LOTTE Mart

(Applied to both direct and online shopping forms)

Introduction

The Joint Stock Company LOTTE Mart Vietnam (hereinafter referred to as “LOTTE Mart Vietnam”, “the Company” or “we”) is committed to respecting and striving to ensure the confidentiality and rights of Data Subjects regarding the Personal Data of Customers. During the processing of Customers' Personal Data, we will implement and comply with the contents of the Personal Data Security Policy for Customers shopping on the online platforms of LOTTE Mart Vietnam, including the website https://lottemart.com.vn/ và https://lottemart.vn (“Website”), the LOTTE Mart Vietnam Application (“Application”), and other Customer Care channels (hereinafter collectively referred to as “Platforms”) of LOTTE Mart Vietnam (hereinafter referred to as “Security Policy”).

This Security Policy regulates and governs how LOTTE Mart Vietnam processes Customers' Personal Data in accordance with legal regulations. For Customers' Personal Data, LOTTE Mart Vietnam is the Data Controller and Processor of Personal Data.

This Security Policy is publicly announced on the website at https://lottemart.com.vn/chinh-sach-bao-mat-du-lieu-ca-nhan; https://lottemart.vn/en-bdg/privacy  or at the offices, stores of LOTTE Mart Vietnam and is effective from July 1, 2023. LOTTE Mart Vietnam reserves the right to amend and supplement this Security Policy at any time. LOTTE Mart Vietnam will notify Customers of any amendments or supplements to the Security Policy and publicly announce them on the website of LOTTE Mart Vietnam. LOTTE Mart Vietnam encourages Customers to regularly review the Security Policy to obtain the latest updates to exercise their rights as Data Subjects.

1. Definitions and Interpretations

In this Security Policy, unless the context requires otherwise, the following terms shall have the meanings as follows:

• Data Controller: is the organization that decides the purpose and means of processing Personal Data.
• Data Controller and Processor: is the organization that simultaneously decides the purpose, means, and directly processes Personal Data.
• Data Processor: is the organization that carries out the processing of data on behalf of the Data Controller, through a contract or agreement with the Data Controller.
• Data Subject: is the individual to whom the Personal Data relates.
• Affiliate Company: is any other organization directly or indirectly controlled by LOTTE Mart Vietnam, controlled by or under the control of LOTTE Mart Vietnam over time.
• Personal Data: is information in the form of symbols, written words, numbers, images, sounds, or similar forms in the electronic environment associated with a specific individual or helps identify a specific individual. Personal Data includes Basic Personal Data and Sensitive Personal Data. Information that helps identify a specific individual is information formed from the activities of the individual that, when combined with other stored data and information, can identify a specific individual.
• Program: is the program of LOTTE Mart to implement for Customers, including but not limited to programs for accumulating and using points, promotional programs, and other programs to serve Customers.
• Customer: is an individual interested in and/or making purchases on the online platform or directly at the store, regardless of whether or not they have a LOTTE Mart Membership Card.
• Customer Consent: is a letter sent from the Customer to LOTTE Mart Vietnam to express agreement regarding the Processing of the Customer's Personal Data. In the case of online purchases, Customer Consent is a clear, voluntary expression affirming the Customer's agreement allowing LOTTE Mart Vietnam to process their Personal Data, through the form (1) clicking and checking the box stating “I agree with the Membership Policy and Privacy Policy of LOTTE Mart Vietnam” or similar statements displayed in the registration form of LOTTE Mart Vietnam, and simultaneously (2) clicking and checking the box to select the Purpose of processing Personal Data.
• Website: is the website lttemart.com.vn
• Application: is the LOTTE Mart Vietnam Application
• Platform: is the online platforms of LOTTE Mart Vietnam, including the Website, Application, and other Customer Care channels provided by LOTTE Mart Vietnam for Customers to access the services of LOTTE Mart Vietnam.
• Account: is the LOTTE Mart Vietnam account provided to Customers for use and access to the Platform to access the services of LOTTE Mart Vietnam.
• Processing Personal Data: is one or more activities affecting Personal Data, such as: collection, recording, analysis, verification, storage, editing, disclosure, combination, access, retrieval, recovery, coding, decoding, copying, sharing, transmission, provision, transfer, deletion, destruction of Personal Data or other related actions.

