PRIVACY POLICY AND PERSONAL DATA PROTECTION TERMS

Article 1: General Introduction to Hobiverse

The website www.hobiverse.com.vn (hereinafter referred to as "the Website") is the official e-commerce site owned by Viet Tinh Anh Joint Stock Company (Tax Code: 0309132354), with its headquarters at: 33-35 Ngo Thi Bi Street, Him Lam New Urban Area, Tan Hung Ward, Ho Chi Minh City.

Article 2: Hobiverse's Commitment to Personal Information Protection

The Privacy Policy published on this website explains why and how the Website collects, records, organizes, structures, stores, adapts or alters, retrieves, consults, uses, discloses, aligns or combines, restricts, erases or destroys the personal information that Customers provide when accessing the website, purchasing and using services, or interacting with Hobiverse.

  1. This Privacy Policy also guides you on how to exercise your rights related to your personal data.
  2. Hobiverse commits to adhering to the following principles when processing your personal information in accordance with applicable laws:
  3. Your personal data will be processed lawfully, fairly, and transparently;
  4. Your personal data will be collected for specific, explicit, and legitimate purposes and will not be processed for purposes other than those stated in this Policy;
  5. Your personal data will be stored appropriately and to the extent necessary for processing in accordance with applicable laws;
  6. Your personal data will be accurate, up-to-date, and inaccurate data related to the processing purpose will be erased or rectified promptly in accordance with applicable laws;
  7. Hobiverse implements appropriate technical and organizational management measures in accordance with applicable laws to ensure an appropriate level of personal data security, including measures to protect against unauthorized or unlawful access to personal data and against accidental destruction, loss, or damage.

Additionally, Hobiverse ensures that our partners (service providers, other suppliers, etc.) also adhere to the same level of personal data protection in contracts signed with Hobiverse.

Hobiverse commits to complying with other principles stipulated by law regarding personal data protection, especially regulations related to the rights of data subjects.

Article 3: Types of Data Collected and Processed

1. Basic Data

When you use our services, especially services accessed on the website: purchasing, loyalty programs, customer support centers, Hobiverse may collect and process the following types of personal information:

  1. Name and other identification information: name, gender, date of birth, mobile phone number, personal email address, preferences, other information related to special requests from Customers;
  2. Delivery information: Shipping address, mobile phone number;
  3. Information collected when you use the website: personal information collected automatically when Customers use the website, such as IP address, cookies, login credentials;
  4. For payment information data (including but not limited to: card number, expiration date, authentication code), Hobiverse is not the collector or processor of personal data. This data is provided directly by the Customer to the payment gateway, which is an independent data processor responsible for complying with specialized laws and personal data protection regulations;
  5. Communications between Hobiverse and Customers: exchanges, communication preferences (newsletter unsubscribe), requests for questions, participation in surveys, research, complaints, or phone communications.

2. Cookies and similar technologies:

A cookie is a small text file stored on the Customer's device when accessing the website. Cookies help record information such as IP address, source of access (e.g., from a search engine), and website usage behavior (e.g., how the Customer navigates the site). Hobiverse uses cookies and similar technologies to facilitate access and use of services; personalize the experience according to Customer settings; analyze and statistically track website access activities.

Article 4: Methods of Personal Data Collection

Hobiverse collects the personal information specified in Article 3 of this Privacy Policy through the website and Hobiverse stores when Customers make purchases, register for the Membership Program; interact with Hobiverse via social media, email, phone, or other interaction channels; when Customers subscribe to electronic newsletters, register to attend events, prize contests organized by Hobiverse; through cookies and similar technologies.

Article 5: Purposes of Personal Data Collection

The personal data provided by Customers is primarily used to serve the Customers' interests when they use Hobiverse's services. Therefore, Hobiverse collects and processes Customers' personal data for the following purposes:

1. Processing orders, deliveries, and providing after-sales services

To fulfill deliveries, Hobiverse processes information including full name, shipping address, phone number, and other identification information to process orders, make deliveries, and provide after-sales services such as warranty and product repair.

2. Membership Program (Mypoints)

To facilitate the Mypoints Membership Program, Hobiverse uses the personal data of Customers mentioned in Article 3.1 to ensure that Customers enjoy the exclusive benefits of being a Member: purchasing at preferential prices, accumulating points when shopping, receiving annual birthday codes, and many other benefits according to the Membership Program Policy

3. Fulfilling accounting and financial obligations

Hobiverse collects, stores, and uses customer data for internal business purposes such as record-keeping and compliance with legal and tax obligations as stipulated by law.

