Personal Data Processing Notice

Personal Data Processing Notice

Version no: 01

BIDV SuMi TRUST Leasing Company Limited (hereinafter collectively referred to as “we” or “BSL”) respect every individual’s privacy and comply with all applicable laws of Vietnam on personal data protection , including Decree 13/2023/ND-CP dated 17 April 2023 on personal data protection of the Government. This Notice sets out how we, as data controller and/or processor, will process personal data.

This Notice is intended to be addressed to You, i.e. (i) any organization/enterprise or individual who is and/or has had a contractual relationship with BSL (“Customer”), or (ii) related parties of the Customer, including organizations/
individuals who are guarantors and obligors; shareholder; Chairman of the Board of Management/Board of Members, member of the Board of Management/Board of Members, Chief Executive Officer, Deputy Chief Executive Officer or member of the Board of Executives; beneficial owner; officers, employees (legal representative/
authorized person/person with transaction authority and/or contact person), or other personnel; Customer’s partners, agents, consultants, contractors or (iii) Data Subject whose Personal Data is processed by BSL (as defined below).

1.  General Provision

1.1. “Personal Data” means any information in the forms of symbols, writing, digits, imagines, sounds or similar forms on an electronic environment associated with a specific person or  used to identify an individual. Personal Data includes General Personal Data and Sensitive Personal Data.

a. General Personal Data includes:

(1) Last name, middle name and first name, other names (if any);
(2) Date of birth; date of death or going missing;
(3) Gender;
(4) Place of birth, registered place of birth; place of permanent residence; place of temporary residence; current place of residence; hometown; contact address;
(5) Nationality;
(6) Personal image; information obtained from security systems, including recordings of Personal Data Subjects’ images on camera systems, surveillance cameras at BSL’s business locations;
(7) Phone number; ID Card number, personal identification number, passport number, driver’s license number, license plate, taxpayer identification number, social security number and health insurance card number;
(8) Occupation, place of work;
(9) Marital status;
(10)Information about the individual’s family relationship (parents, children);
(11) Digital account information; personal data that reflects activities and activity history in cyberspace;
(12)Other information associated with an individual or used to identify an individual.

b. Sensitive Personal Data includes:

(1) Political and religious opinions;
(2) Health condition and personal information stated in health record, excluding information on blood group;
(3) Information about racial or ethnic origin;
(4) Information about genetic data related to an individual’s inherited or acquired genetic characteristics;
(5) Information about an individual’s own biometric or biological characteristics;
(6) Information about an individual’s sex life or sexual orientation;
(7) Data on crimes and criminal activities collected and stored by law enforcement agencies;
(8)  Information on customers of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including: Data Subject’s identification as prescribed by law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service providers;
(9) Personal location identified via location services;
(10) Other information related to the operation, provision and evaluation of BSL’s activities, products and services in accordance with the provisions of law.

1.2. “Personal Data Subject” or “Data Subject” refers to an individual to whom the data relates.

1.3. “Personal Data Processing” refers to one or multiple activities that impact on personal data, including collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, traceability, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction or other relevant activities.

1.4. By registering to use and using BSL’s products and services through entering into a contract and/or allowing BSL to the Personal Data Processing, You (i) accept it in its entirety and without any conditions for the policies mentioned in this Notice and any changes (if any) from time to time, (ii) and:

a. BSL collects Personal Data from You for the Purposes set out in Section 2.1 below, either directly or indirectly, until mutually agreed or unless otherwise provided by law, the processing of Personal Data may be performed by the Company by one or multiple activities that impact on Personal Data such as collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, traceability, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction of Personal Data, outbound transfer of Personal Data and/or other activities prescribed by applicable law from time to time; and
b. undertakes not to claim, file a petition or take any similar action against BSL arising out of or in connection with the Data Processing for the Purposes mentioned in this Notice.

1.5. When You provide Personal Data of another individual who is a third party or related party (including but not limited to the legal representative of the enterprise, beneficiary, authorized person, partner, dependents, legally related persons, spouses, children and/or parents and/or guardians, friends, emergency contacts or other individuals) of You to BSL, You undertake, warrant and take resposibility that You have provided complete information and obtained the legal consent/
approval of such Data Subject to permit BSL to process such Personal Data for the Purposes set forth in this Notice. You understand, agree and accept that BSL is not responsible for assessing the legality or validity of this consent/approval and that it is the responsibility of You to maintain consent/approval, not the BSL. BSL is disclaimed and reserves the right to claim for damages and expenses related when the above commitment is not guaranteed from You.

