RULES AND POLICIES FOR CONSUMER INFORMATION PROTECTION
(Issued together with Decision No. 010/QĐ-TTC-2024 dated June 22,2024 of Tam Trinh Coffee Import-Export Company)
CHAPTER I. GENERAL PROVISIONS
Article 1. Purpose
  1. These Rules and Policies set forth the principles, purposes, scope, methods of collection, storage, use, modification, update, cancellation, sharing, disclosure, transfer, confidentiality and security assurance of consumers’ information at Tam Trinh Coffee Import-Export Company (hereinafter referred to as the Company).
  2. These Rules and Policies also establish a mechanism for consumers to choose whether to allow or disallow the Company to share, disclose, or transfer their information to third parties; use the information to advertise, introduce products, goods, services and other commercial activities.
Article 2. Scope of application
  1. Applicable to the Company’s collection, storage, use, modification, update, deletion, sharing, disclosure, transfer or processing of consumer information when consumers register for an account, sign up as a Distributor, register as a Loyalty Customer, make purchases, use services, participate in the Company’s programs, provide feedback, submit requests, file complaints or interact with the Company.
  2. Applicable to information processed via the Company’s website, applications/software, network management systems, paper forms, contracts, purchase orders, emails, phone calls, text messages, social media, points of sale, business premises or other legitimate channels.
  3. Applicable to all departments, divisions, officials, employees, workers, technical collaborators, system administrators, distributors, and third parties hired or authorized to process consumer information.
Article 3. Interpretation of Terms
  1. Consumer information includes consumers’ personal information; information related to the process of purchasing and using products, goods and services; account information; transaction information; Information reflecting feedback, requests, complaints and other information related to transactions between consumers and the Company.
  2. Personal information of a consumer refers to information in the form of symbols, text, numerals, images, sounds or similar formats that is associated with a specific consumer or helps to identify a specific consumer.
  3. Information processing refers to one or more operations affecting consumer information, including collection, recording, analysis, verification, storage, modification, disclosure, combination, access, retrieval, recovery, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction, or other related activities.
  4. Third parties are organizations and individuals that are not part of the Company but are hired, authorized, or collaborate with the Company to carry out part of the consumer information processing activities, including: system development/operation units, data storage providers, delivery service providers, payment service providers, customer service teams, audit firms, legal and financial consulting firms, or competent authorities and organizations as stipulated by law.
Article 4. Principles for the protection of consumer information
  1. Collect and use information for the correct purposes, within the notified scope, and only to the extent necessary for transaction activities, customer management and care, resolution of requests/complaints, fulfillment of legal obligations, and other legitimate purposes.
  2. Provide clear, public notice in an appropriate form before collecting and using information, and establish mechanisms for consumers to choose whether to consent or not, unless otherwise provided by law.
  3. It shall not be assumed that consumers consent to the use of their information for advertising, product, goods and service promotion purposes, or the transfer of their information to third parties, except as permitted by law.
  4. Ensure information security and safety; prevent acts of theft, unauthorized access, unauthorized use, modification, updating, and unauthorized deletion of consumer information.
  5. Guarantee the rights of consumers to inspect, correct, update, delete, transfer, or request the cessation of the transfer of their personal information to third parties in accordance with legal provisions.
  6. It is prohibited to trade, exchange, disclose, or use consumer information beyond the notified purposes and scope or outside the limits permitted by law.
CHAPTER II. INFORMATION COLLECTION, USE AND STORAGE
Article 5. Scope of Information Collected and Used
  1. Full name, date of birth, gender, and nationality (if applicable).
  2. Phone numbers, email addresses, contact information, delivery addresses, residential addresses, or other addresses provided by consumers.
  3. Identification information provided by consumers in accordance with regulations or as required for registration/contract conclusion, including citizen identity card/people’s identity card/passport number or equivalent documents, date of issue and place of issue where necessary.
  4. Account information, customer codes, distributor codes, loyalty customer codes, and information on lines/sponsorships/designations/ranks/titles within the scope necessary for the operation of the multi-level sales system and the management of related benefits.
  5. Order information, purchase history, purchased products, transaction value, payment method, payment vouchers, invoices, delivery, returns and exchanges, warranty, and refunds.
  6. Consultation content, feedback, requests, complaints, contact history, and images/videos/proof documents provided by consumers when case handling is required.
  7. Technical data generated when consumers transact on the Company’s website, application or electronic system, such as IP address, access time, device, browser, cookie or similar data in accordance with the policy announced from time to time.
Article 6. Purposes of Collection and Use of Information
  1. Register, verify, and manage accounts; register as a Distributor, Loyal Customer, or establish other transactional relationships with the Company.
  2. Establish, execute, manage, and store contracts, purchase orders, and product, goods, and service sales and purchase transactions.