2. Scope and Purpose of Processing Customers' Personal Data

2.1. Scope of Processing:

The Personal Data of Customers processed by LOTTE Mart Vietnam includes:

(a) Basic Personal Data

• Last name, middle name, and first name at birth, other names (if any);
• Date, month, year of birth;
• Gender;
• Information about residence (including permanent residence, temporary residence, current address, hometown, contact address; workplace address, office address, other contact information);
• Nationality;

• Personal images; information obtained from security systems (for customers shopping at the store, for example, audio recordings, video recordings in areas equipped with surveillance cameras – CCTV);
• Identity card number, citizen identification number, personal identification number, passport number;
• Email address; Phone number;
• Driver's license number, vehicle registration number;
• Full name, phone number, and address of the recipient (if using delivery services);
• Comments, product reviews from Customers (including text, images, and videos provided by Customers) through LOTTE Mart's customer care channels including Application/ Website/ Hotline/ Chat/ Email/ Facebook of LOTTE Mart;
• For Customers who are children (under 16 years old): Information about the father, mother, or legal guardian as prescribed by law, designated by the People's Committee of the commune or the Court according to legal regulations (collectively referred to as "Legal Representative"), including information about their full name, ID number, CCCD number, passport number, contact phone number, relationship between the Legal Representative and the child Customer;
• Automatically collected information when you use our services on the Lotte Mart App and Website, besides the separate storage system, this information is also recorded by other data query services including Facebook, Google, Zalo, and third-party partners that LOTTE Mart uses services from:

• Purchase history
• User interaction history

• Line ID information, Chat ID provided by Customers;
• Information from registered sources through third parties, including: Zalo, Google, Chat, Apple ID;
• Other information provided by Customers to exercise their rights or requests and not classified as sensitive personal data;
• Any other data, information actively provided by Customers to LOTTE Mart Vietnam through the Platform during the use of services or when participating in programs/events of LOTTE Mart Vietnam that collect information, not classified as sensitive personal data;
• Other information linked to a specific individual or helps identify a specific individual not classified as sensitive personal data.

When Customers provide personal data of other individuals (for example, contact information of other individuals to place orders and receive goods) to LOTTE Mart Vietnam, Customers understand that they are acting as the Data Controller regarding the provision of personal data of these subjects to LOTTE Mart Vietnam, and LOTTE Mart Vietnam only processes the personal data of these subjects based on the consent of the Customers for the processing purposes in Clause 2.2 of this Privacy Policy. Customers are responsible for ensuring that these individuals have been fully informed about the related processing purposes and the processing of personal data according to legal regulations and have obtained their consent before providing that information to LOTTE Mart Vietnam.

(b) Sensitive personal data

• Financial information, such as bank account numbers, credit card numbers, and any other financial details;
• Account information, such as username and password, the usage process of the Customer's account, detailed information about products or services that the Customer has purchased or obtained on the Platform and systems of LOTTE Mart Vietnam.
• Data related to electronic communications or applications: Technical information (including internet protocol (IP) address, Customer login data, browser type and version, language settings, time zone and location, types and versions of browser plugins, operating system and platform, international mobile device version, device identification, interaction on platforms and applications,…).

• Information about transactions and account information is secured and recorded by the parties below when the Customer completes the transaction:

• VNPay: VNPay transaction gateway (PCI DSS standard)
• Momo: E-wallet (PCI DSS standard).
• ZaloPay: E-wallet (PCI DSS standard).
• Apple Pay.
• Bank.

