Privacy Policy and Personal Data Processing Policy of LENDI Platform

Article 1. Purpose and scope of application

1. This Privacy Policy and Personal Data Processing Policy (“Policy”) sets forth the manner in which LENDI collects, processes, uses, stores, protects, and shares personal data of users of the LENDI Platform (“Users”).
2. This Policy applies to all Users, including but not limited to:
   1. Asset Owners (Lessors);
   2. Lessees;
   3. Representatives, employees, or authorized persons of organizations using LENDI; and
   4. Individuals whose data is provided by Users or generated in the course of using the Platform, within the scope permitted by law.
3. This Policy forms an integral part of the Terms and Conditions of Use of the LENDI Platform (“T&C”). Account registration, use of the Platform, and/or confirmation of agreement with the T&C shall be conducted pursuant to the mechanisms applied on the Platform and pursuant to the provisions of law.
4. In the event of matters relating to complaints, disputes, collection and use of evidence, or transaction processing, the corresponding provisions of the T&C and LENDI’s Complaint and Dispute Resolution Procedure shall apply concurrently.

Article 2. Principles of personal data processing

LENDI shall perform the processing of personal data pursuant to the following principles:

1. For clear purposes, aligned with LENDI’s operations, and within the scope permitted by law;
2. Collecting and processing data strictly to the extent necessary for the corresponding purposes;
3. Ensuring the accuracy, currency, and appropriateness of data within the scope controllable by LENDI;
4. Applying appropriate measures to protect data from unauthorized access, use, disclosure, alteration, or destruction;
5. Respecting and ensuring the rights of data subjects pursuant to applicable law;
6. Not using personal data for purposes inconsistent with this Policy, except where consented to by the User or permitted/required by law.

Article 3. Identification information and account information

Depending on the type of account and services used, LENDI may collect:

1. Full name;
2. Date, month, and year of birth;
3. Number and information on Citizen Identity Cards, passports, or other lawful identification documents;
4. Information on nationality, where necessary;
5. Identification photos and information serving identity verification;
6. Login information, account details, and activity history on LENDI.

Article 4. Contact information and address verification

LENDI may collect:

1. Telephone number;
2. Email address;
3. Residential address or contact address;
4. Address verification documents, such as utility bills, bank statements, or equivalent documents, where necessary.

Article 5. Information of organizations

For Users that are organizations or representatives of organizations, LENDI may collect:

1. Organization name;
2. Enterprise Registration Certificate or equivalent legal documents;
3. Enterprise code/tax identification number;
4. Information of the legal representative or authorized person;
5. Contact information and address of the organization;
6. Other documents necessary to verify legal status or asset ownership/lease rights.

Article 6. Financial and payment information

Depending on payment methods and transactions, LENDI may process:

1. Bank account information or payment methods linked by the User;
2. Information relating to payment transactions, rental fees, service fees, and Security Deposits;
3. Payment history, refunds, withdrawals, and reconciliations;
4. Information proving financial capacity where required pursuant to LENDI’s criteria or for certain asset categories.

LENDI may utilize payment partners or financial service providers to execute transactions. In such cases, the processing of payment information may additionally be governed by the privacy policies of the corresponding providers.

Article 7. eKYC data and biometric data

1. LENDI may utilize third-party eKYC services to verify User identity.
2. During the eKYC process, LENDI may collect and process information from identification documents, images, and biometric data, including facial biometric data, to the extent necessary to verify identity, reconcile information, prevent fraud, prevent impersonation or the use of another person’s identity, and ensure transaction safety.
3. eKYC services may be conducted via systems or APIs provided by third parties. In such cases, data may be shared with or processed by eKYC service providers to the extent necessary to provide services to LENDI and pursuant to agreements, confidentiality requirements, and applicable provisions of law.
4. The processing of biometric data shall be conducted pursuant to applicable provisions of law and corresponding requirements on personal data protection.
5. In the event of unsuccessful verification, invalid information, expired documents, use of another person’s identity, or indications of fraud, LENDI may refuse verification, request supplementary verification, restrict functionality, or lock the account pursuant to the T&C and applicable provisions of law.