  3. Delivery, payment, reconciliation, issuance of invoices/documents, warranty, return and exchange, refund, customer care, and resolution of feedback, requests, complaints and disputes.
  4. Manage the sales system, network management system, or related obligations in accordance with the provisions of the law on multi-level sales and the lawful internal regulations of the Company.
  5. Improve the quality of products, goods and services; enhance user experience; ensure system security; prevent fraud, forgery, violations of the Company’s regulations or illegal acts.
  6. Notify information related to transactions, products, policies, safety warnings, product recalls, legal updates, or obligations required by law.
  7. Provide information to competent state agencies or other entities in cases where there is a legal request or in accordance with the provisions of the law.
Article 7. Methods of information collection
  1. Information is collected directly from consumers via the website tamtrinhcoffee.com , export.tamtrinhcoffee.com, network management system, registration forms, contracts, purchase orders, emails, phone calls, messages or other legal means.
  2. On the registration interface or information collection form, the Company provides relevant notices/policies and a mechanism for consumers to read, confirm their consent or disagreement before submitting information to the system, unless otherwise provided by law.
  3. If the consumer does not consent to the mandatory processing of information required for the Company to establish or execute a transaction/registration, the Company may refuse to carry out the corresponding transaction/registration if it does not have sufficient necessary information to fulfill its obligations to the consumer.
  4. For non-mandatory purposes such as advertising, marketing, or sharing information with third parties outside the scope necessary to execute transactions, the Company must provide a separate opt-in/opt-out mechanism for consumers to give or withhold their consent.
Article 8. Notification Prior to Collection and Use of Information
  1. Before collecting and using information, the Company shall clearly specify the type of information to be collected, the purpose of collection, the scope of use, the storage period, the entities that may access the information, the consent/non-consent selection mechanism, and the rights of consumers.
  2. The company is not obligated to provide notification in cases where the information has already been disclosed by the consumer or in other cases as stipulated by law.
  3. If the Company changes the purpose and scope of use of the notified information, the Company must provide a new notification and obtain the consumer’s consent before using the information for the new purpose and scope, unless otherwise provided by law.
Article 9. Information Retention Period
  1. Consumer information is stored for the period necessary to fulfill the purposes of collection, conduct transactions, manage accounts, provide customer support, resolve complaints and disputes, fulfill the Company’s accounting, tax, reporting, archiving and other legal obligations.
  2. The minimum retention period for registered account information on the system is 02 years from the date of account/transaction termination or the date the information expires, unless specialized legislation requires a longer retention period, or further retention is necessary to resolve complaints, disputes, inspections, examinations, audits, or to protect the legitimate rights and interests of the Company/consumers.
  3. When the storage period expires or the processing purpose no longer exists, the Company shall delete, destroy, anonymize, or apply appropriate technical measures to restrict the further use of the information, unless otherwise required by applicable laws to continue retaining the information.
CHAPTER III. MECHANISM FOR SELECTION, SHARING AND ACCESS TO INFORMATION
Article 10. Mechanism for consumers to choose to agree or disagree
  1. Consumers can make separate choices for each of the following matters:(i) sharing, disclosing, or transferring information to third parties; (ii) use the information for advertising, promoting products, goods, services and other activities of a commercial nature.
  2. Consumers’ choices may be expressed by means of direct signature, ticking a box on a website/application, confirmation via email, message, valid recorded call, or other legally valid methods that leave a verifiable trail.
  3. The company does not pre-select consent for advertising/marketing or sharing information with third parties, except as permitted by law.
  4. Consumers have the right to modify, withdraw their consent, request the cessation of advertising, and stop the sharing/transfer of information to third parties at any time through the channels announced by the Company.
Article 11. Sharing, disclosure or transfer of information to third parties
  1. The Company only shares, discloses or transfers consumer information to third parties with the consent of the consumer; necessary for selling and supplying products, goods and services as required by consumers; necessary for third parties to store, analyze, and operate systems serving the Company’s business operations, provided that the two parties have a written agreement on information protection responsibilities; at the request of a competent state authority; or in other cases as prescribed by law.
  2. When hiring or authorizing a third party to process consumer information, the Company must do so in writing, clearly specifying the scope of processing, processing purposes, types of information, confidentiality responsibilities, incident handling responsibilities, the obligation not to use the information beyond the specified scope, and the obligation to return/delete/destroy the information upon termination of the cooperation.
  3. Third parties that are granted access to information must commit to confidentiality, use the information only for the intended purposes and within the assigned scope, and implement protection measures commensurate with the nature of the information being processed.
  4. The Company shall not trade, exchange, or indiscriminately provide consumer information to organizations or individuals that lack the authority or legal basis to receive such information.