2.2. Purpose of processing
LOTTE Mart Vietnam processes Customers' Personal Data for the purposes below (hereinafter referred to as “Processing Purpose”):

(a) General Processing Purposes

• Provide, manage, and operate the Membership Program (hereinafter referred to as the “Program”), including but not limited to the following details:
  • Points accumulation and redemption programs
  • Customer benefit programs such as discounts, promotions, and free services
  • Providing services/utilities to Customers/introduction of new Company products or services based on Customers’ needs and habits while participating in the Program
  • Other programs developed and provided to Customers from time to time
• Perform necessary services or services supporting the provision and management of the Program
• Identify, authenticate, and verify Customer information for the Program
• Customer service, including contacting, receiving, processing, and responding to valid requests, inquiries, complaints; notifying changes related to the Company’s products, orders, or services
• Fulfill service requests and Customer support needs (such as delivery services, product exchange/return services, warranty services, etc.)
• Security and risk prevention: Detect, prevent, and handle fraudulent acts, unauthorized intrusions, account sabotage, or fraudulent activities within the Program, ensuring information security and protection of Customer rights
• Manage security, order, safety, and assets at the premises, including but not limited to: (i) controlling building access; (ii) detecting and preventing fraud or unauthorized/improper use of utilities, products, or services; (iii) detecting, preventing, and handling violations; and/or (iv) conducting internal investigations of incidents and providing information as required by State authorities
• Store personal information and carry out internal management tasks, contingency for disaster recovery, or other similar purposes
• Prevent, investigate, and handle fraud, legal violations, disputes, complaints, accidents, or other misconduct related to LOTTE Mart Vietnam’s operations; and fulfill legal obligations under Vietnamese law
• Receive, process, track, and manage Customer orders to ensure the execution of transactions and the provision of products/services to Customers
• Transactions and payments: Confirm and execute payments related to Customer transactions
• Adjust, update, secure, and improve the products, services, applications, devices, and systems provided and/or managed by LOTTE Mart Vietnam
• Comply with laws and requirements of competent State authorities, including disclosure of information, reporting, auditing, record keeping, and obligations as prescribed by law from time to time
• Exercise Customer rights related to Personal Data in accordance with law and agreements between the Customer and LOTTE Mart
• Fulfill LOTTE Mart’s obligations with relevant agencies, organizations, and individuals under contracts and legal regulations

(b) Extended Processing Purposes

• Optimize the Program (implement marketing campaigns, communicate with Customers to enhance Program effectiveness)
• Conduct market surveys, product research, develop new products, compile Customer information statistics, analyze consumer behavior, and use detailed information related to the Program (such as transaction value, transaction time, shopping location, or other related information) to support the Company’s operations and business
• Send Customers, through methods permitted by law, notices, advertising information, promotions, and materials related to the Program, products, and/or services within the Program (“Marketing Program”), as follows:
  • Content: Notices, advertising information, promotions, and materials related to the Program, products, and/or services within the Program, including but not limited to marketing programs, promotions, customer care policies, warranty policies, gift programs, discounts, or other special offers, etc.
  • Methods and forms: The Company will contact Customers via Call Center, email, text message, applications, social media, or other interactive channels to send notices, advertising information, promotions, and materials related to the Program, products, and/or services within the Program
  • Frequency of product introduction: Marketing and product introduction will be carried out according to the specific implementation plans of the Marketing Programs that the Company is currently or plans to implement and/or has registered with competent State authorities
• Personalization: Customize Customer experience, such as identifying preferences and shopping behaviors to improve LOTTE Mart Vietnam’s services and deliver advertising messages tailored to Customer shopping needs
• LOTTE Mart Vietnam will provide Customers’ Personal Data to LOTTE Shopping Co., Ltd. LotteMART, its Affiliates, subsidiaries, branches of LOTTE Mart Vietnam, and other related parties as specified in this Letter of Consent, for the purposes of processing mentioned above (if any).

