Personal data protection and information security policy

1.         Principles for processing personal data

a.        Personal data is processed only on the basis of the consent of the data subject, unless otherwise stipulated by law. The consent of the data subject must be expressed clearly and specifically in writing, voice, checking the consent box, consent syntax via text message, selecting consent technical settings or via a text message or other actions demonstrating this.

b.      UIC only process personal data for the purposes as provided for in this Policy and in relevant contracts/ agreements between UIC and Customer.

c.          Personal data will be processed by UIC fairly, transparently and in accordance with the law.

d.      UIC will apply necessary, reasonable and permissible measures to protect and secure the personal data of data subjects. To the extent permitted by law, UIC may store your personal data in Vietnam or oversea, including on cloud storage solutions.

e.        UIC only proceed personal data about children provided by their parents or legal guardians when the child is the insured in insurance contract or when the child is designated as the beneficiary. If you participate in an insurance contract for children 7 years of age or older or designate a child 7 years of age or older to be the beneficiary of insurance benefits, you hereby agree to the processing of personal data. your child’s personal data as governed by this Policy, and ensure that you have informed and obtained your child’s consent to UIC’s processing of your child’s personal data in accordance with this Policy.

2.         Types of personal data to be processed

            Depending on features, requirements of each type of products, services, or purpose for collecting personal data, UIC can process the following personal data:

            General personal data includes but not limited to: first name, middle name and birth name, other name (if any); date, month, year of birth; date, month, year of death or loss; gender; permanent address, temporary address, current address, contact address; country, nationality; image of individual; telephone number, ID card number/citizen identification number/personal identification number/passport number, driver license number, personal tax code, personal social insurance code, number of health insurance card; email address; marital status; personal image; information of family relationship; working place, salary; information of digital account of individual; personal data reflecting activities and history of activities in cyber environment; other information required or necessary for, or related to provision of our products/services such as history of buying insurance of the insurers, history of requesting for claim or settlement of career interest; and other information that pertains to a particular person or identifies a particular person that is not sensitive personal data.

            Sensitive personal data includes but not limited to: health condition and private life in medical record, including information of blood group; information about genetic characteristics which is inherited or  inherited or acquired genetic characteristics; information about an individual’s own biometric or biological characteristics; information of customers of credit institutions, branches of foreign bank, payment intermediary service providers and other licensed institutions, including: information about customer identification in accordance with the law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment intermediary service providers; data on violated activities which is collected/stored by state agencies, information of your location determined via location service, and other personal data which, under the laws, is typical and needed to have necessary security measure.

3.         Methods of collecting personal data

a.         UIC may collect information and personal data directly from data subjects or from third parties (which may include customers). Collection of personal data from third parties will be carried out on the basis of consent from the data subject.

b.         In case you provide personal data of another person (data subject) to UIC, you will undertake to have received all legal authorization or permission from the data subject to process such data.

c.         Personal data will be collected through lawful means, including but not limited to phone calls, messages, emails, forms, cookie (“Cookie” are data files created by websites you visit. By saving information about your visit, cookie help to make your online experience easier.)

d.         Personal data collected can be presented in paper form, electronic form or any other form that allows storage and retrieval when necessary.

4.         Purposes for processing personal data

            UIC will only process necessary personal data for the purposes specified in Article 2 Section 2 of this Policy.

5.         Provide personal data to third party

a.         For the purposes of processing data under this Policy, UIC reserves the right to provide, share, and transfer personal data to the following parties: director/manager/staff/representative of UIC to perform the works of UIC and to the extent in accordance with this Policy and contracts/ agreements between Customer and UIC, reinsurers, insurance ancillary service providers, claim settlement assistant, insurance agents (including but not limited to the individuals working for the organization operating in insurance agent, and individuals, organization providing insurance management providing service), insurance brokers, consultants, actuaries, contractors, suppliers, third party handling personal data under the contract with UIC (including company operating in research or survey and rating agency), owners/capital contributing members, parent companies, company being the member of the same group, other relevant partners of UIC in Vietnam and other countries and territories, the Insurance Association of Vietnam,  competent state agencies, anyone acting on your behalf, the payee, the beneficiary, correspondent bank or any party making payments to you, other parties with whom you approve or UIC has a legal basis to share personal data. The aforementioned third parties must perform the obligation to keep confidential the information provided and shared by UIC, in accordance with the agreement with UIC and the law of Vietnam and host country (if any).

b.         For transfer of personal data abroad (if any) according to Article 5.a of Section III above, UIC will require the receiving party to ensure compliance with the laws of Vietnam and the host country on transferring personal data.

6.         Time for processing data

UIC and the party which is permitted/ authorized by UIC will be entitled to process personal data as from the time when the data is declared and provided to UIC or the party which is permitted/ authorized by UIC and until such data is not necessary to satisfy the purposes for processing data or the laws provide for other requirement.

7.         Rights and obligations of data subject

a.         Rights of data subject

UIC, to the extent possible and reasonable and unless otherwise provided by law, will ensure that data subjects exercise their rights to their personal data under Decree 13, including:

–              The right to know about the process of their personal data;

–              The right to consent or not consent to process their personal data;

–              The right to access to view, edit or request correction of personal data;

–              The right to withdraw consent to the processing of personal data;

–              The right to request to delete personal data;

–              The right to restrict processing personal data;

–              The right to request to provide yourself with your personal data;

–         The right to object to process personal data in order to prevent or restrict the disclosure of personal data or use for the purpose of advertising and marketing;

–              The right to complain, denounce or sue in accordance with laws;

–            The right to request compensation for damages in case of violation of regulations on personal data protection;

–           The right to self-protect, or request competent agencies and organizations to implement methods to protect civil rights under the law.

UIC can request customer to pay relevant fee which is direct and necessary for conduct these requests.

b.         Obligations of data subject

–          Ensure that the personal data provided to UIC is accurate, adequate, updated and legitimate. Any failure to the aforesaid obligation may result in contracts/agreements (including but not limited to, insurance policy) being null and void, terminated, or claim being rejected.

–          Timely notify UIC any changes to provided personal data; comply with all requirements applicable to customer regarding your provision of personal data under the laws.

–       Keep confidential your personal data, do not let your personal data be used, stolen, edited, or disclosed illegally, such as sharing or revealing your login name or password of trading account. UIC will not be responsible for your losses or damages related to personal data that are not due to UIC’s fault.

c.        If the data subject does not consent or restrict or withdraw his or her consent to process his or her personal data, the insurance policy and related contracts/agreements, as the case may be, may not be executed or terminated since the parties do not have a basis to perform relevant rights and obligations under the contract relating to such personal data, and UIC will reserve its reasonable rights and lawful remedies in such cases.