PRIVACY NOTICE AND PROCESSING OF PERSONAL DATA CONSENT FORM (FOR CANDIDATES)

(Issued / effective date: 01/07/2026, superseding the 05/2024 updated version)

TRUSTING SOCIAL JSC, located at 8th Floor, Havanna Tower, 132 Ham Nghi, Ben Thanh Ward, Ho Chi Minh City, Vietnam, Tax code 0106957913; and TRUST IQ LLC, located at 4th Floor, Havanna Tower, 132 Ham Nghi, Ben Thanh Ward, Ho Chi Minh City, Vietnam, Tax Code 0313916390 (each of the above companies, together with its branches, subsidiaries, affiliates and parent company, collectively the "Company", "we"):

Pursuant to the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP dated 31 December 2025, together with their amendments, supplements and guiding documents from time to time (the "PDPL"), and relevant regulations;

For the purposes of recruitment, assessment and interaction with candidates, the Company, in its capacity as the Data Controller (or Data Controller-cum-Processor, as applicable, as defined in the PDPL), through this notice (the "Notice") informs the candidate (the "Candidate", "you") about the collection, use, processing, storage and transfer of the Personal Data of the Candidate and of third parties provided by the Candidate, and the related rights and obligations.

"Candidate" means a job applicant or applicant for positions under employment, partnership or ad-hoc engagements who is involved in the Company's recruitment process.

When providing Personal Data of related persons (referees, emergency contacts, next-of-kin, etc.), the Candidate affirms and ensures that they have informed and obtained valid consent from such persons and have full authority to act on their behalf. The Company is not obliged to verify the accuracy or legality of such authorization and consent.

By electronically confirming under Article 9, or by sharing Personal Data with the Company, the Candidate confirms that they have read, understood, agreed and accepted the contents of this Notice.

Article 1. Purposes of Personal Data Processing

The Company processes the Candidate's Personal Data for the following purposes (the "Purposes"):

Assessing and evaluating the Candidate's skills, qualifications, experience and suitability for career opportunities at the Company; ensuring a fair and transparent recruitment process;
Communicating regarding the application, interview scheduling and the progress and results of recruitment;
Verifying identity and the accuracy of information; conducting reference checks and background checks (where permitted by law and necessary);
Considering the Candidate for current or future positions; analyzing and improving the recruitment process;
Where the Candidate is successful: transferring Personal Data into the personnel file and carrying out administrative and HR procedures related to joining the Company;
Detecting, preventing and addressing fraud, security or technical issues;
Seeking professional advice (including legal advice); exercising and protecting the Company's rights and legitimate interests; resolving complaints and disputes;
Fulfilling legal obligations and procedures with competent state authorities and other compliance purposes.

Article 2. Types of Personal Data Processed

2.1. Depending on the Purposes in Article 1, the Company may collect and process data associated with the Candidate or a related individual, including (the "Personal Data"): last, middle and first name, and other names; gender; nationality; date of birth; contact address and residence; phone number, email address; personal image (photo); education, qualifications and professional certificates; experience, work history, skills and achievements; salary history and expected salary; personal identification number/citizen ID number, passport number (if provided by the Candidate); public online identifiers provided by the Candidate (e.g. LinkedIn profile URL, public GitHub account), for which the Company only collects the public identifier or URL and does not collect passwords or login credentials; referee information provided by the Candidate; and other information the Candidate voluntarily provides during the application.

2.2. Within the scope of recruitment activities under this Notice, the Company does not request or process sensitive personal data of the Candidate. Where the Candidate is successful, the processing of Personal Data (including sensitive personal data, if any) after onboarding is governed by the Privacy Notice and Processing of Personal Data Consent Form applicable to employees.

Article 3. Sources of Personal Data

3.1. Directly from the Candidate, for example when the Candidate: applies via the Company's career site, a third-party recruitment platform (e.g. LinkedIn, ITViec) or another channel; proceeds through the recruitment process; contacts the Company about the application.

3.2. From other sources: Company employees who refer to the Candidate; third-party recruitment service providers; academic institutions, previous employers and referees (to verify information provided by the Candidate); and publicly available sources on which the Candidate has published information (e.g. LinkedIn).

3.3. The Company retains only Personal Data that is necessary and relevant to the Purposes.

Article 4. Personal Data Processing Activities

4.1. To fulfill the Purposes in Article 1, the Company may: collect; analyze, correlate and aggregate; store on on-premises systems and on the infrastructure/systems of Data Processors (including the recruitment management system/platform used by the Company, e.g. Trakstar, and third-party cloud infrastructure); transmit and share with the parties in Article 5; delete and destroy.

4.2. Cross-border transfer. Personal Data may be stored or processed by Data Processors or on infrastructure located/hosted outside Vietnam (including recruitment systems/platforms and storage or analytics services of foreign suppliers). Such cross-border transfer is carried out in accordance with the PDPL, including the preparation and maintenance of a cross-border transfer impact assessment (TIA), combined with domestic backup storage as required.

4.3. Automated processing and artificial intelligence (AI). Processing may be carried out, in whole or in part, by automated means, including the use of artificial intelligence (AI), including third-party AI services, to support the intake, screening, classification, summarization and evaluation of applications, consistent with the disclosed purposes and the data-minimization principle. The Company notifies the Candidate of such automated processing and provides a general explanation of its operating principles and its impact on the Candidate's rights and legitimate interests. Such automated processing is not intended to make significantly-affecting decisions independently; any recruitment decision relating to the Candidate is subject to human review before application. The Candidate may request human intervention in respect of automated results that significantly affect them and, to the extent offered by the Company, may opt out of non-mandatory forms of automated processing. Where third-party AI services are used, the Company applies appropriate controls, including data minimization or anonymization where feasible and requiring the provider to commit to confidentiality and not to use the Company's data to train models.

