Personal Data Protection Policy

 

The Personal Data Protection Policy for Customers of Galaxy Holdings/ Galaxy Telecom (hereinafter referred to as "Policy") aims to inform Customers about their Personal Data processed by Galaxy Holdings/ Galaxy Telecom, the purpose of processing, method of processing, storage period, rights and obligations of Customers regarding their Personal Data in accordance with Vietnamese law on Personal Data protection. This Policy also provides recommendations to help Customers raise awareness about Personal Data protection.

This Policy is an inseparable part of the Mobile Information Service Provision and Use Contract, the Subscriber Information Confirmation for Mobile Information Service Registration, General Transaction Conditions for Mobile Information Services, and other contracts and general terms that Customers have entered into with Galaxy Holdings/ Galaxy Telecom. This Policy applies to all product and service provision activities of Galaxy Holdings/ Galaxy Telecom and applies across all platforms interacting with Customers, including digital environments.

By checking the box "I have read and agree" or "I agree with Galaxy Holdings/ Galaxy Telecom's Policy and Terms of Use" or by signing a contract, entering into a model contract, general transaction conditions with Galaxy Holdings/ Galaxy Telecom, or by continuing to register, log in, use the website/app of Galaxy Holdings/ Galaxy Telecom or use products and services of Galaxy Holdings/ Galaxy Telecom without any complaints, Customers confirm that they have carefully read, clearly understood, and voluntarily accepted the entire content of this Policy without deception or coercion.

Article 1. Definitions and Abbreviations

Within the scope of this Policy, the following terms are understood and interpreted as follows:

1.1Galaxy Holdings is Galaxy Digital Holdings LLC. 

1.2 Galaxy Telecom is Galaxy Telecom LLC. 

1.3 Customer is: 

1. -           Individuals or their legal representatives who use and/or are interested in the products and services of Galaxy Holdings/ Galaxy Telecom/ Parent company/ Subsidiaries/ Member companies of Galaxy Holdings;

   -           Individuals or their legal representatives who have accessed and/or registered accounts on websites/applications owned by Galaxy Holdings/ Galaxy Telecom/ Parent company/ Subsidiaries/ Member companies of Galaxy Holdings/ Galaxy Telecom.

1.4 Products and services of Galaxy Holdings/ Galaxy Telecom are: 

1. -           Products and services directly researched, developed, and provided to Customers by Galaxy Holdings/ Galaxy Telecom;

   -           Products and services provided to Customers by Galaxy Holdings/ Galaxy Telecom in cooperation with partners.

1.5 Personal Data is information in the form of symbols, letters, numbers, images, sounds, or similar forms associated with a specific person or that helps to identify a specific person.

1.6 Processing Personal Data is one or more activities impacting personal data, such as: collection, recording, analysis, confirmation, storage, editing, disclosure, combining, accessing, retrieving, recalling, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data or other related actions.

Article 2. Types of Personal Data processed

2.1. Customer's personal data processed by Galaxy Holdings/ Galaxy Telecom (hereinafter referred to as "Personal Data") includes the following information and may change depending on the type of product or service, and the way Customers interact with Galaxy Holdings/ Galaxy Telecom (Galaxy Holdings/ Galaxy Telecom will specifically notify of any changes (if any) and obtain the data subject's consent for such changes):

2.1.1. Basic Personal Data

a) Full name, middle name and birth name, other names (if any);

b) Date of birth; date of death or disappearance;

c) Gender;

d) Place of birth, place of birth registration, permanent residence, temporary residence, current address, hometown, contact address;

e) Nationality;

f) Individual images, including images provided by the Customer when registering for the service, images uploaded by the Customer on Galaxy Holdings/ Galaxy Telecom's applications/websites during service usage;

g) Phone number, ID card number, personal identification number, passport number, driver's license number, vehicle registration number, personal tax code, social insurance number, health insurance card number;

h) Marital status;

i) Information about family relationships (parents, children);

j) Information about individual digital accounts;

k) Data on consumption behavior reflecting activities and historical activities on the network space of Customers when using Galaxy Holdings/ Galaxy Telecom products and services (online behavior; frequency, average duration of calls, messages, customer care calls; device type; operating system; 4G/5G device user ratio; time, data volume used for domestic network, international roaming; international roaming packages; form and amount of phone top-up and usage; service payment time; prepaid or postpaid SIM; value-added service registration rate; short/long data package registration rate);

l) Telecommunications credit score of Customers: expressed as a score, which is the result of Galaxy Holdings/ Galaxy Telecom's process of processing and analyzing data of Customers using Galaxy Holdings/ Galaxy Telecom products and services;

m) Information from mobile device usage: phone configuration, version information of applications on the phone, customer's phone book;

n) Other information associated with a specific person or helping to identify a specific person not falling under Clause 2.1.2 of this Article.

