PERSONAL DATA PROTECTION POLICY

1.1. This Policy applies to the Company's processing of your Personal Data in connection with the Company and the operator of LOTTE Mall West Lake Hanoi, located at 272 Vo Chi Cong Street, Tay Ho Ward, Hanoi, Vietnam (the "Mall").

1.2. This Policy applies to Personal Data processed through the following channels:

(a) Online channels:The website https://lottemallwestlakehanoi.vn/ (including contact and feedback forms, cookies and analytics tools) and social media pages managed by the Company;

(b) Direct channels at the Mall:Information counters, customer service counters, events and promotional programs directly organized by the Company, and the security camera system.

1.3. Data Subjects within the scope of this Policy include:

Customers, consumers, website users, visitors, event participants, and contact persons of tenants, suppliers and partners.

1.4. This Policy does not apply to:

(a) Stores, restaurants, cinemas, entertainment venues and other services within LOTTE Mall West Lake Hanoi that are operated independently by tenants or partners who independently determine the purposes and means of data processing. Such parties are separate data controllers and apply their own personal data protection policies;

(b) Websites and applications of third parties linked from the Company's website. The Company is not responsible for the content or privacy policies of such third parties;

(c) Personal Data of the Company's employees and job applicants, which is subject to separate internal regulations.

1.5. Personal Data of members of the LS.POINT program is processed by the Company and Lotte Shopping Plaza Vietnam Co., Ltd. in accordance with the privacy policy of the program, published at https://lsp.lotte.vn/membership_privacy_policy.html.

In this Policy, the following terms shall have the meanings set out below:

2.1. Personal Data: digital data or information in another form that identifies or helps identify a specific individual, including Basic Personal Data and Sensitive Personal Data as classified by the Government. De-identified data is no longer considered Personal Data.

2.2. Customer, You or Data Subject: an individual whose Personal Data is processed by the Company under this Policy, including the persons specified in Clause 1.3 of Article 1.

2.3. Products, goods and services: products, services, amenities, promotional programs and events directly provided or organized by the Company at the Mall and on the website; excluding products, goods and services of tenants and partners referred to in Point (a), Clause 1.4 of Article 1.

2.4. Processing: one or more activities including collection, analysis, aggregation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer and other activities affecting Personal Data.

2.5. Data Controller: an organization that determines the purposes and means of Processing Personal Data.

2.6. Data Controller and Processor: an organization that determines the purposes and means of Processing Personal Data and directly Processes Personal Data.

2.7. Data Processor: an organization that Processes Personal Data at the Company's request pursuant to a contract.

2.8. Third Party: an organization or individual other than the Customer, the Company and the Data Processor that participates in the Processing of Personal Data in accordance with the law.

2.9. Consumer Information: personal information of consumers, information concerning the purchase and use of products and services, and other information related to transactions between consumers and the Company.

2.10. Cookie: a small data file stored on a device when you access the website, and similar technologies such as pixels, SDKs and local storage.

2.11. Personal Data Protection Law: Law No. 91/2025/QH15 on Personal Data Protection and its implementing regulations.

3.1. Company information:

– Enterprise name:Lotte Properties Hanoi Co., Ltd.

– Enterprise Registration No.:0107645480

– Head office address:13th Floor, Office Building, Lotte Mall Hanoi, 272 Vo Chi Cong Street, Tay Ho Ward, Hanoi, Vietnam

– Personal Data Protection Department:Personal Data Protection Department of Lotte Properties Hanoi Co., Ltd.

– Email: info.lottemall@lotte.vn

– Hotline: 024 3333 8000

3.2. Depending on the circumstances, the Company acts as the Data Controller or Data Controller and Processor in relation to the Personal Data specified in this Policy.

3.3. The Company does not purchase or sell Personal Data in any form. The transfer of Personal Data by the Company to a Data Processor or Third Party in the cases specified in this Policy does not constitute the purchase or sale of Personal Data.

