1. Who We Are

The legal entity responsible for the BKMOS website and services is
CÔNG TY TNHH DỊCH THUẬT BKMOS (“BKMOS”, “we”, “us” or “our”).

Depending on the context, BKMOS may act as a personal data controller, a controller and processor,
or a processor acting on a client’s instructions. For example, when a company sends employee files
to BKMOS for translation, the company may determine the purpose and scope of that processing while
BKMOS processes the documents to perform the agreed service.

2. Scope of This Policy

This Policy applies to personal data that BKMOS receives through:

• the BKMOS website and English-language pages;
• contact, quotation and file-upload forms;
• email, telephone, messaging applications and other approved communication channels;
• quotations, orders, service agreements, invoices and transaction records;
• documents submitted for translation, editing, certification or related processing;
• in-person communication at BKMOS offices; and
• other online channels lawfully operated or used by BKMOS.

This Policy does not govern independent websites or services operated by third parties that you may
access through links or embedded content on the BKMOS website.

3. Personal Data We May Collect

3.1 Identification and contact information

• name;
• telephone number;
• email address;
• contact or delivery address;
• company or organization name and job title; and
• details of an authorized representative or project contact.

3.2 Service and transaction information

• quotation or consultation requests;
• document type, source language and target language;
• deadline, formatting, certification and delivery requirements;
• communications, order confirmations and project history;
• contract, invoice, payment and accounting information; and
• feedback, complaints and post-service support requests.

3.3 Personal data contained in translation documents

Documents submitted for translation may contain personal data relating to you or other individuals,
including:

• identity-card, passport and identification information;
• birth, marriage and civil-status records;
• diplomas, transcripts and educational records;
• employment, recruitment and personnel information;
• financial, banking, tax and insurance information;
• medical records and health information;
• legal, judicial or litigation-related information;
• signatures, photographs, identification numbers and other information appearing in the documents.

Some information contained in translation files may be sensitive personal data under applicable law.
BKMOS processes such information only to the extent reasonably necessary for the agreed service and
other lawful purposes.

3.4 Technical and website data

When you use our website, systems or service providers may record information such as:

• IP address;
• device, operating system and browser information;
• date and time of access;
• pages visited and referring source;
• system and security logs; and
• cookie or similar technical identifiers.

4. Sources of Personal Data

BKMOS may receive personal data from:

• you directly;
• your employer, organization, representative or authorized person;
• a client who provides documents containing your information;
• our website and technical systems;
• service providers involved in an order;
• lawful public sources; and
• competent authorities where permitted or required by law.

5. Why We Process Personal Data

BKMOS may process personal data for purposes including:

• responding to enquiries and contact requests;
• reviewing documents and preparing quotations;
• verifying project information and client requirements;
• forming and performing service agreements or orders;
• translation, editing, proofreading, formatting and quality assurance;
• coordinating certification, notarization, legalization or related procedures where requested;
• delivering electronic files or physical documents;
• payment processing, accounting, invoicing and debt administration;
• customer service, revisions and post-delivery support;
• handling complaints and resolving disputes;
• protecting the security of our website, systems and business operations;
• preventing fraud, misuse and unlawful activity;
• website analytics and service improvement;
• complying with legal, tax, accounting and regulatory obligations; and
• marketing communications where consent or another lawful basis applies.

6. Basis for Processing

BKMOS processes personal data in accordance with applicable Vietnamese law, including
the Law on Personal Data Protection No. 91/2025/QH15 and implementing regulations,
as amended or replaced from time to time.

Depending on the circumstances, processing may be based on one or more of the following:

• the data subject’s valid consent;
• steps requested before entering into an agreement;
• performance of a service agreement or order;
• legal rights and obligations of BKMOS or relevant parties;
• compliance with applicable law or a lawful request from a competent authority;
• protection of lawful rights and interests where permitted by law; or
• another circumstance in which applicable law permits processing without consent.

Where consent is required, BKMOS will provide information reasonably necessary for the data subject
to make a voluntary and informed decision.

7. Documents Containing Data About Other People

Translation documents frequently contain personal data about persons other than the client.
If you submit such information to BKMOS, you are responsible for having the lawful authority
to provide it or for taking the steps required by applicable law.

BKMOS will process third-party personal data only within the scope reasonably necessary to review,
quote, perform, verify and deliver the requested service, unless another lawful purpose applies.

8. Cookies and Similar Technologies

BKMOS may use cookies or similar technologies that are necessary for website operation, security,
preferences, performance measurement or analytics. Depending on the website configuration,
third-party embedded services may also place or read cookies.

You can control cookies through your browser and, where available, website consent settings.
Disabling certain cookies may affect the operation or usability of some website features.

9. When We May Share Personal Data

BKMOS does not sell client documents or personal data. We may share information where necessary with:

• BKMOS employees and departments directly involved in the service;
• translators, interpreters, editors, proofreaders and specialist collaborators;
• notary offices, competent authorities or other entities involved in a requested formal procedure;
• courier and delivery providers;
• hosting, email, cloud-storage and technology service providers;
• accounting, invoicing, payment or banking service providers;
• website analytics or security providers;
• legal, audit or professional advisers where reasonably necessary;
• competent authorities where disclosure is lawfully required; or
• another party with the data subject’s valid consent or as otherwise permitted by law.

