Privacy Notice for Employees

Long Son Petrochemicals Co.,Ltd respects the privacy rights of our employees. To ensure your personal data is protected, this notice explains how we process your personal data in electronic and other formats in accordance with Vietnam’s Personal Data Protection Laws.

1. Definitions

1.1. “We” means Long Son Petrochemicals Co.,Ltd.

1.2. “You” means employees and staff of Long Son Petrochemicals Co.,Ltd.

1.3. “Processing” means any act impacting personal data: collecting, recording, analyzing, confirming, storing, editing, publicizing, disclosing, combining, accessing, retrieving, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying.

1.4. “Vietnam Personal Data Protection Laws” refers to applicable Vietnamese laws, including Decree No. 13/2023/ND‑CP on Personal Data Protection (as amended or replaced).

2. Purposes of Processing

2.1. We process your personal data for purposes including:

1. Performing contractual obligations and pre‑contract steps: employment contracts, personnel management, ethics compliance, transfers, training, appraisals, compensation, health & safety.
2. Complying with legal obligations: labor laws, social security, occupational safety, disease control.
3. Managing HR: manpower analysis, resource allocation, employee development.
4. Providing benefits: medical, insurance, staff facilities.
5. Managing finances & budgets, internal communications, third‑party interactions.
6. Handling registrations & certifications: document publication, reporting to regulators.
7. Verifying employee information, maintaining work history databases, internal news dissemination.
8. Enhancing workplace conditions, facilities, and information security.
9. Creating user accounts, granting system access, implementing security measures.
10. Preventing accidents and crime, investigating complaints/fraud, post‑employment matters.
11. Establishing or defending legal claims.
12. Protecting vital interests: emergency contact, disease prevention.
13. Performing public‑interest tasks or exercising official authority.

The above list is illustrative and may be updated as needed.

2.2. For purposes requiring consent, we will inform you at the time of collection and in subsequent sections of this notice.

3. Personal Data We Collect

We collect personal data directly from you and indirectly from sources such as government agencies, SCG Group companies, recruitment platforms, business partners, authorized individuals, and trusted service providers.

3.1. Types of Data Collected

1. Recruitment information: resumes, CVs, application letters, recruiter comments.
2. Contact details: name, address, phone, email, social media.
3. Identification: ID number, passport, driver’s license, social security number, tax ID.
4. Immigration/residency: permits, visas.
5. Personal details: birth date, age, gender, marital status, interests, opinions.
6. Family info: dependents’ data; inform them of this notice before sharing.
7. Photos & videos.
8. Education & qualifications: institutions, training, test results, professional credentials, language skills, references.
9. Work experience: positions, employers, salaries, compensation.
10. Work location info.
11. Employee characteristics: behavior, skills, leadership, teamwork, emotional intelligence, organizational commitment.
12. Regulatory reporting: data for statutory reports (e.g., Ministry of Labor).
13. Financial data: bank accounts, wages, taxes, provident fund, loans, securities.
14. Social security & benefits: coverage, welfare, compensation.
15. Attendance: hours, overtime, absences, leave.
16. Work history: roles, meeting records, director-level details.
17. IT usage: system, network, application access logs per IT policy.
18. Participation: surveys, assessments.
19. Shared info: questionnaire, tool inputs.
20. Identification documents: IDs, passports, household registrations.
21. Emergency contacts.
22. Vehicle & driving: licenses, company vehicle data.
23. Conflict of interest: holdings, partner relationships.
24. Accident records.
25. Employment & welfare: contract compliance, post‑retirement care.
26. Whistleblowing & disciplinary: complaints, investigations.

3.2. Sensitive Personal Data

When necessary, we process sensitive data under Vietnamese law with appropriate safeguards:

1. Facial recognition or fingerprint data for identity verification.
2. Health data (allergies, vaccinations) for events and compliance.
3. Unintentionally received sensitive data (e.g., religious beliefs) will be redacted or not processed.
4. May include financial and location data.

3.3. Additional Data: We will notify you and comply with law if more data is needed.

3.4. Third‑Party Disclosure: You must have rights to share others’ data and inform them of this notice.

4. Cookies

4.1. We use cookies and similar tech per our Cookies Notice.

5. Consent, Withdrawal & Consequences

5.1. You may withdraw consent any time; prior processing remains valid.

5.2. Withdrawal or refusal may prevent some processing purposes.

5.3. Withdraw via consent channels (e.g., account settings) or contact us at Section 11.

5.4. Under-16s or legally incapacitated must obtain guardian authorization.

5.5. Consenting on others’ behalf requires legal authority.

6. Retention Period

6.1. Retain data as needed for purposes, unless law requires longer.

6.2. We delete/destroy data when no longer necessary.

6.3. If consent-based, stop processing upon withdrawal but may retain for record-keeping.

7. Disclosure

7.1. Shared with:

1. SCG Group companies (inside & outside Vietnam) per latest report at https://scc.listedcompany.com/ar.html;
2. Other parties (recruiters, service providers, IT, finance, regulators, etc.) as needed to conduct business and meet processing purposes.

7.2. Recipients may have their own privacy notices—please review them.

7.3. On restructuring, asset transfers, mergers, we may disclose data to counterparties/advisors under compliance with this notice and law.

7.4. Recipients must protect and only process as necessary to prevent unauthorized use/disclosure.

8. International Transfers

8.1. We may transfer data to SCG or other parties outside Vietnam when necessary.

8.2. Data may be stored on overseas servers/clouds; providers must implement appropriate security.

8.3. We comply with applicable laws and ensure you can exercise your rights; recipients must protect data and process only as necessary.

9. Security Measures

9.1. We use technical and administrative safeguards—encryption, access controls, training—to protect data.

9.2. Implement physical, technical, management controls and review them regularly.

9.3. Additional safeguards apply for sensitive personal data.

10. Your Rights & Obligations

10.1. You have rights to:

1. Be informed of processing;
2. Give & withdraw consent;
3. Access & correct your data;
4. Object to marketing;
5. Request deletion/anonymization;
6. Request restriction of processing;
7. Request portability;
8. File complaints or legal claims for damages.

10.2. We will respond within a reasonable timeframe under law.

10.3. To exercise rights, contact compliance@lsp.com.

10.4. You must provide accurate data when consenting.

11. Data Controller & DPO

11.1. Data Controller: Long Son Petrochemicals Co.,Ltd.

11.2. Address: Hamlet 2, Long Son commune, Vung Tau city, Ba Ria – Vung Tau province.

11.3. Contact: compliance@lsp.com.

If this notice is amended, we will publish the new version on our website or other channels, effective immediately upon posting.