4.1. Personal Data processed includes data provided by Customers or collected by the Company during Customers' access to the website, inquiry about or use of Products, goods and services, participation in interactive activities, marketing, surveys or other activities related to the Company, specifically as follows:

(a) Basic Personal Data: full name, date of birth, gender, telephone number, email address, contact address, vehicle license plate number, personal images (including images captured by the security camera system at the Mall), contents of calls, messages and other forms of communication between you and the Company, etc.;

(b) Sensitive Personal Data: data concerning your activities on the website (IP address, cookies, browsing history), etc.

4.2. Where you provide the Company with Personal Data of another individual, including but not limited to a family member or gift recipient, you undertake and warrant that such provision has been consented to by the Data Subject, or that you are the lawful representative of the Data Subject in accordance with the law. You shall be responsible for any complaints or disputes arising from a breach of this undertaking.

4.3. For certain services, the provision of certain types of Personal Data is necessary for the Company to provide the relevant services; mandatory information fields shall be clearly indicated in the data collection form. If you do not provide such data, the Company may refuse or be unable to provide the corresponding services. Your refusal to provide such data shall not affect your use of other services of the Company that do not require such data.

5.1. Processing purposes based on Consent

The Company shall only process data for the following purposes where you have provided separate Consent for each purpose. You may refuse or withdraw your Consent without affecting your use of other Products, goods and services:

(a) Direct marketing: sending information about promotions, events and the Company's products and stores at the Mall via SMS, email, Zalo or telephone calls. The frequency shall not exceed three (03) advertising messages to one telephone number, three (03) advertising emails to one email address, and one (01) advertising call to one telephone number within a 24-hour period, during the hours permitted by law;

(b) Sharing with tenants, co-branding partners, member companies and affiliates of the Company so that they may introduce their products, services and offers to you;

(c) Using your image captured or recorded at events for communication purposes where you are the principal subject of the image;

(d) Classifying, screening and assessing the suitability of Customers and prospective customers for the Company's Products, goods and services;

(e) Conducting surveys, market research, statistical analysis and analysis of consumer behavior to improve and develop the Company's Products, goods and services.

5.2. Processing purposes not requiring Consent

(a) Performance of agreements with you: organizing promotional programs, events and prize activities in which you have registered to participate; providing amenities at the Mall; receiving and resolving feedback, complaints and lost-and-found matters, including storing communications for the purpose of handling your requests; and sending service-related notifications that are not advertisements;

(b) Fulfillment of the Company's legal obligations, including accounting and tax obligations, promotional reporting obligations, and provision of information upon lawful request by a competent state authority;

(c) Ensuring security and safety at the Mall, including through the security camera system; ensuring the security and safety of the Company's website and information systems; preventing, detecting and investigating fraud, impersonation and violations of law; and handling incidents and emergencies.

6.1. Methods of collection

The Company collects Personal Data through the following methods:

(a) Directly from you: when you complete forms, participate in promotional programs or online and offline events, complete surveys, contact the Company via the website, telephone, email, social media, hotline or service counters;

(b) Automatically: through cookies on the website and the security camera system at the Mall. Essential cookies required for website operation are used by default; analytics and advertising cookies are only used when you provide Consent through the cookie notice on the website. Areas covered by security cameras shall be clearly signposted;

(c) From Third Parties: data lawfully provided by tenants or partners having cooperation arrangements with the Company, with your permission;

(d) Other methods permitted by law.

At the time of collection, the Company shall notify you of the types of data to be collected, the purposes of collection and use, your right to refuse to provide data, and the consequences associated with such refusal.

6.2. Methods of storage

Personal Data is stored in Vietnam on the Company's systems or on the systems of storage service providers under contract.

6.3. Methods of analysis

Personal Data analysis shall be conducted in accordance with the Company's internal procedures. The Company has mechanisms to supervise each data analysis process, including requirements to verify compliance with legal requirements on data confidentiality and information security for information technology systems before conducting analysis. Personal Data shall be de-identified at an appropriate stage during the Processing.

6.4. Methods of encryption

Personal Data shall be encrypted in accordance with appropriate encryption standards where necessary during storage or transfer of data, in order to ensure that the data is protected, authenticated and remains intact and unaltered after transmission.