4. Customer Service

Hobiverse uses personal data to provide customers with the following customer service: (i) receiving information, feedback, suggestions, and complaints from customers to improve service quality; (ii) contacting customers to resolve their requests; (iii) performing statistical analysis to develop and improve services and offers based on personal information and customer requests; (iv) assisting customers faster, personalizing user experience, and improving website content and design; (v) after receiving customer consent, conducting customer satisfaction surveys to better understand customer needs; (vi) resolving customer complaints.

5. Contacting Customers

Hobiverse uses personal information to contact Customers to provide Hobiverse's services according to orders or the Membership program, as well as to answer Customer inquiries and resolve complaints.

6. Direct Marketing

Hobiverse may use customers' personal information for direct marketing purposes such as: (i) sending customers promotional information and the latest offers related to Hobiverse's products and services; (ii) sending customers electronic newsletters and other marketing information; (iii) selectively analyzing information relevant to customers; (iv) contacting customers to inform them about marketing campaigns to best meet their needs; (v) sending customers personalized advertisements and special offers on Hobiverse's products and services via order confirmation emails; (vi) sending customers the latest general offers on products and services from Hobiverse and its partners.

Hobiverse will only send the direct marketing communications mentioned above with the customer's prior consent (opt-in).

Customers can object to the use of their personal data for the direct marketing purposes mentioned above by clicking the unsubscribe link in the email or by contacting Hobiverse directly via hotline.

Article 6: Legal Basis for Personal Data Processing

Hobiverse processes customers' personal data based on: (i) receiving prior consent from the customer; (ii) fulfilling an order; (iii) fulfilling and complying with legal obligations as stipulated by law, or (iv) pursuing Hobiverse's legitimate rights and interests.

Customers express their consent through one of the following forms: (i) specific written or verbal consent; (ii) checking the consent/agreement box when registering an account, placing an order, or using features on the website; (iii) consent/agreement syntax via SMS; (iv) selecting technical consent/agreement settings; (v) another action demonstrating consent/agreement.

Customers may withdraw their consent at any time as stipulated in Article 9 below. In this case, Customers should note that withdrawing consent will not affect the lawfulness of processing personal data performed prior to the withdrawal based on the Customer's consent. Furthermore, if Customers refuse to provide, or provide incomplete or inaccurate information required to fulfill an order or comply with legal obligations, Hobiverse may not be able to provide Customers with full and quality services as requested.

According to the provisions of Decree 13/2023/ND-CP on personal data protection, Hobiverse has the right to process personal data without the customer's consent in the following cases:

  1. The public disclosure of personal data as stipulated by law.
  2. The processing of personal data by competent state agencies in cases of national defense, national security, social order and safety emergencies, major disasters, dangerous epidemics; when there is a risk of threatening national security or defense but not yet at the level of declaring an emergency; preventing and combating riots, terrorism, crime, and law violations as stipulated by law.
  3. To fulfill contractual obligations of the data subject with related agencies, organizations, or individuals as stipulated by law.
  4. Serving the operations of state agencies as stipulated by specialized law.

Article 7: Personal Data Retention Period

Hobiverse will store personal data provided by customers on its internal system for the period necessary to fulfill the announced data collection and processing purposes.

Personal data may continue to be stored in the following cases: (i) as required by applicable law; (ii) to fulfill legal, financial, or accounting obligations; (iii) to resolve complaints or disputes (if any); (iv) until the Customer makes a valid request to erase or destroy the data, unless otherwise stipulated by law.

Article 8: Agencies and Units Receiving Personal Data

1. Agencies and units receiving personal data

Hobiverse may disclose personal data to third parties, such as authorized employees of Viet Tinh Anh Company who have access to personal data, business partners, service providers involved in operating the website and providing services, and competent state agencies when legally required.

Hobiverse will make every effort to ensure that the employees or third parties mentioned above involved in the collection, processing, and provision of personal information understand the importance and comply with this Privacy Policy.

The provision of personal information to service providers will be carried out on a contractual basis to ensure that the information is protected at a level consistent with this Privacy Policy and applicable law.

Hobiverse commits not to sell or rent customer personal information to any third party without the customer's consent, except as required by law.

2. Transfer of personal data abroad

Currently, Hobiverse does not transfer customers' personal data abroad. Should this activity occur, Hobiverse will provide notification and fully comply with all relevant legal regulations.

Article 9: Customer Rights Regarding Collected Data

1. Based on current law, customers – as personal data owners – have the following rights:

a. Right to access

Customers have the right to know about the collection, use, and processing of their personal data by Hobiverse, unless otherwise stipulated by law.

b. Right to rectification

Customers have the right to request Hobiverse to correct or update inaccurate or incomplete information related to them.

c. Right to erasure

Customers have the right to request the erasure of their personal data stored by Hobiverse in cases permitted by law, including but not limited to situations where the customer's personal data is no longer necessary for the original collection and processing purposes, or the data has been unlawfully processed.