3. Organizations and individuals that may process customers' personal data

LOTTE Mart Vietnam will not provide customers' personal data to any third party except for parties related to the Processing Purpose. These related parties include:

• LOTTE Shopping Co., Ltd., LotteMART, and affiliated companies, units, and branches (if any);
• Service providers, or other third parties involved in carrying out Personal Data Processing activities on behalf of or authorized by LOTTE Mart Vietnam and serving only the Processing Purposes, including but not limited to:

• transportation service partners;
• payment partners;
• partners supporting data analysis about users (if any);
• partners providing cloud storage services, information technology;
• advertising and marketing partners;
• consultants and experts, such as legal advisors,…
• Competent state authorities.
• Data Processing Transfer: LOTTE Mart Vietnam has the right to share personal data of customers with other parties related to any merger, acquisition, consolidation, cooperation, restructuring, funding, or any other business transaction.
• Other third parties that LOTTE Mart Vietnam deems necessary for the purpose of processing or according to legal regulations.

4. Rights and Obligations of Customers Regarding Personal Data:

4.1. Rights of Customers

Customers, as data subjects, have the following rights regarding their personal data, unless otherwise provided by law:

• Right to be informed: Customers have the right to know about the processing activities of their personal data.
• Right to consent: Customers have the right to consent or not consent to the processing of their personal data, unless the law allows the processing of personal data without the consent of the data subject.
• Right of access: Customers have the right to access to view, edit, or request the editing of their personal data by logging into their account on the platform and editing personal information or requesting LOTTE Mart Vietnam to do this through customer care channels such as Hotline/ Kết nối/ Email/ Fanpage.
• Right to withdraw consent: Customers have the right to withdraw their consent.
• Right to erasure: Customers have the right to erase and request the erasure of their personal data.
• Right to restrict processing: Customers have the right to request the restriction of processing their personal data.
• Right to data portability: Customers have the right to request the provision of their personal data.
• Right to object to processing: Data subjects have the right to object to the processing of their personal data to prevent or limit the disclosure of personal data or its use for advertising or marketing purposes.
• Right to complain, report, and sue: Data subjects have the right to complain, report, and sue according to legal regulations.
• Right to request compensation for damages: Data subjects have the right to request compensation for damages when violations of regulations on the protection of their personal data occur.
• Right to self-defense: Customers have the right to self-defense according to the provisions of the Civil Code, other relevant laws, and Decree 13/2023/NĐ-CP on the Protection of Personal Data, requesting competent authorities and organizations to implement civil rights protection measures. Customers have the right to file complaints about the disclosure of personal information to third parties to the management board of LOTTE Mart Vietnam.

The exercise of some of these rights by customers, such as the right to withdraw consent, erase data, restrict, or object to data processing, may result in LOTTE Mart Vietnam being unable to perform necessary actions to achieve the processing purpose or unable to provide, support, or resolve customer requests. LOTTE Mart Vietnam will not be responsible to customers for any losses arising from the exercise of these rights by customers.

4.2. Obligations of Customers

Customers, as data subjects, have the following obligations regarding their personal data:

• Self-protect their personal data; request other relevant organizations and individuals to protect their personal data. If personal data is disclosed due to negligence or any fault of the customer, the customer must accept the risks and potential damages that may occur.
• Customers will be solely responsible for the confidentiality and retention of all activities using services under their registered name, password, and email. Additionally, customers are responsible for promptly notifying LOTTE Mart Vietnam of any unauthorized use, abuse, breach of confidentiality, or retention of third-party registered names and passwords to take remedial measures appropriate; or when detecting any errors, mistakes regarding personal data of oneself or suspecting that one's personal data is being infringed.

• Respect, protect the personal data of others.
• Provide complete, accurate personal data to LOTTE Mart Vietnam when agreeing to allow the processing of personal data.
• Timely update LOTTE Mart Vietnam if there are any changes regarding the personal data that the employee has provided.
• Provide legally valid documents when LOTTE Mart requests to prove that you have obtained the necessary consent and permission from a third party when providing their personal data.
• Comply with legal regulations on the protection of personal data and participate in preventing violations of regulations on the protection of personal data.

5. Start and end time of personal data processing

LOTTE Mart Vietnam processes the personal data of customers from the moment it receives the customer's consent regarding the processing of personal data (in the manner defined in Article 1 of this Privacy Policy). The personal data of customers will be processed within the necessary time frame to achieve the processing purposes and to comply with legal requirements (for example, for tax and audit purposes), or to fulfill obligations that LOTTE Mart Vietnam has communicated to customers. Some types of personal data may be stored longer than other personal data.