Article 5. Disclosure of Personal Data

5.1. The Company may share all or part of the Personal Data with: departments and affiliates within or outside Vietnam; Data Processors and service providers (infrastructure, storage, analytics, recruitment management systems/platforms, e.g. Trakstar); professional advisors (legal, financial); competent state authorities; and other third parties where reasonably required (e.g. an employee who referred the Candidate).

5.2. In certain cases, where the Candidate independently applies via a third-party recruitment platform (e.g. LinkedIn, ITViec, other job portals), such party may collect Personal Data as an independent Data Controller, i.e. determining its own processing purposes and not acting on the Company's instructions. The Candidate should refer to that party's privacy notice and contact it directly to exercise any rights over data under its control.

Article 6. Rights and Obligations of the Candidate

6.1. The Candidate has the rights under the PDPL, including: the right to be informed; the right to consent/withhold and withdraw consent; the right to access, view and rectify; the right to request provision of data; the right to request deletion or restriction of processing; the right to object to processing; and the right to complain, denounce, initiate legal proceedings and claim compensation, in accordance with the law and statutory limitations (including cases of processing without consent).

6.2. To exercise these rights, the Candidate may submit a request to the Company's data protection function via email data-privacy@trustingsocial.com. The Company receives, verifies identity (for security purposes) and handles the request within the time limits prescribed by the PDPL and the Company's personal data protection policy.

6.3. The Candidate is obliged to: provide accurate Personal Data and promptly update any changes; ensure valid consent of related persons has been obtained when providing their data.

Article 7. Rights and Obligations of the Company

7.1. The Company complies with the PDPL and relevant laws; applies appropriate technical and organizational measures to ensure the security and confidentiality of Personal Data; ensures Data Processors/third parties are bound by equivalent obligations.

7.2. The Company processes Personal Data to the extent necessary and consistent with the Purposes, unless otherwise required by law; upon a breach, implements remedial measures and notifies the competent authority and/or data subjects within the statutory time limits.

7.3. The Company deletes or returns Personal Data upon the Candidate's lawful request, except where the law permits continued processing or the parties have otherwise agreed.

Article 8. Retention of Personal Data

8.1. The Company retains the application, résumé and documents containing Personal Data for a period of 12 (twelve) months from the end of the recruitment process for the position applied for, or from the Candidate's most recent interaction with the Company, whichever is later, in order to make contact when a suitable vacancy arises; and securely deletes or destroys them upon expiry of that period or upon the Candidate's request, unless otherwise required by law.

8.2. For a successful Candidate: Personal Data is transferred into the employee file and the employee retention periods of the Company apply.

8.3. The Company may continue to retain or process data where necessary to resolve disputes or complaints, to exercise or defend the Company's rights and legitimate interests, or as required by a competent state authority. Upon expiry of the applicable period, Personal Data is deleted or anonymized through a secure process.

Article 9. Legal Basis and Confirmation

9.1. Processing is carried out on the following legal bases: (i) to perform pre-contractual steps and related contracts between the Company and the Candidate; (ii) to protect the rights and legitimate interests of the Company or others; (iii) to prevent and combat violations of law; (iv) other cases as provided by law; or (v) on the basis of the Candidate's consent. If one legal basis is held inapplicable, the remaining bases continue to apply.

9.2. Confirmation mechanism. After viewing the entire Notice, the Candidate performs an electronic confirmation on the Company's recruitment system/platform (e.g. ticking the "I agree"/"Yes" box), thereby confirming they have read, understood, agreed and accepted the entire Notice. This action constitutes active, clear consent with legal value and is verifiable; the system records identity, the version of the Notice (issued date), timestamp and confirmation log as evidence. Consent is voluntary; the Candidate may withhold or withdraw consent and may contact data-privacy@trustingsocial.com for clarification before confirming.

Article 10. General Terms

10.1. This Notice is an independent document governing Personal Data processing and does not depend on any recruitment/employment contract between the Company and the Candidate.

10.2. This Notice takes effect from 01 July 2026, is published at https://trustingsocial.com/candidate-data-consent-vi, and supersedes the previous 05/2024 updated version. This Notice may be updated by the Company from time to time; the latest version is published at the above address and takes effect from the time of publication; the Candidate's confirmation applies to the version displayed at the time of confirmation. Where required by law, the Company will re-collect consent for such changes.

10.3. Terms not defined in this Notice shall be interpreted in accordance with the PDPL. If any provision is invalid, the remaining provisions remain in full force and effect.

10.4. This Notice shall be interpreted and governed by the laws of Vietnam. Any dispute arising out of or in connection with this Notice shall be resolved by arbitration at the Vietnam International Arbitration Centre (VIAC) in accordance with its Rules of Arbitration. The number of arbitrators is three. The place of arbitration shall be Ho Chi Minh City, Vietnam. The language of arbitration shall be Vietnamese.

10.5. This Notice is made in Vietnamese and English of equal validity. In case of any difference or inconsistency between the Vietnamese and English versions, the Vietnamese version shall prevail.

10.6. Contact: data protection function, email data-privacy@trustingsocial.com.