Article 8. Data arising from transactions and asset utilization

LENDI may collect and process:

1. Information regarding assets posted or leased on the Platform;
2. Information regarding rental prices, rental duration, and transaction conditions;
3. Electronic contracts, transaction confirmations, transaction history, data on leasing processes and transaction confirmations, electronic confirmations performed by Users, and other electronic data relating to the execution and performance of transactions;
4. Information on delivery, transportation, and return of assets;
5. Asset condition inspection results;
6. Images, videos, handover records, joint-inspection records, or other documents relating to the delivery and return of assets;
7. Information relating to complaints, disputes, compensation claims, or handling of violations.

Users shall be responsible for ensuring that the provision of images, videos, or information containing personal data of third parties to LENDI is conducted on a lawful basis.

Article 9. Usage behavior data and Trust Score

1. LENDI may collect data regarding User activities on the Platform, including transaction history, fulfillment of obligations, asset status, complaint history, and other factors relevant to account trustworthiness.
2. Such data may be used to build, maintain, or update the User’s Trust Score for the purposes of assessing the User’s trustworthiness in using the Platform, supporting transaction management, detecting fraud, and managing risks, in accordance with the criteria and mechanisms announced or applied by LENDI from time to time.
3. In certain cases, LENDI may use automated processing or a combination of automated processing and human review to assess transactions, detect fraud, manage risks, or determine appropriate account management measures in accordance with the Platform’s rules and applicable law.
4. Detailed information regarding the algorithms, internal criteria, or operational mechanisms of the Trust Score may be kept confidential to protect the security and integrity of the Platform, without prejudice to the User’s rights with respect to their personal data under applicable law.

Article 10. Technical data and communication information

When Users access or use LENDI, the system may record appropriate technical data, including device information, operating system, IP address, access time, system logs, and similar information necessary for the operation, security, and improvement of the Platform.

LENDI may also store communications between Users and LENDI or information relating to transactions to the extent necessary for customer support, complaint and dispute resolution, and the protection of lawful rights and interests of the parties.

Article 11. Data sources

Personal data may be collected from:

1. Users directly upon registering and using LENDI;
2. Other Users within the same transaction;
3. eKYC, payment, logistics partners, and service providers of LENDI;
4. Documents and records provided by Users;
5. Systems and technology of LENDI during the User’s utilization of the Platform;
6. State authorities or other lawful sources of information, where permitted or required by law.

Article 12. Purposes of data processing

LENDI shall process personal data for the following primary purposes:

1. Registration, authentication, and account management;
2. Execution of eKYC and identity verification;
3. Assessment of transaction eligibility and capacity to fulfill requirements for each asset category;
4. Connecting Asset Owners and Lessees, establishing and executing transactions;
5. Processing payments, refunds, reconciliations, and managing Security Deposits;
6. Coordinating delivery, inspection, handover, and return of assets;
7. Detecting, preventing, and handling fraud, impersonation, violations, or platform abuse;
8. Processing, calculating, updating, and managing Trust Scores, and managing risks;
9. Receiving and resolving complaints and disputes;
10. Providing customer support and responding to User requests;
11. Fulfilling obligations pursuant to law, requests of competent state authorities, or decisions of jurisdictional bodies;
12. Protecting the rights, property, safety, and lawful interests of LENDI, Users, and third parties;
13. Analyzing, improving, and developing the Platform, products, and services;
14. Sending information on products, services, or programs of LENDI where consent is required by law and the User has consented to receive such information;
15. Recording, storing, retrieving information, and utilizing electronic data relating to leasing processes, transaction confirmations, contract executions, and performance, including for proving transactions, fulfilling legal obligations, and resolving complaints and disputes.

Article 13. Bases for data processing

LENDI shall process personal data on one or more appropriate bases pursuant to applicable law, including:

1. Consent of the data subject;
2. Performance of contracts, transactions, or agreements to which the data subject is a party;
3. Compliance with legal obligations of LENDI;
4. Protection of the lawful rights and interests of LENDI, Users, or third parties within the scope permitted by law;
5. Other processing cases permitted or required by law.

