaction offices and other premises;

e. Information provided by the Data Subject to third parties that are organisations or individuals outside BLUEMARQ DEVELOPMENT and its Personal Data Processors but are authorised to Process Personal Data, where the Data Subject has consented to those third parties providing such information to BLUEMARQ DEVELOPMENT. For the purposes of this provision, third parties may include but are not limited to providers of communications, recruitment, market research, marketing, fraud-prevention and data-aggregation services and/or other third parties connected with BLUEMARQ DEVELOPMENT’s activities;

f. Information obtained from BLUEMARQ DEVELOPMENT’s Personal Data Processors, including business partners, affiliated banks, publicly available data sources, data sources maintained by competent state authorities and other sources; and

g. Information obtained from other sources and/or third parties not specified above, provided that such sources and/or third parties Process Personal Data in accordance with Vietnamese laws and have obtained the Data Subject’s consent to provide the information to other parties, including BLUEMARQ DEVELOPMENT. BLUEMARQ DEVELOPMENT may use any collection method permitted by Vietnamese laws to collect Personal Data from the sources specified above, including but not limited to landline telephone systems, call centres, mobile telephones, email, laptop computers, closed-circuit television systems (CCTV) and other electronic transaction systems.

2. Processing Personal Data Obtained Through Audio and Video Recording in Public Areas

a. BLUEMARQ DEVELOPMENT may collect and process images of individuals and information obtained from security systems, including audio and video recordings captured in areas monitored by CCTV. Such areas may include, but are not limited to, branches, business units, the head office, transaction counters, corridors, entrances, exits and parking areas. In accordance with applicable laws, this information may be processed without the Data Subject’s consent for the purposes of protecting national security, maintaining public order and social safety, and protecting the lawful rights and interests of organisations and individuals.

b. BLUEMARQ DEVELOPMENT’s security and CCTV systems operate 24 hours a day, seven days a week to maintain order and safety for Data Subjects, prevent crime, protect facilities, and support fire prevention and firefighting. BLUEMARQ DEVELOPMENT undertakes to Process the Data Subject’s Personal Data only in accordance with this Policy and applicable laws.

3. Processing Children’s Personal Data

a. BLUEMARQ DEVELOPMENT shall Process children’s Personal Data in accordance with the principles of protecting children’s rights and best interests. Before Processing a child’s Personal Data, BLUEMARQ DEVELOPMENT shall implement appropriate measures to verify the child’s age.

b. BLUEMARQ DEVELOPMENT may receive the Personal Data of children who are the children, relatives or dependants of Employees and Process such Personal Data for the Processing Purposes specified in Article 4 of this Policy. BLUEMARQ DEVELOPMENT shall Process children’s Personal Data only on the basis of an agreement with the relevant Employee and for the specified Processing Purposes. Before providing such information to BLUEMARQ DEVELOPMENT, the Employee is responsible for ensuring that:

– The child has been fully informed of the relevant Processing Purposes;

– Consent has been obtained from the child where the child is seven years of age or older; and

– Consent has been obtained from the child’s parent or legal guardian as required by law.

The above consent requirements shall not apply in the circumstances specified in Article 17 of Decree No. 13/2023/ND-CP dated 17 April 2023.

4. Overseas Transfer of Personal Data

a. BLUEMARQ DEVELOPMENT may transfer or grant overseas partners and service providers access to the Data Subject’s Personal Data so that it may be processed in accordance with the Processing Purposes consented to by the Data Subject. In certain circumstances, BLUEMARQ DEVELOPMENT’s partners or service providers established in Vietnam may use equipment or data-processing systems located outside the territory of Vietnam to Process Personal Data on behalf of BLUEMARQ DEVELOPMENT. Each of the above circumstances shall be regarded as an overseas transfer of the Data Subject’s Personal Data.

b. Data protection standards and practices in certain countries may provide a lower or higher level of protection than those applicable in Vietnam. Whenever Personal Data is transferred overseas, BLUEMARQ DEVELOPMENT shall use reasonable efforts to implement appropriate safeguards for the Data Subject’s Personal Data, including:

– Entering into data-protection and confidentiality agreements or undertakings;

– Selecting suitable Personal Data Processors and clearly defining their duties and responsibilities; and

– Engaging only partners that have implemented appropriate Personal Data protection measures.

Please note that, although BLUEMARQ DEVELOPMENT shall use reasonable efforts to ensure that the Data Subject’s Personal Data is protected to the greatest extent possible in accordance with applicable laws, BLUEMARQ DEVELOPMENT cannot completely eliminate every risk to Personal Data during Processing.

The transmission of information through the Internet or BLUEMARQ DEVELOPMENT’s internal information systems may involve certain risks arising from force majeure events or cybersecurity incidents and offences, including cyberattacks, cyberterrorism and unlawful cyberespionage. Such incidents may disrupt data-processing activities or result in the unauthorised disclosure of Personal Data.

If such an incident occurs, BLUEMARQ DEVELOPMENT shall promptly implement the necessary measures to prevent, remedy and minimise any possible unintended damage to Personal Data. BLUEMARQ DEVELOPMENT shall also cooperate with competent state authorities in investigating and addressing the relevant violation.

The Data Subject acknowledges and agrees that, to the extent BLUEMARQ DEVELOPMENT has implemented reasonable measures to prevent such risks, BLUEMARQ DEVELOPMENT shall not be liable for damage caused by the acts of a third party that adversely affect an Employee’s Personal Data and are not attributable to any fault of BLUEMARQ DEVELOPMENT.

BLUEMARQ DEVELOPMENT’s websites, mobile websites and applications may contain third-party advertisements and links to other websites, mobile websites or applications. Third-party advertising partners may collect information about Customers/Partners when they interact with such partners’ content, advertisements or services. Access to and use of third-party links or websites are not governed by this Policy. Instead, they are subject to the privacy policies of the relevant third parties. BLUEMARQ DEVELOPMENT is not responsible for the privacy or information-handling practices of any third party.

If Customers/Partners have any questions concerning this Policy or wish to exercise their rights relating to Personal Data, they may contact BLUEMARQ DEVELOPMENT through the following methods:

1. Contact BLUEMARQ DEVELOPMENT’s hotline using the information published on its official websites, mobile websites or applications from time to time.

2. Send written correspondence to the following address:

BLUEMARQ DEVELOPMENT Joint Stock Company
2W Ung Van Khiem Street, Thanh My Tay Ward, Ho Chi Minh City, Vietnam.

3. Contact BLUEMARQ DEVELOPMENT directly at any of its transaction offices nationwide.