Article 12. Entities that may access consumer information
  1. Consumers are the subjects of their information and have the right to access and verify their personal information in accordance with the law.
  2. The Board of Directors, Data Governance Department, System Engineering/Information Technology Department, Customer Care Department, Business Department, Accounting Department, Legal Department and other relevant departments of the Company shall only access information within the scope of their assigned functions and responsibilities.
  3. The entity that develops, operates and maintains the website/system; the data storage entity; the delivery entity; the payment entity; legal counsel; the party handling complaints and disputes; Competent state agencies shall have access to information within the necessary scope and on legal grounds.
  4. Sponsors, referrers, upstream distributors, or entities belonging to the designated/affiliated system shall only be provided with the information necessary for system management, connectivity, and the exercise and performance of legitimate rights and obligations.
Article 13. Delegation of authority for data access on the system
  1. The Company implements the principle of access rights allocation based on job position and legitimate usage needs; each individual is only granted access rights appropriate to their assigned responsibilities.
  2. Full access to sensitive personal information is only granted to the consumer account holder, the Board of Directors, the Data Governance Department, and individuals/departments assigned under valid official designation from the Company.
  3. In the organizational chart/line system, the system only displays the information necessary to support business organization management, such as codes, assigned/supervised lines, titles, ranks, and operational status; Other sensitive information must be hidden or restricted based on access permissions.
  4. System access accounts must be managed separately and must not be shared; Access rights must be reviewed periodically or when personnel change positions, leave employment, have their contracts terminated, or no longer hold related responsibilities.
CHAPTER IV. INFORMATION SECURITY, SAFETY AND INCIDENT HANDLING
Article 14. Measures for technical safety assurance and management
  1. Encrypt transmission channels using SSL/TLS certificates or equivalent technical measures to protect data transmitted between consumers’ devices and the Company’ s servers/systems.
  2. Perform regular data backups to ensure data integrity and recoverability in the event of system failures; backup data must be protected against unauthorized access, modification, deletion, or use.
  3. Implement measures for account management, password management, authentication, authorization, and logging of access, modification, and data export activities where supported by the system.
  4. Restrict the downloading, printing, copying, and transmission of consumer data via personal email, personal devices, or channels that have not been approved by the Company.
  5. Train, guide, and require personnel with information access rights to commit to confidentiality; handle violations in accordance with the company’s internal regulations, rules, and legal provisions.
  6. Periodically review and update security measures to align with risk levels, the nature of information, and legal requirements.
Article 15. Strictly Prohibited Acts
  1. Collecting, storing, using, modifying, updating, or deleting consumer information in violation of legal regulations, these Rules and Policies, or beyond the approved scope.
  2. Accessing, copying, downloading, printing, disclosing, or transferring consumer information without authorization or legitimate work-related requirements.
  3. Using consumer information for personal, advertising, marketing, sales, or other commercial purposes when the consumer has not given consent or has withdrawn their consent.
  4. Selling, exchanging, or providing consumer information to third parties without legal basis.
  5. Obstructing consumers from exercising their right to inspect, correct, update, delete, transfer, or cease the transfer of information in accordance with regulations.
  6. Unauthorizedly losing, disclosing, damaging, modifying, deleting, or destroying consumer data, or failing to report incidents in accordance with regulations.
Article 16. Handling of information safety and security incidents
  1. Upon detecting or suspecting unauthorized access, leakage, loss, misuse, unauthorized modification or deletion of consumer information, the individual/department that identifies the incident must immediately report it to the System Engineering/Information Technology Department, the Legal Department, and the competent management authority.
  2. The company shall promptly conduct an investigation, isolate risks, lock affected accounts or functions, retrieve incorrectly sent data where possible, request third parties to suspend processing if the incident involves a third party, and implement preventive and remedial measures.
  3. The company assesses the scope, type of affected information, number of affected consumers, cause, time of detection, risk of harm, and remedial measures.
  4. In the event that an information system is compromised, creating a risk to the information safety and security of consumers, the Company or the relevant information storage party shall notify the competent state regulatory authority within 24 hours from the time of detection and take all necessary measures in accordance with legal provisions.
  5. Depending on the nature and severity of the incident and legal requirements, the Company will notify affected consumers of the types of information that may have been compromised, the measures that have been and are being implemented, recommendations for self-protection, and available support contact channels.
  6. Incident records must be stored, their causes assessed, and preventive measures must be implemented to prevent recurrence.
CHAPTER V. CONSUMER RIGHTS AND MECHANISM FOR RECEIVING CONSUMER CLAIMS
Article 17. Consumers’ rights regarding their personal information
  1. To be informed about the Company’s collection, storage, use, sharing, disclosure, transfer and protection of your personal information.
  2. You may choose to consent or object to non-mandatory processing purposes, in particular for advertising, product, goods and service promotion, and the sharing/transfer of information to third parties.