Access should be limited to information reasonably necessary for the relevant task and,
where appropriate, subject to confidentiality and data-protection obligations.

10. Cross-Border Processing and Technology Providers

Some email, cloud-storage, analytics, security or other technology providers used in normal business
operations may host or process data outside Vietnam.

Where a cross-border transfer of personal data occurs, BKMOS will take the steps required under
applicable Vietnamese law, which may include defining the purpose and scope of the transfer,
limiting the data transferred, applying appropriate safeguards, maintaining required records,
and completing applicable assessments, notifications or other procedures.

11. How Long We Keep Data

BKMOS retains personal data only for as long as reasonably necessary for the relevant purposes,
the service relationship, dispute handling and legal or regulatory obligations.

Retention periods may depend on:

• the duration of the project and post-delivery support period;
• revision, verification or complaint requirements;
• the agreement with the client;
• legal limitation or dispute periods;
• tax, accounting, invoicing and record-keeping requirements; and
• lawful requests from competent authorities.

Translation files may be deleted, destroyed, anonymized or taken out of active use when the processing
purpose is complete, the agreed retention period expires, a valid deletion request applies,
the parties have agreed to deletion, or the law requires it.

Immediate deletion may not be possible where information must be retained to comply with law,
prove a transaction, establish or defend legal claims, or resolve a dispute.

12. How We Protect Personal Data and Documents

BKMOS applies administrative and technical measures appropriate to the nature of the information
and the service, with the aim of reducing risks such as unauthorized access, misuse, alteration,
disclosure, loss, destruction, malware and other unlawful processing.

Measures may include:

• role-based or task-based access controls;
• account and password controls;
• protected transmission and storage systems;
• backup and recovery procedures;
• confidentiality requirements for employees and collaborators;
• security monitoring and incident handling; and
• appropriate document deletion or destruction procedures.

13. Your Personal Data Rights

Subject to the conditions, exceptions and procedures provided by applicable law,
a data subject may have rights including the right to:

• be informed about personal data processing;
• consent to or refuse processing where consent is the applicable basis;
• withdraw consent;
• request restriction of processing;
• access or request provision of personal data;
• request correction of inaccurate data;
• request deletion or destruction of data;
• object to certain marketing uses;
• make a complaint, denunciation or legal claim as provided by law; and
• seek compensation where there is a lawful basis.

Withdrawal of consent does not affect the lawfulness of processing carried out before BKMOS
receives the withdrawal request. Certain rights may be restricted where continued processing
or retention is required by law, contract, a competent authority, dispute handling or the protection
of lawful rights and interests.

How to make a privacy request

Contact BKMOS using the details at the end of this Policy. We may ask for information reasonably
necessary to verify identity, authority and the data or transaction concerned before acting on a request.
BKMOS will handle requests within the time and manner required by applicable law.

14. Personal Data Relating to Children

The BKMOS website is not designed to intentionally collect children’s personal data for advertising
or user profiling. However, translation documents may contain children’s data, for example in birth
certificates, passports, school records, medical files or visa applications.

In such cases, BKMOS processes the information only as reasonably necessary for the service.
The client must have lawful authority to submit the documents, and any required consent or exercise
of rights will be handled in accordance with applicable law concerning the child and legal representative.

15. Email, Messages and Marketing

BKMOS may contact you to:

• respond to an enquiry or quotation request;
• confirm an order or request missing information;
• discuss documents, progress, payment or delivery;
• provide revisions or post-service support; and
• send necessary transaction-related notices.

Promotional messages will be sent only where consent or another lawful basis applies.
You may opt out of marketing communications without affecting necessary communications
about an active order or service.

16. Third-Party Links and Embedded Services

The website may contain links, maps, videos, social-media features, messaging links or other content
provided by third parties. When you interact with those services, the third party may process information
under its own privacy policy and terms.

BKMOS does not control independent processing carried out by third-party services outside our reasonable control.
You should review the privacy information provided by the relevant service before supplying personal data.

17. Personal Data Incidents

If BKMOS becomes aware of a personal-data incident affecting information under our control,
we will assess the incident, take reasonable containment and remediation measures,
preserve relevant records, and make any notifications or reports required by applicable law.

18. Changes to This Privacy Policy

BKMOS may update this Policy to reflect changes in the website, services, technology,
internal processes or applicable law. The updated version will be posted on this page
and the “Last updated” date will be revised.

Where a change materially affects the way personal data is processed or a notice is otherwise required,
BKMOS will take appropriate steps within the circumstances and applicable law.

19. Contact BKMOS About Privacy

This English-language Policy is intended to explain BKMOS’s privacy practices to users of the English website.
A specific service agreement, data-processing arrangement or mandatory law may impose additional requirements
for a particular project.