2.1.2. Sensitive Personal Data

a) Data on crimes, criminal acts collected and stored by law enforcement agencies;

b) Customer information of credit institutions, foreign bank branches, payment intermediary service providers, and other authorized organizations, including: customer identification information as regulated by law, account information, deposit information, asset deposit information, transaction information, information about organizations and individuals that are guarantors at credit institutions, bank branches, payment intermediary service providers;

c) Data on an individual's location determined through location services.

d) Political views, religious views;

e) Health status and private life recorded in medical records, not including blood type information;

f) Information related to racial origin, ethnic origin;

g) Information about an individual's inherited or acquired genetic characteristics;

h) Information about an individual's physical attributes, unique biological characteristics;

i) Information about sexual life, sexual orientation of the individual;

j) Data on trade union membership;

k) Data on an individual's financial situation;

l) Information on the social origin of individuals;

m) Personal data of children identified as under 7 years old by Galaxy Holdings/ Galaxy Telecom;

n) Information on accounts of subjects engaged in communication activities, online activities, including call history, message history, email history.

Article 3. Purposes of Personal Data Processing

Galaxy Holdings/ Galaxy Telecom processes Personal Data for the following purposes:

3.1. To identify Customers during the process of providing and using Galaxy Holdings/ Galaxy Telecom's products and services, including:

a) Registering and creating Customer accounts on Galaxy Holdings/ Galaxy Telecom's systems (websites, applications, etc.);

b) Processing transactions, providing products and services requested by Customers;

c) Customer care, handling complaints, troubleshooting, and resolving Customer issues.

3.2. To research, develop, and improve product and service quality:

a) Collecting Customer feedback and suggestions on Galaxy Holdings/ Galaxy Telecom's products and services;

b) Analyzing Customer usage trends and behavior to optimize products and services, and develop new features or products;

c) Conducting surveys, market research, and customer satisfaction assessments.

3.3. To manage and operate business activities:

a) Managing customer relationships, contracts, and payment information;

b) Risk management, fraud prevention, and security assurance for the system;

c) Internal audit, data analysis, and reporting for business planning.

3.4. To comply with legal obligations:

a) Fulfilling legal requirements, judicial orders, and requests from competent state agencies;

b) Implementing regulations on personal data protection and other relevant laws.

3.5. Other purposes as agreed upon by the Customer and Galaxy Holdings/ Galaxy Telecom, or as required by law.

Article 4. Sources of Personal Data Collection and Processing Methods

4.1. Sources of Personal Data Collection:

a) Data directly provided by the Customer: Personal Data is collected from the Customer through their registration for services, use of products, interactions on websites/applications, or direct communication with Galaxy Holdings/ Galaxy Telecom.

b) Data collected from third parties: Galaxy Holdings/ Galaxy Telecom may collect Personal Data from partners, service providers, or other legal sources if the Customer has consented to the sharing of their data with these third parties or data storage sources, and Customers agree that Galaxy Holdings/ Galaxy Telecom may collect, store, process, and use this information;

c) Data from competent authorities: To comply with its obligations under current law, Galaxy Holdings/ Galaxy Telecom may also receive Customer data from competent authorities.

4.2. Galaxy Holdings/ Galaxy Telecom may process Customer's personal data in the following ways and forms:

a) Depending on the purpose of processing Customer's personal data in each specific case, Galaxy Holdings/ Galaxy Telecom may apply appropriate processing methods including but not limited to automatic personal data processing methods (through cookies and/or other related technologies), non-automatic or other methods ensuring data protection requirements.

b) During data processing, Galaxy Holdings/ Galaxy Telecom applies one or more activities impacting personal data such as: collection, recording, analysis, confirmation, storage, editing, publicizing, combining, accessing, retrieving, revoking, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying data, personal data or other related actions.

c) Galaxy Holdings/ Galaxy Telecom may directly or through a personal data processor process Customer's data in accordance with current legal provisions.

d) To achieve the purposes of processing Customer's personal data, Galaxy Holdings/ Galaxy Telecom may transfer Customer's personal data abroad and/or to locations outside the territory of Vietnam. Galaxy Holdings/ Galaxy Telecom will comply with the requirements of Vietnamese law, the law of the country/territory to which the data is transferred, and apply necessary measures to protect Customer's personal data.