6. Methods of processing personal data

6.1. Collection and processing of personal data

LOTTE Mart Vietnam may collect customers' personal data through the following methods:

• From customers when customers order directly at the store and online on platforms;
• From exchanges, communications, interactions with customers (in person, via mail, phone, online, electronic communication, social media, surveys, or any other means);
• From recording devices associated with the security system installed at the store;
• From personal data processors of LOTTE Mart Vietnam (including business partners), affiliated companies, publicly available data sources, or data sources from competent state authorities and other sources.
• From other legal means of collecting personal data.

After collecting personal data, LOTTE Mart Vietnam will carry out one or more processing activities of personal data as appropriate, such as: collecting, recording, analyzing, verifying, storing, editing, disclosing, combining, accessing, retrieving, recovering, encoding, decoding, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data, or other related actions to achieve the processing purposes or to respond to the exercise of customers' rights as data subjects (for example, the right to edit, update, provide, restrict the processing of personal data,…) according to current legal regulations.

6.2. Processing personal data obtained from recording activities in public places

LOTTE Mart Vietnam may collect and process data about the images of individuals and information obtained from the security system (for example, recordings in areas equipped with surveillance cameras – CCTV, including but not limited to the store area, including the supermarket area, hallways, exits, etc., and parking lots) for the purpose of ensuring national security, social order, and the legal rights and interests of organizations and individuals according to legal regulations without needing the consent of customers.

At LOTTE Mart Vietnam, the security system and CCTV operate 24/7 to ensure the safety of customers, prevent crime, protect facilities, and fire safety. LOTTE Mart Vietnam commits to only process customers' personal data according to the contents of this Privacy Policy and legal regulations.

6.3. Processing personal data of customers who are childrens.

LOTTE Mart Vietnam processes personal data of children based on the principles of protecting the rights and best interests of children. Before processing personal data of children, the Company will take appropriate measures to verify the age of the children. The processing of personal data of children must have the consent of the parents or guardians, and in the case of children aged 7 years and older, additional consent from the child regarding the processing of personal data is required, except in cases where data processing does not require the consent of the data subject as stipulated by law.

6.4. Deletion of Customer Personal Data

LOTTE Mart Vietnam will delete irretrievably the personal data of customers in the following cases:

• Processing data for purposes not intended;
• The purpose of processing the personal data agreed upon by the customer has been fulfilled;
• The storage of personal data is no longer necessary for the activities of LOTTE Mart Vietnam;
• LOTTE Mart Vietnam is dissolved or no longer operates or declares bankruptcy or ceases business operations as stipulated by law.

LOTTE Mart Vietnam will take necessary steps to prevent access to or use of personal data for any purpose other than compliance with this Privacy Policy or for the purposes of safety, security, fraud detection, and preventing risks to the safety of information systems, cybersecurity, and the safety of customers' personal data.

6.5. Transfer of Personal Data Abroad

LOTTE Mart Vietnam may transfer or grant access to customers' personal data to organizations, management departments abroad (including LOTTE Shopping Co., Ltd., LotteMART, and affiliated companies, units, and branches (if any)) or partners, service providers abroad to process in accordance with the processing purposes agreed upon by the customer. In some other cases, partners and service providers of LOTTE Mart Vietnam based in Vietnam may use equipment and data processing systems located outside the territory of Vietnam to represent LOTTE Mart Vietnam in processing personal data. These cases are considered as transferring customers' personal data abroad.

It should be noted that some countries may have lower levels or practices regarding the protection of personal data than Vietnam. In all cases of transferring personal data abroad, LOTTE Mart Vietnam will strive to implement appropriate measures to ensure the protection of customers' personal data, including signing agreements, commitments to data security, selecting partners as Data Processors that meet clear obligations and only working when these partners have appropriate protective measures.