6.5. Methods of deletion

Upon a valid request from you, the Company shall delete all Personal Data that you have provided and/or that the Company has collected during your use of Products, goods and services, except in the following cases:

(a) The law does not permit deletion of the data or requires the data to be retained;

(b) Personal Data is processed by a competent state authority for purposes serving the operations of such state authority in accordance with the law;

(c) Personal Data has been made public in accordance with the law;

(d) Personal Data is processed for legal requirements, scientific research or statistical purposes in accordance with the law;

(e) Emergencies involving national defense, national security, social order and safety, major disasters or dangerous epidemics; where there is a threat to national security or national defense that has not reached the level of declaration of a state of emergency; prevention and control of riots, terrorism, crimes and violations of law;

(f) Response to an emergency situation threatening the life, health or safety of the Customer or another individual.

7.1. To the extent permitted by law, the Company may share Personal Data for the purposes specified in Article 5 with the following organizations and individuals:

(a) Member companies and affiliates of the Company;

(b) Information technology, data analytics and processing, market research, trade promotion, advertising, operations and customer service providers that process data on behalf of the Company pursuant to contracts;

(c) Tenants and partners where you have provided Consent;

(d) The Company's auditors, lawyers and consultants;

(e) Competent state authorities upon lawful request;

(f) A recipient in the event of corporate reorganization in accordance with the law;

(g) Other organizations or individuals where you have provided Consent or where the Company has a lawful basis for sharing such data in accordance with the law.

7.2. Data sharing shall be carried out in accordance with the applicable procedures, methods and laws. Recipients of Personal Data are obliged to maintain the confidentiality of your Personal Data in accordance with this Policy, their contracts with the Company and applicable law.

7.3. Where Personal Data is transferred abroad, including where a partner or service provider uses a system located outside the territory of Vietnam to process data on behalf of the Company, the Company shall comply with applicable laws and implement appropriate protective measures, including entering into data confidentiality agreements with the recipient and permitting Processing only within the clearly defined scope.

8.1. The Company shall only retain Personal Data for as long as necessary to fulfill the purposes specified in this Policy. The specific retention period shall be determined based on:

(a) The period during which the Company provides services, organizes programs or handles your requests;

(b) Mandatory retention periods prescribed by law, including accounting and tax laws;

(c) The period necessary to resolve complaints or disputes or as required by a competent state authority;

(d) For data processed based on Consent: until you withdraw your Consent or the Processing purpose has been fulfilled.

8.2. Upon expiry of the retention period, the Company shall securely delete, destroy or de-identify Personal Data, ensuring that the data cannot be unlawfully recovered. De-identified data may continue to be used for statistical purposes.

9.1. Your rights

(a) The right to be informed of the Processing of your Personal Data, except where otherwise provided by law.

(b) The right to decide whether to provide Consent in relation to the Processing of your Personal Data, except where otherwise provided by law.

(c) The right to access, review, correct or request correction of your Personal Data, except where otherwise provided by law. The Company shall correct Personal Data upon your request or as required by specialized laws. Where the Company is unable to do so, it shall notify you.

(d) The right to delete or request deletion of your Personal Data in accordance with Clause 6.5 of Article 6 of this Policy.

(e) The right to request restriction of the Processing of your Personal Data in accordance with the law. The Company shall implement such restriction upon receiving your request, except where otherwise provided by law.

(f) The right to request the Company to provide your Personal Data, except where otherwise provided by law.

(g) The right to withdraw your Consent in relation to the Processing purposes for which you have provided Consent, except where otherwise provided by law. Upon receiving such request, the Company shall notify you of the possible consequences and damages arising from the withdrawal of Consent. Where withdrawal of Consent affects the provision of Products, goods or services to you, the Company may be unable to continue providing part or all of the relevant Products, goods or services.

(h) The right to object to the Company's Processing of your Personal Data for the purpose of preventing or restricting disclosure of Personal Data, use of Personal Data for advertising or marketing purposes, or for other reasons in accordance with the law. The Company shall implement the objection upon receiving your request, except where otherwise provided by law. Where the objection affects the provision of Products, goods or services to you, the Company may be unable to continue providing part or all of the relevant Products, goods or services.

