Privacy Policy

Article 1. Scope and effective date

  1. DISC JOINT STOCK COMPANY, with enterprise code 0108468650 (hereinafter the “Company”), is the owner of the direct-sales e-commerce platform at the domain name discglobal.net (hereinafter the “Platform”).

  2. This policy applies to the Company’s processing of information and data through the Platform in accordance with the roles and responsibilities prescribed by law.

  3. This policy applies from October 9, 2026, but not before the Company has completed its public disclosure and satisfied the conditions for application under the law.

Article 2. Purposes and scope of collecting Users’ information

  1. Depending on the activity and in accordance with Article 3, the Company may collect directly, collect automatically, receive from lawful sources, or create the following groups of information and data, including through integrated tools and services:

    a) Identification, contact, demographic, occupational, organizational, account, authentication, preference, permission, and consent information;

    b) Information on needs, goods, services, transactions, contracts, payments, invoices, delivery and receipt, and related parties;

    c) Content, files, input data, output data, results, and reports that Users or other parties provide, create, synchronize, or allow access to;

    d) The content of communications, surveys, support, responses, requests, complaints, and related documents;

    dd) Information on devices, software, networks, IP addresses, identifiers, cookies, browser storage, location, logs, access sources such as websites, applications, or links that led Users to the Platform, usage activity, interactions, performance, errors, and security events;

    e) Information analyzed, aggregated, classified, evaluated, predicted, or inferred from the groups above.

  2. In accordance with Article 3, the Company may collect information and data for one or more of the following purposes:

    a) The Company sets up, authenticates, manages, and protects User accounts and profiles;

    b) The Company operates, integrates, maintains, and supports the Platform and provides goods, services, content, and results. The Company establishes, manages, performs, or terminates transactions, contracts, and agreements;

    c) The Company contacts, verifies, surveys, and provides customer care to Users and resolves requests, feedback, complaints, and disputes;

    d) The Company measures, analyzes, compiles statistics on, researches, tests, develops, and improves its operations, products, services, and technologies. The Company trains and evaluates models and algorithms and personalizes content and recommendations;

    dd) The Company carries out advertising, promotional, and marketing activities and measures their effectiveness;

    e) The Company ensures security and safety, and detects and handles errors, incidents, fraud, abuse, risks, and violations;

    g) The Company administers and reorganizes its operations, carries out accounting, tax, and audit work, protects lawful rights and interests, and complies with the law, the requirements of competent authorities, and lawful agreements.

Article 3. Scope of use of information

  1. The Company may process information and data, by itself or through other organizations and individuals, for the purposes set out in Article 2, within the scope, on the bases, and under the conditions permitted by law.

  2. The Company gives notice, provides explanations, offers choices, and obtains consent for each purpose when required by law, including when it changes the purpose or scope of processing or transfers data to another party.

  3. The Company may process de-identified data in accordance with the law.

Article 4. Information retention period or method for determining the information retention period

  1. The Company determines the retention period in line with the lawful processing purpose, taking into account the time needed to carry out transactions, resolve requests and disputes, and protect lawful rights and interests. The Company applies mandatory retention periods when prescribed by law.

  2. The Company deletes and destroys information and data in accordance with the law. Closing an account or terminating a transaction does not by itself end lawful retention.

Article 5. Organizations and individuals that may access personal information

In accordance with Article 3, the following organizations and individuals, inside or outside Vietnam, may be given access to personal information:

  1. Managers, employees, representatives, and departments authorized by the Company;

  2. Data processors, suppliers, and partners that support the activities set out in Article 2;

  3. Users, recipients, representatives, or parties related to a transaction, within the scope of the information they are entitled to access;

  4. Competent authorities, advisers, dispute resolution parties, parties that lawfully succeed to or take over the Company’s operations or assets, and other parties designated by the data subject or permitted by law to have access.

Article 6. Measures to secure Users’ information and data

The Company applies management, technical, and personnel measures to control access, protect accounts, systems, and data, manage access by other parties, and detect and handle incidents. The Company selects measures appropriate to its processing activities and the law, and reviews and updates them when necessary.

Article 7. Methods and procedures for data subjects to view, edit, or request the editing of their data on the Platform

  1. Data subjects may view and edit their data themselves using the functions on the Platform, if available, or send a request through the online contact methods that the Company publishes on the Platform. The sender states their identifying information, contact information, capacity, the relevant data, and what needs to be done.

  2. The Company receives and responds to the request and provides complete information about the procedure. The Company may ask for the information needed to verify identity or authority to represent, or to clarify the request. The Company carries out the request, or coordinates in carrying it out, and then gives notice of the result or of the reason for not carrying it out in accordance with the law.

  3. For a request to view, edit, or provide personal data made in accordance with the proper procedure, counting from receipt of the request, the Company responds within 2 working days and carries out the request within 10 days. The time limit for carrying out the request is 15 days if a personal data processor or a third party must be asked to edit the data. The maximum extension is 10 days under Clause 4 of this Article.

  4. The Company extends a time limit only once in each case set out in this policy, when the extension is necessary and reasonable due to the nature and complexity of the request. The Company gives notice of the reason and bears the burden of proof for the extension. When the law changes the time limits or the rules on extensions, the Company applies the rules in effect for the relevant request.

Article 8. Methods and procedures for receiving data subjects’ requests to delete, destroy, or restrict the processing of data they have provided

  1. The data subject sends the request under Clause 1 of Article 7, stating the data, the scope, and the measures requested. The Company applies the procedure in Clause 2 of Article 7. The Company may carry out the request in part or refuse it in accordance with the law, with notice of the reason.

  2. For a request to delete personal data made in accordance with the proper procedure, counting from receipt of the request, the Company responds within 2 working days and carries out the request within 20 days. The time limit for carrying out the request is 30 days if a personal data processor or a third party must be asked to provide, delete, or restrict the processing of the data. The maximum extension is 20 days under Clause 4 of Article 7.

  3. For a request to restrict processing, withdraw consent, or object to the processing of personal data made in accordance with the proper procedure, counting from receipt of the request, the Company responds within 2 working days and carries out the request within 15 days. The time limit for carrying out the request is 20 days if a personal data processor or a third party must be asked to stop processing. The maximum extension is 15 days under Clause 4 of Article 7.

  4. A request to restrict processing or to withdraw consent to the processing of personal data must be made in writing, including in electronic form or another verifiable format. The carrying out of these requests does not apply to processing activities that took place before the time of the request.

  5. For a request to delete or destroy data for which the law does not prescribe a different time limit, the Company carries out the request within 72 hours of the data subject’s request and notifies the data owner of the result.

Article 9. Methods and procedures for receiving and resolving data subjects’ complaints, requests, and feedback concerning information security

  1. The data subject sends a complaint, request, or feedback under Clause 1 of Article 7, stating the matter, the relevant data, the proposed measures, and any accompanying documents. This method also accepts requests to exercise other data rights in accordance with the law.

  2. For a request to implement personal data protection measures or solutions made in accordance with the proper procedure, counting from receipt of the request, the Company responds within 2 working days and carries out the request within 15 days. The maximum extension is 15 days under Clause 4 of Article 7.

  3. The Company applies Clause 2 of Article 7 and the time limits prescribed by law. For any part of the work for which no statutory time limit exists, the Company applies the corresponding time limits published on the Platform in its content on receiving and resolving feedback, requests, and complaints.