Article 5. Start and End Time of Data Processing

5.1. Start time of data processing: From the time the Purposes specified in Article 3 are initiated, or from the time the Customer consents to the processing of Personal Data by Galaxy Holdings/ Galaxy Telecom.

5.2. End time of data processing:

a) When the purposes of processing Personal Data have been completed, or when the storage period specified in Article 9 of this Policy expires;

b) When the Customer requests to revoke consent for data processing, delete data, or destroy data, unless otherwise provided by law.

Article 6. Organizations and Individuals allowed to process Personal Data

6.1. Galaxy Holdings/ Galaxy Telecom processes Personal Data and ensures compliance with Vietnamese law on personal data protection.

6.2. Galaxy Holdings/ Galaxy Telecom may share Personal Data with the following organizations and individuals for the purposes specified in Article 3:

a) Partners and service providers cooperating with Galaxy Holdings/ Galaxy Telecom to provide products and services to Customers (e.g., payment gateways, logistics partners, marketing agencies). These parties are committed to protecting Personal Data in accordance with this Policy and legal regulations.

b) Affiliates, subsidiaries, or member companies within the Galaxy Holdings ecosystem for internal management, business operations, and comprehensive service provision to Customers.

c) Competent state agencies, when requested in accordance with legal provisions.

d) Other organizations or individuals if consented to by the Customer or as required by law.

Article 7. Rights of the Customer regarding Personal Data

Customers have the following rights regarding their Personal Data:

7.1. Right to be informed

Customers have the right to be informed of the processing of their Personal Data, except as provided by law.

7.2. Right to Consent

Customers have the right to consent or not consent to the processing of their Personal Data, except in cases where consent is not required by law.

7.3. Right to Access

Customers have the right to access their Personal Data to view, correct, or request correction of their Personal Data by Galaxy Holdings/ Galaxy Telecom, unless otherwise provided by law.

7.4. Right to Withdraw Consent

Customers have the right to withdraw their consent to the processing of Personal Data by Galaxy Holdings/ Galaxy Telecom, unless otherwise provided by law.

7.5. Right to Delete Data

Customers have the right to request Galaxy Holdings/ Galaxy Telecom to delete their Personal Data, unless otherwise provided by law.

7.6. Right to Restrict Data Processing

Customers have the right to request Galaxy Holdings/ Galaxy Telecom to restrict the processing of Personal Data, unless otherwise provided by law.

7.7. Right to Object to Data Processing

Customers have the right to object to the processing of their Personal Data, unless otherwise provided by law.

7.8. Right to Data Portability

Customers have the right to request Galaxy Holdings/ Galaxy Telecom to provide their Personal Data in a structured, commonly used, and machine-readable format, unless otherwise provided by law.

7.9. Right to Complain, Denounce, and Sue

Customers have the right to complain, denounce, or sue in accordance with legal provisions.

7.10. Right to Claim Damages

Customers have the right to claim damages in accordance with legal provisions when there is a violation of regulations on personal data protection, unless otherwise agreed by the parties or stipulated by law.

7.11. Right to Self-Protection

Customers have the right to self-protect in accordance with the Civil Code, other relevant laws, and Decree 13/2023/ND-CP on personal data protection (and any amending or replacing documents), or to request competent agencies or organizations to implement civil rights protection methods as stipulated in Article 11 of the Civil Code.

Article 8. Customer Obligations

Customers are responsible for protecting their Personal Data as follows:

8.1. Actively implement measures to protect, manage, and safely use accounts and personal technological devices (including devices such as smartphones, computers, tablets, laptops, and other devices) by logging out after use, setting a strong password, and keeping their login information and password confidential. The aforementioned measures for safe account and mobile device use help prevent unauthorized access to Customer accounts. Galaxy Holdings/ Galaxy Telecom is exempted from liability for Customer's damages in cases where Customer's password is exposed/lost, stolen, leading to unauthorized account access, or any activity on Customer's account used on a lost or misplaced mobile device leading to unauthorized service use, or if Galaxy Holdings/ Galaxy Telecom's system is illegally compromised by a third party despite Galaxy Holdings/ Galaxy Telecom having implemented all necessary measures to protect the system (unless due to Galaxy Holdings/ Galaxy Telecom's fault);

8.2. Having accepted all terms and conditions of this Policy, Customers are responsible for providing complete and accurate Personal Data as requested by Galaxy Holdings/ Galaxy Telecom and are responsible for immediately notifying Galaxy Holdings/ Galaxy Telecom upon detecting any violation of personal data protection regulations;

8.3. Customers are responsible for respecting the Personal Data of other data subjects and for complying with legal provisions on Personal Data protection, participating in preventing and combating violations of Personal Data protection regulations.