(i) The right to lodge complaints, denunciations or initiate legal proceedings in accordance with the law.

(j) The right to request compensation for actual damages in accordance with the law if the Company violates regulations on the protection of your Personal Data.

(k) The right to protect your own rights in accordance with the Civil Code and relevant laws, or to request competent authorities or organizations to implement measures for the protection of civil rights.

(l) Other rights under this Policy and applicable law.

9.2. Your obligations

(a) To comply with applicable laws and the Company's regulations concerning the Processing of your Personal Data.

(b) To provide complete, truthful and accurate Personal Data and other information when inquiring about or using Products, goods and services, participating in interactive activities, marketing, surveys or other activities related to the Company, and to notify the Company of any changes to such information. You shall be responsible for any risks or damages arising from inaccurate, incomplete or untimely updated information provided by you.

(c) To cooperate with the Company, competent state authorities or Third Parties in the event of matters affecting the confidentiality of your Personal Data.

(d) To protect your own Personal Data; request relevant organizations and individuals to protect your Personal Data; and promptly notify the Company upon discovering any errors or mistakes concerning your Personal Data or suspecting that your Personal Data has been compromised.

(e) To respect and protect the Personal Data of others.

(f) To take responsibility for information and data created or provided by you in cyberspace; and to take responsibility where Personal Data is leaked or compromised due to your own fault.

(g) To regularly review and update this Policy and relevant regulations published by the Company on the website from time to time.

(h) To comply with laws on personal data protection and participate in preventing and combating violations of personal data protection regulations.

(i) Other obligations prescribed by law.

9.3. Methods of exercising rights

You may personally, or through a lawfully authorized person, submit a written request, including in electronic form, to exercise your rights to the Company using the contact information specified in Clause 3.1 of Article 3. The Company may request you to provide necessary information to verify your identity and the contents of the request.

The Company shall receive, respond to and process the request within the time limit prescribed by personal data protection laws. For requests for provision of Personal Data, the Company shall notify you of the time limit, method of provision and actual costs associated with printing, copying and sending the data, if any.

9.4. Opting out of advertising

You may opt out of receiving advertising information at any time by using one of the following methods:

(a) For text messages:Send an opt-out message using the format instructed in the advertising message;

(b) For telephone calls:Register with the "Do Not Call List" by sending a message using the format DK DNC to 5656 or via the website khongquangcao.ais.gov.vn. Subscribers on this list will not receive advertising messages or calls from any organization;

(c) For emails:Click "Unsubscribe" as instructed in the advertising email;

(d) Contact the Company using the contact information specified in Clause 3.1 of Article 3.

9.5. Limitations on rights

The Company may refuse or only partially fulfill a request and shall notify you of the reasons where:

(a) The data is being processed in a case where Consent is not required under Article 19 of the Personal Data Protection Law (e.g., invoices that must be retained under tax laws);

(b) Fulfillment of the request may harm national defense, national security or social order, or infringe upon the rights or legitimate interests of another person (e.g., camera footage containing images of other individuals that have not been blurred);

(c) The identity of the requester cannot be verified.

10.1. The Company applies appropriate administrative, technical and physical measures in accordance with the law to protect Personal Data, including: designating a department and personnel responsible for personal data protection; issuing internal regulations on data Processing; allocating and limiting access rights; and requiring Data Processors and Third Parties to apply corresponding data protection measures pursuant to contracts.

10.2. Upon detecting an incident that may affect Personal Data, the Company shall implement measures to prevent and remedy the incident and notify the competent authority and affected Customers in accordance with the law.

10.3. No security measure is absolutely secure in the Internet environment. The Company undertakes to apply measures appropriate to the requirements of applicable law and shall be responsible to you for damages caused by the Company's Processing of data, except where such damages arise from your own fault.

10.4. Fraud warning. The Company will never ask you to provide your password, OTP code, full card number, or transfer money in order to receive a gift via telephone, text message or social media. If you receive any such request purportedly made on behalf of LOTTE Mall West Lake Hanoi, please immediately notify the Company using the contact information specified in Clause 3.1 of Article 3.