Article 14. Consent and withdrawal of consent

1. Where consent is required by law, LENDI shall perform the collection and recording of consent through appropriate methods.
2. Users may withdraw consent for data processing activities conducted on the basis of consent, except where law permits or requires LENDI to continue processing data on another lawful basis.
3. Withdrawal of consent may affect the User’s ability to continue using certain functions or services of LENDI if the corresponding data processing is necessary to provide the service.

Article 15. Parties permitted access to data

Depending on processing purposes and the necessary scope, personal data may be accessed by:

1. LENDI personnel authorized in accordance with job functions;
2. eKYC service partners;
3. Payment partners and relevant financial service providers;
4. Logistics units and parties participating in the asset delivery process;
5. Technology, storage, operation, and platform support service providers;
6. Parties participating in complaint and dispute resolution or providing legal, auditing, and other professional services to LENDI;
7. Competent state authorities or jurisdictional bodies when proper legal grounds exist.

LENDI may permit the aforementioned parties to access or process personal data via systems, platforms, or technical tools of LENDI or relevant service providers, to the extent necessary to execute transactions, provide services, verify identity, process payments, deliver assets, prevent fraud, resolve complaints and disputes, and fulfill legal obligations.

Article 16. Providing data to third parties

1. LENDI shall not sell Users’ personal data to third parties for use for their own purposes inconsistent with this Policy.
2. LENDI may provide or permit third parties to process personal data under cases specified in this Policy, the T&C, pursuant to requests or mechanisms necessary to execute transactions, or in cases permitted or required by law.
3. In the event that providing data to third parties falls under cases requiring User consent pursuant to law, LENDI shall seek and record consent pursuant to applicable provisions of law.
4. For third parties that process personal data on behalf of or under the instructions of LENDI, LENDI shall implement appropriate measures and agreements to define the scope and purposes of processing, data protection responsibilities, and other relevant obligations of such third parties in accordance with applicable law.
5. Third parties granted access to personal data shall process such data only within the permitted scope and apply appropriate data protection and security measures in accordance with applicable law and their agreements with LENDI, where applicable.

Article 17. Cross-border transfer of personal data

1. In the event that LENDI or LENDI’s service providers utilize systems, servers, or services provided from outside Vietnam resulting in the transfer of personal data offshore, LENDI shall perform corresponding obligations pursuant to Vietnamese law on personal data protection.
2. Depending on each case, measures may include impact assessments, dossier preparation, agreements with data recipients, application of security measures, and execution of notification or consent procedures pursuant to statutory provisions.

Article 18. Storage duration

1. LENDI shall store personal data for the duration necessary to fulfill collection purposes, provide services, manage transactions, resolve complaints and disputes, prevent fraud, and fulfill legal obligations.
2. Certain data may be stored for a duration longer than the period during which the User maintains an account if storage is necessary to:
   1. Comply with legal obligations;
   2. Execute or prove transactions;
   3. Resolve complaints and disputes;
   4. Detect and handle fraud or violations; or
   5. Protect the lawful rights and interests of LENDI or third parties.
3. When data is no longer necessary or upon expiry of the storage duration under regulations, LENDI shall perform deletion, destruction, anonymization, or apply other appropriate processing measures pursuant to law.
4. For electronic data relating to transactions and contracts executed on the Platform, including booking information, transaction confirmations, contract content, party confirmations, and other relevant data, LENDI may store and ensure accessibility for a minimum duration of 03 (three) years from the time of execution, or a longer duration if required by applicable law.
5. Storage duration for eKYC data, biometric data, and other categories of personal data may vary depending on processing purposes, data categories, legal requirements, and LENDI’s legitimate storage needs. LENDI shall determine and apply appropriate storage durations on a case-by-case basis.

Article 19. Data security

1. LENDI shall apply management, technical, and organizational measures appropriate to the nature of data and associated risks to protect personal data.
2. Access to data within LENDI shall be conducted pursuant to authorization principles and job needs.
3. LENDI shall require partners and service providers authorized to access personal data to fulfill appropriate confidentiality and data protection obligations.
4. In the event of a personal data incident, LENDI shall promptly take necessary measures to detect, respond to, contain, and remediate the incident, and shall notify and/or report to affected Users and/or competent authorities within the time limits and in accordance with the procedures prescribed by applicable law.