Article 9. Personal Data Storage

9.1. Customer's Personal Data stored by Galaxy Holdings/ Galaxy Telecom will be kept confidential. Galaxy Holdings/ Galaxy Telecom is responsible for implementing measures to protect Customer's Personal Data in accordance with legal provisions.

9.2. Location of Personal Data Storage: Within the scope permitted by law, Galaxy Holdings/ Galaxy Telecom may store Customer's Personal Data in Vietnam and abroad, including on cloud computing storage solutions. Galaxy Holdings/ Galaxy Telecom applies data security standards consistent with current legal provisions. The transfer of personal data abroad must comply with the provisions of Article 25 of Decree 13/2023/ND-CP (as amended, supplemented, or replaced from time to time) and other legal provisions.

9.3. Personal Data Storage Period: Galaxy Holdings/ Galaxy Telecom only stores Customer's Personal Data for the period necessary to achieve the purposes for which the data was collected or as required by law. After this period, Personal Data will be deleted or anonymized in accordance with legal regulations.

Article 10. Protection of Personal Data of Minors

10.1. Galaxy Holdings/ Galaxy Telecom acknowledges the importance of protecting the Personal Data of minors. If Personal Data of a minor is processed, Galaxy Holdings/ Galaxy Telecom will ensure compliance with legal provisions on personal data protection for minors.

10.2. In cases where the processing of Personal Data of a minor requires consent from their parent or guardian, Galaxy Holdings/ Galaxy Telecom will implement necessary measures to verify and obtain this consent.

Article 11. Security Measures for Personal Data

Galaxy Holdings/ Galaxy Telecom implements appropriate technical and organizational security measures to protect Personal Data from unauthorized access, alteration, disclosure, loss, or destruction. These measures include:

11.1. Applying advanced security technologies: Using encryption, firewalls, intrusion detection systems, and other advanced security technologies to protect data on systems and networks.

11.2. Access control: Implementing strict access control policies to Personal Data, ensuring that only authorized personnel can access the data based on their job requirements.

11.3. Regular security audits and assessments: Conducting regular security audits and assessments to identify and address potential vulnerabilities in the system.

11.4. Employee training: Providing regular training to employees on personal data protection and security policies to raise awareness and ensure compliance.

11.5. Incident response plan: Developing and maintaining an incident response plan to promptly and effectively handle any personal data security incidents.

Article 12. Consequences of not providing Personal Data

In cases where Customers do not provide or provide incomplete or inaccurate Personal Data as required by Galaxy Holdings/ Galaxy Telecom, it may lead to the following consequences:

12.1. Inability to use products and services: Customers may not be able to register for, access, or use certain products or services of Galaxy Holdings/ Galaxy Telecom that require specific Personal Data.

12.2. Limited service quality: The quality of services or customer support provided by Galaxy Holdings/ Galaxy Telecom may be affected if accurate and complete Personal Data is not available.

12.3. Legal and regulatory compliance issues: Failure to provide required Personal Data may lead to non-compliance with legal regulations, affecting the Customer's rights and obligations.

Article 13. Changes to the Policy

Galaxy Holdings/ Galaxy Telecom may update or amend this Policy from time to time to ensure compliance with legal regulations and reflect changes in its data processing activities. Any significant changes will be notified to Customers through official channels. Customers are encouraged to regularly review the Policy to stay informed about how their Personal Data is being protected.

Article 14. Contact Information

Customers can contact Galaxy Holdings/ Galaxy Telecom for questions or requests related to personal data protection using the information below:

14.1. Contact the hotline using the information on Galaxy Holdings/ Galaxy Telecom's official websites/applications at the relevant time.

14.2. Send official correspondence to the following addresses:885 Hong Ha Street, Chuong Duong Do, Hoan Kiem, Hanoi.

14.3. Contact directly at Galaxy Holdings/ Galaxy Telecom's transaction points nationwide.

14.4. Other contact methods such as Livechat (online chat software), contact via Galaxy Holdings/ Galaxy Telecom's official fanpage (electronic information page), customer care email provided to Customers at all times.