Hobiverse may refuse a customer's request for data erasure in cases where the law does not permit erasure or in accordance with the provisions of personal data protection laws.

d. Right to restrict personal data processing

Customers have the right to request Hobiverse to restrict the processing of personal data without erasing it, under the conditions and scope permitted by law.

e. Right to data portability

Customers have the right to retrieve some of their data for personal use or to transfer it to another company/enterprise within technical limits and as permitted by law.

f. Right to object

Customers have the right to object to the processing of their personal data for direct marketing purposes.

g. Right to withdraw consent

Customers have the right to withdraw their consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

The withdrawal of consent may affect Hobiverse's ability to provide full and quality services to Customers.

h. Right to lodge a complaint

Customers have the right to lodge a complaint with a competent state agency if they believe their personal data protection rights have been violated.

i. Right to compensation

Customers have the right to claim damages as stipulated by law if there is a violation of regulations on the protection of their personal data, unless otherwise agreed by the parties or stipulated by law.

2. Customers can exercise the above rights by contacting Hobiverse via postal address or email as follows:

Viet Tinh Anh Joint Stock Company

Address: 33-35 Ngo Thi Bi Street, Tan Hung Ward, Ho Chi Minh City, Vietnam

Email: lienhe@Hobiverse.com.vn

When submitting a request, customers are kindly requested to provide the necessary information to verify their identity. Hobiverse will respond and process the request within a reasonable timeframe as stipulated by current law.

Article 10: Children's Personal Information

Hobiverse does not intentionally collect or process personal data of children as stipulated by law. Should personal data of children be processed, Hobiverse will comply with all current legal regulations.

Article 11: Technical and Management Measures for Personal Data Protection

To ensure the security of personal information against risks due to loss, theft, leakage, counterfeiting, or any other risks during processing, Hobiverse employs appropriate technical and management measures, including but not limited to the following:

1. Critical personal information is stored and managed under strict access control, accessible only to authorized individuals and departments.

2. Understanding the risks of cyberattacks, the potential and severity of damages that could impact personal rights and freedoms, Hobiverse implements appropriate measures to:

  1. Protect customer personal information from leakage or damage due to cyberattacks, technical incidents, or malware;
  2. Control and prevent unauthorized external access to the information system;
  3. Implement appropriate technical and organizational measures to ensure a level of security commensurate with the risk, including the application of encryption, anonymization, or other personal data protection methods;
  4. Ensure the confidentiality, integrity, and availability of the personal data processing system within its scope;
  5. Implement measures to promptly restore access to personal data in the event of physical or technical incidents;
  6. Regularly review and evaluate the effectiveness of technical and organizational security measures to adjust them as necessary;
  7. Issue internal regulations on personal data protection and guide and train staff to comply with these regulations during their work.

Article 12: Communication with Customers and Notification to Competent Authorities Regarding Personal Data Breaches

1. When a personal data breach is detected, Hobiverse will promptly apply technical measures within its reasonable capacity to minimize and prevent the impact or consequences of the breach. Hobiverse will notify customers and competent authorities in accordance with personal data protection laws. The content of the notification will be presented in clear, easy-to-understand language and will include the following key information:

  1. Name and contact information of the Personal Data Protection Officer or contact point for customers to request further information;
  2. Description of the nature of the personal data breach incident, including the time, location, type of data affected, and extent of impact (if identifiable);
  3. Possible consequences arising from the breach incident;
  4. Measures Hobiverse has implemented or is implementing, or proposes to implement, to resolve the incident and mitigate risks for customers.

2. In certain special circumstances, when direct notification to each Customer cannot be made despite Hobiverse having applied reasonable measures, Hobiverse will make public announcements through its website, media, or other appropriate forms to ensure that Customers are still informed in a timely and effective manner, in accordance with legal regulations.

Article 13: Contact Information

Customers who wish to exercise their rights related to personal data or have comments, feedback, or complaints regarding this Privacy Policy and Personal Data Protection Terms may contact Hobiverse through the following channels:

Article 14: Policy Effectiveness and Amendments

This Privacy Policy and Personal Data Protection Terms shall be effective from the date of its publication on the Website.

Hobiverse reserves the right to amend and update the content of the Privacy Policy from time to time to align with actual operations and legal regulations. The updated version will be posted on the Hobiverse website on the same update date for Customers to be aware of the latest update.

The Customer's continued use of the Website after the Policy is updated signifies the Customer's agreement to the amended content.

This Information Privacy Policy was last updated in February 2026.