Article 20. Rights of Users

Within the scope of applicable law, Users may exercise rights regarding their personal data, including:

1. The right to be informed of data processing activities;
2. The right to consent or withdraw consent where processing is based on consent;
3. The right to access and request the provision of personal data information;
4. The right to request correction and updating of inaccurate or incomplete data;
5. The right to request data deletion in cases permitted by law;
6. The right to request restriction of data processing in cases specified by law;
7. The right to object to certain data processing activities pursuant to provisions of law;
8. The right to lodge complaints, denunciations, institute legal proceedings, or exercise other rights pursuant to law;
9. Other rights of data subjects pursuant to Vietnamese law.

Article 21. Fulfilling requests of data subjects

1. Users may submit requests relating to personal data via support functions on LENDI or contact channels announced by LENDI.
2. To protect personal data, LENDI may require Users to perform identity verification steps prior to processing requests.
3. LENDI shall receive, evaluate, and process requests within time limits and sequences consistent with applicable law.
4. In certain cases, LENDI may refuse or limit the fulfillment of requests if providing, correcting, deleting, or restricting data processing affects legal obligations, or lawful rights and interests of LENDI or third parties, or falls under cases where refusal is permitted by law.

Article 22. Account deletion

1. Users may request account closure or deletion via functions provided by LENDI or through support channels.
2. Account deletion does not imply immediate deletion of all data. LENDI may continue storing certain data for the necessary duration pursuant to Article 18 of this Policy.
3. Account deletion shall not affect payment obligations, compensation, complaint and dispute resolution, or other obligations arising prior to the time of account deletion.

Article 23. Minor users

1. LENDI applies age conditions appropriate to each asset category pursuant to the T&C. Users aged full 15 years or older may use LENDI to lease standard assets under applicable conditions; for premium assets or transactions falling under higher age requirement groups, Users must satisfy corresponding age conditions pursuant to the T&C.
2. For Users aged from full 15 years to under 18 years, LENDI may apply supplementary verification measures and/or require confirmation, consent, or participation of parents or legal representatives depending on transaction type, asset value, risk level, and requirements of law or LENDI policies.
3. LENDI does not actively collect children’s data outside the scope necessary to provide services and fulfill legal obligations.

Article 24. Information confidentiality

In addition to personal data, LENDI may receive or generate confidential information relating to Platform operations, including business information, technical information, trade secrets, algorithms, Trust Score mechanisms, asset valuation data, and other internal information.

LENDI applies appropriate measures to restrict disclosure of such information to unauthorized parties, except where necessary for Platform operations, service provision, dispute resolution, or as required by law.

Article 25. Cookies and similar technologies

1. LENDI may use cookies, device identifiers, system logs, and similar technologies to maintain login sessions, remember preferences, secure accounts, analyze performance, and improve User experience.
2. Certain cookies or technologies may be provided by third parties. The use of such technologies may be governed by the policies of corresponding providers.
3. Users may adjust certain cookie settings on their devices or browsers. However, disabling certain necessary cookies may affect the ability to use certain functions of LENDI.

Article 26. Policy updates

1. LENDI may amend or update this Policy to reflect changes in law, business activities, technology, or Platform operating methods.
2. Updated versions shall be posted on LENDI and may be notified through appropriate methods.
3. Where law requires User consent or re-confirmation for changed content, LENDI shall execute corresponding procedures.
4. Users should regularly check the Policy to stay updated on the latest changes.

Article 27. Contact channels

All requests, inquiries, or complaints relating to personal data processing may be submitted via support channels or contact information announced by LENDI on the Platform.

When submitting requests, Users should provide necessary information for LENDI to identify the account and request contents.

Article 28. Effectiveness

1. This Policy shall take effect from the date of publication on LENDI, unless otherwise specified by LENDI.
2. If any part of this Policy is determined invalid or unenforceable under law, the remaining parts shall continue in full force and effect.
3. This Policy shall be interpreted and applied pursuant to Vietnamese law on personal data protection and relevant legal provisions.