  3. Be subject to inspection, request revisions, and update inaccurate, incomplete, or no longer relevant information.
  4. Be entitled to request the cancellation, deletion, hiding, transfer or cessation of transfer of information to third parties when the conditions are met in accordance with the provisions of the law.
  5. Withdraw the consent that has been provided, except in cases where continued processing of information is necessary to fulfill legal obligations, resolve disputes, protect the legitimate rights and interests of the Company/consumers, or as otherwise permitted by law.
  6. To receive feedback, requests, and complaints when they believe their personal information is being collected without authorization, used for improper purposes, outside the notified scope, or subject to information safety and security breaches.
Article 18. Means and tools for consumers to update, edit, and delete information
  1. Consumers can check the information themselves via their registered account.
  2. Consumers may submit requests to inspect, correct, update, cancel, transfer, cease the transfer of their information, or withdraw their consent via email at admin@tamtrinhcoffee.com; by phone at (+ 84) 886677283; in person at the Company’s headquarters, branches, and business locations; or in writing sent to the Company’s address.
  3. The company may request consumers to provide necessary information to verify the identity of the requester or their legal representative, but such requests shall not exceed the scope necessary for verification purposes.
  4. The fulfillment of consumer requests is handled in accordance with internal procedures and legal regulations; In the event that it is unable to fulfill all or part of a request, the Company shall notify the consumer of the reasons.
Article 19. Receipt and handling of feedback, requests, and complaints related to information
  1. The company receives feedback, requests, and complaints related to consumer information through the following channels: email at admin@tamtrinhcoffee.com; phone at (+ 84) 886677823; in person at the headquarters, branches, or business locations; or via written notice submitted to the Company.
  2. Within 03 working days from the date of receiving feedback, requests, or complaints, the Company shall acknowledge receipt and provide guidance on supplementary information if necessary.
  3. The company shall inspect, verify, and categorize the content, coordinate with relevant departments/third parties for handling, and notify consumers of the results within a timeframe appropriate to the nature of the case.
  4. In cases where the reported concerns, requests, or complaints are well-founded, the Company shall take appropriate measures such as correction, update, cancellation, suspension of transfer, request for third parties to cease processing, incident remediation, apology, compensation for damages if liability is established, or other measures in accordance with regulations.
CHAPTER VI. ACCOUNTABILITY AND ENFORCEMENT
Article 20. Responsibilities of the Company and relevant departments
  1. The Customer Service Department is the point of contact for receiving, recording, and responding to consumer requests, feedback, and complaints related to information.
  2. The System Technical/Information Technology Department is responsible for system administration, access rights allocation, security, backup, access monitoring, technical incident handling, and coordinating data extraction to serve the processing of valid requests.
  3. The Legal Department reviews compliance, forms, consent terms, and contracts/agreements with third parties; Provide consultation on handling requests, complaints, disputes, and propose amendments to Rules and Policies when necessary.
  4. The Business, Accounting, Logistics and related departments may only use information within the scope of their duties, for proper purposes, in accordance with assigned authorization levels, and are responsible for coordinating to address consumer requests.
  5. Third parties hired or authorized by the Company to process consumer information must comply with the contracts/agreements with the Company, these Rules and Policies, and relevant legal provisions.
  6. The Board of Directors shall direct the handling of complex cases, serious incidents, legal/communication risks, or requests from competent state authorities.
Article 21. Publication of Rules and Policies
  1. The Company shall make these Rules and Policies public through one or more of the following forms: posting them at its headquarters, branches, representative offices and business locations; publishing them on its website, application/software (if any); be integrated into or referenced in the registration form, transaction terms, contract, and sales materials; and be provided to consumers upon request.
  2. The public notice must be clear, easy to understand, and easily accessible before or at the time of collecting consumers’ information.
Article 22. Address of the information collection and management unit
  1. Tam Trinh Coffee Import-Export Company.
  2. Address: A1 Quang Trung 1, Nam Ban Commune, Lam Ha District, Lam Dong Province
  3. Phone:(+ 84) 886677283
  4. Email: admin@tamtrinhcoffee.com
Article 23. Entry into force
  1. These Rules and Policies are effective as of June 22,2024.
  2. If the law provides for higher levels of consumer rights protection or personal data protection than these Rules and Policies, the provisions of the law shall apply.
  3. During the implementation process, if there are changes in laws or new regulatory requirements arise, the Legal Department will take the lead and coordinate with the System Technical/Information Technology Department, Customer Care Department and relevant departments to review, propose amendments and supplements to the Rules and Policies to ensure compliance, and will notify consumers before implementation. In case consumers do not agree with the amended and supplemented content, consumers have the right to terminate the transaction or contract before the new policy takes effect.