7. Measures to Protect Personal Data

LOTTE Mart Vietnam will implement appropriate measures to protect personal data, including organizational, personnel, and technical measures in accordance with legal regulations to detect and prevent data breaches or violations of personal data, including but not limited to:

• Establishing and issuing regulations on personal data protection, specifying the actions to be taken in accordance with legal regulations.
• Designating departments and personnel responsible for personal data protection. Recording and storing logs of the personal data processing system.
• Conducting cybersecurity checks on systems and means, devices serving the processing of personal data before processing, deleting irretrievably or destroying devices containing personal data.
• Designing security systems, access control, intrusion prevention, authentication, data encryption, and data backup.
• Other measures as stipulated by law.

8. Consequences, Unintended Damages That May Occur

Please note that, although LOTTE Mart Vietnam always strives to ensure that customers' personal data is best protected according to legal regulations, LOTTE Mart Vietnam cannot exclude all risks to personal data during processing. The information provided over the Internet or the internal information system of LOTTE Mart Vietnam still has certain risks arising from force majeure cases or incidents, crimes related to cybersecurity such as cyberattacks, cyber terrorism, illegal cyber espionage, causing disruption to the data processing process or leakage of personal data. In this case, LOTTE Mart Vietnam will immediately take necessary actions to prevent, remedy, and minimize any unintended damages that may occur to personal data, while coordinating with the competent state authorities to handle violations. Customers also agree that to the extent that reasonable measures have been applied to prevent these hazards, LOTTE Mart Vietnam will not be liable for compensation for damages caused by the actions of any third party that adversely affects the personal data of the Customer beyond the control of LOTTE Mart Vietnam.

9. Personal Data Protection Department

If Customers wish to exercise their rights or have any questions, requests for support, inquiries, and complaints related to this Privacy Policy or the processing of personal data of LOTTE Mart Vietnam, Customers can contact LOTTE Mart Vietnam through the following contact details:

PERSONAL DATA PROTECTION DEPARTMENT – LOTTE MART VIETNAM JOINT STOCK COMPANY

• Address: 469 Nguyen Huu Tho Street, Tan Hung Ward, Ho Chi Minh City, Vietnam.
• Phone: 028.3775 3232
• Fax: 3775 1575
• Responsible personnel: DPD Department
• Email: dpd@lottemart.vn

LOTTE Mart Vietnam will screen and verify the identity, authority to make the request of the Customer, or any necessary information related to the Customer's request. LOTTE Mart Vietnam may request the Customer to provide information or supporting documents to authenticate the request. After verification, LOTTE Mart Vietnam will process the Customer's requests within the time frame stipulated by law.

10. Address of the unit collecting, managing, and supporting Customers

LOTTE MART VIETNAM JOINT STOCK COMPANY

• Tax code: 0304741634
• Headquarters: 469 Nguyen Huu Tho Street, Tan Hung Ward, Ho Chi Minh City, Vietnam.
• Hotline: 0901057057
• Email: info@lottemart.vn
• Customer care hotline: 0901057057
• Email: info@lottemart.vn
• ID Line: Hotline07 (for Korean customers)

11. Commitment to the confidentiality of Customers' personal data

The personal data of Customers on the platform of LOTTE Mart Vietnam is absolutely committed to confidentiality according to this Privacy Policy. The collection and use of Customers' personal data will only be carried out with the consent of the Customers, except in cases where the law provides otherwise.

LOTTE Mart Vietnam commits:

• Not to use, transfer, provide, or disclose to any third party (except for organizations and individuals authorized to process Customers' personal data listed in Article 3 of this Privacy Policy) regarding Customers' personal data without permission or consent from the Customers, except in cases where the law provides otherwise.
• In the event that the server storing information or the information system of LOTTE Mart Vietnam is attacked by hackers leading to the loss of Customers' personal data, LOTTE Mart Vietnam are responsible for promptly reporting the incident to the competent authorities for investigation and handling, and for notifying the Customer.
• We ensure the absolute confidentiality of all online transaction information of the Customer, including invoice information and digitized accounting documents stored in the secure central data area of LOTTE Mart Vietnam.