PERSONAL DATA PROTECTION POLICY

a. Data voluntarily provided by you when using features on the Website:

• Registration for consultation: Full name, telephone number, email address (optional), province/city, district, address, and product(s) of interest;
• Messaging through the live chat function on the Website: Name, telephone number, email address, and message content;
• Placing orders and making payment: Full name, telephone number, email address, province/city, district, delivery address, order notes, and selected payment method (cash on delivery or bank transfer);
• Electronic warranty registration: Customer name, telephone number, address, province/city, product model, date of purchase, and place of purchase.

b. Data generated during transactions: order history, warranty registration history, and payment information.

c. Data collected automatically when you access the Website through cookies and online measurement and advertising tools integrated into the Website: IP address, device/browser type, access time, and pages/products viewed. This category of data is primarily used for statistical purposes, advertising measurement, and improvement of the Website experience. We do not use this category of data to directly identify you unless it is combined with the data referred to in item (a).

The provision of the above personal data is voluntary. However, for mandatory information fields (marked with *) for each feature, if you do not provide the required information in full, we may be unable to process the corresponding consultation request, order, or warranty registration. The Website and related services are not intended for persons under 16 years of age. If we become aware that personal data of a person under 16 years of age has been provided without the lawful consent of that person’s parent or guardian, we will delete such data promptly upon discovery.

2. Purposes of Personal Data Processing

2.1 Purposes relating to transactions and services provided to you:

• Receiving and confirming consultation requests and assisting you in selecting suitable products;
• Processing orders, including confirmation, delivery, installation, invoicing, payment, return, and periodic filter replacement;
• Receiving and processing electronic warranty registration requests;
• Receiving and resolving your complaints and feedback in order to improve the quality of products and services;
• Performing obligations in accordance with law, including issuing invoices and providing information to competent state authorities upon lawful request.

2.2 Purposes unrelated to transactions, which are carried out only with your consent:

• Sending information on new products, promotional programs, and marketing content from the Company, only where you have actively provided consent through a separate checkbox that is not selected by default in the relevant feature;
• Analyzing and improving Website content and user experience, and measuring and optimizing advertising through cookies and online measurement and advertising tools.

You have the right to customize your acceptance of each category of cookies (Necessary/Analytics/Marketing/Personalization), including accepting all, rejecting all, or customizing your choices, when you access the Website.

3. Retention, Deletion, and Destruction of Personal Data

Your personal data is stored in Vietnam on the Company’s management systems (SAP and Salesforce) in respect of data relating to consultation registration, ordering/payment, and electronic warranty registration, and/or on the platform of the messaging service provider (Pancake) in respect of data exchanged through the live chat function.

Data is retained until:

• You request the deletion of your personal data, except where deletion is not permitted by law;
• We have completed the purposes of collection and processing and determine that continued retention is no longer necessary;
• The retention period prescribed by law expires, or as required by a competent state authority.

We delete data within the applicable period prescribed by the decree guiding the current Personal Data Protection Law, by deleting electronic data or destroying paper documents, if any. Invoices and accounting records arising from purchase transactions are retained for at least 10 years in accordance with accounting laws.

4. Sharing of Personal Data

When you interact with the Website, certain data may be collected directly by third-party platforms and tools integrated into the Website in order to support Website operations, customer care, and marketing activities, such as customer data management platforms, messaging/live chat platforms, and online measurement and advertising tools. Each such platform or tool has its own personal data processing policy, which is independent from this Policy. We do not control and are not responsible for the policies or data processing practices of these third parties. Please refer directly to the policy of each third party on its official website. In addition, we do not sell or rent your personal data and only share data to the reasonable extent necessary for the purposes specified in Section 2 with:

• Partners providing delivery, installation, and product warranty services;
• Service providers providing payment, accounting, audit, and legal advisory services to the Company;
• Competent state authorities upon lawful request in accordance with law.

5. Use of Technology Platforms and Personal Data

The Company is a commercial enterprise operating in Vietnam and uses your personal data solely for its business activities within the territory of Vietnam. Certain technology platforms used by the Company to store data, such as SAP and Salesforce, may have servers located outside Vietnam. However, these platforms are used only as data storage tools. The Company does not transfer your personal data to its parent company or any other third party outside Vietnam for processing for that party’s own purposes. Responsibility for data security on these platforms rests with the relevant service providers in accordance with the applicable service agreements. If an actual need arises to transfer your personal data to a party outside Vietnam for processing, the Company will complete all required procedures under the 2025 Personal Data Protection Law and Decree No. 356/2025/ND-CP before carrying out such transfer.

6. Your Rights in Relation to Personal Data

You have the right to:

• Be informed of data processing activities and consent or refuse to consent to our processing of your personal data;
• Withdraw consent previously provided;
• Access, review, and request correction of your personal data;
• Request deletion of or restriction on the processing of your personal data;
• Object to processing and request the provision of your personal data;
• Lodge complaints, make denunciations, initiate legal proceedings, and claim compensation for damage in accordance with law.

To exercise the above rights, please contact us using the information provided in Section 9. We will receive and respond to your request as soon as reasonably possible in accordance with applicable personal data protection laws. For security purposes, we may require you to verify your identity before processing the request and may refuse the request where refusal is permitted by law or where necessary verification information has not been provided. Please note that withdrawal of consent or a request for data deletion may affect our ability to continue processing your consultation request, order, or warranty request.

7. Your Obligations

• Provide accurate and complete personal data and update it when changes occur;
• Protect your personal data, keep account login information confidential, and not share such information with third parties;
• Where you provide the personal data of another person, including a family member or authorized person, you represent that you have obtained that person’s lawful consent and are solely responsible for such provision.

8. Security Measures and Incident Handling

We apply appropriate technical and organizational measures, including firewalls, SSL connection encryption for payment transactions, and access controls, to protect personal data against unauthorized access, use, or disclosure. However, we cannot guarantee absolute security against sophisticated cyberattacks beyond the Company’s reasonable control. If an incident affecting personal data occurs, we undertake to proactively review and promptly address the incident and to fully comply with our notification obligations to the specialized personal data protection authority and affected data subjects, where applicable, within the time limits prescribed by Decree No. 356/2025/ND-CP and relevant laws.

9. Complaint Receipt and Resolution Mechanism

If you discover that your personal data has been used for purposes or within a scope inconsistent with this Policy, please contact us using the details below so that we may receive and coordinate the resolution of your complaint:

10. General Provisions

This Policy may be amended or updated from time to time to reflect the Company’s actual operations and applicable laws. The updated version will be published on the Website. By continuing to use the Website or providing personal data to us, you are deemed to have read, understood, and agreed to this Policy.

Effective date: 01/01/2026