2.  Personal Data Processing

We may collect certain Personal Data during normal business operations and to comply with applicable regulations through any means of communication, application, cyberspace, device, electronic media or any other form. We may also collect and receive this information orally, in writing or electronically directly from You or directly or indirectly through transactions with or performed by You or through our testing and verification processes, such as due diligence, know-your-customer (“KYC”) processes, or from any other public or third-party source, such as social media sites, public internet sites, newspapers , online publications, information service providers, embargo lists, warning lists, blacklists and databases of politically exposed person(s) (“PEP(s)”) and any other source for KYC and anti-money laundering/ counter-terrorism financing (“AML/CTF”) purposes, and prevention of the weapon of mass destruction (“MDW”).

2.1. Purpose

a. Evaluate and provide BSL products and services to You

(1) Identify, verify and maintain accurate KYC information; seek, verify and conduct anti-money laundering, credit and other checks with You as required;
(2) Evaluate, identify, assess and approve the provision of products and services according to Your registration documents and proposals;
(3) Assess, build and evaluate the level of reliability of You in using our products and services;
(4) Consider offering or continuing to provide any BSL products or services to You.

b. Fulfill the obligations in contracts, agreements, terms, conditions and other documents between BSL and You and customers care

(5) Perform contractual obligations, agreements and provide products and services to You;
(6) Customer care, handling Your complaints and lawsuits;
(7) Contact you, conduct marketing directly and indirectly products and services with you, conduct promotions, exchange gifts, award prizes, deliver gifts.

c. Understand your needs for products and services and improve the quality of BSL’s products and services

(8) Gain a better understanding of your investment needs, current and future financial situation;
(9) Improve, enhance, individualize and personalize BSL’s products and services including BSL’s online service and develop new products and services;
(10) Conduct market research, surveys and data analysis related to any BSL products or services provided to You;
(11) Monitor, ensure safe transactions, timely support You in emergency situations;
(12) Perform other activities related to the provision, operation and management of BSL of Your products and services and/or to develop, enhance and enhance the offering of products and services of BSL to You in general; and other purposes that BSL deems appropriate from time to time.

d. Business operations and internal risk management of BSL

(13) To ensure BSL’s legitimate business purposes in case BSL deems necessary, including but not limited to the exchange of information with our partners, service providers;
(14) To enter data, to check the completeness and accuracy of the data You provide to BSL and/or the information BSL enters into the system;
(15) To comply with agreements and contracts between BSL and other third parties;
(16) To fulfill reporting, financial, accounting and tax obligations;
(17) To perform audit, risk management and compliance purposes activities;
(18) To serve the requirements of the internal operations of BSL or its member units (including for the purposes of credit and risk management, system/network planning and development, audit and administration);
(19) To carry out transactions such as transferring, disposing, merging or buying, selling and transferring BSL’s assets;
(20) To provide agencies and organizations providing credit assessment services, credit information, credit scoring.

e. Comply with the provisions of law and international treaties to which Vietnam is a signatory

(21) To fulfill its obligations under the law, international treaties to which BSL must comply;
(22) To provide to competent state agencies as prescribed by law;
(23) To generate data, reports and statistics on the basis of requests of the State Bank of Vietnam or competent authorities as prescribed by law;
(24) To provide and exchange information between BSL and credit institutions, credit information organizations in accordance with the law.

f. Crime prevention

(25) For risk assessment, trend analysis, statistics, planning, including statistical data processing, credit and anti-money laundering, to create and maintain credit scoring systems , evaluate and maintain data about Your credit history;
(26) To detect, prevent and investigate crimes, attacks or violations including fraud, money laundering, terrorism, financing of weapons of mass destruction, bribery, corruption or tax evasion.

g. Ensuring the interests of BSL and social community

(27) To protect or enforce BSL’s legitimate rights and interests, including the right to collect fees, recover and settle debts owed to BSL by the Customer/Personal Data Subject;
(28) To fulfill responsibilities to the community and society.

h. Other purposes as prescribed by law

(29) In case the Personal Data is processed for purposes other than those mentioned above and not yet provided for by law, BSL will only do upon agreement with You or upon obtaining Your consent.

2.2. Method of Personal Data Processing

a. Depending on the purpose of Personal Data Processing, BSL or a third party authorized to process data for BSL may apply appropriate processing methods including but not limited to automatic, manual or other methods in accordance with the provisions of law and BSL from time to time.
b. If the party to whom the Personal Data is disclosed is located overseas, the Personal Data may be sent to another country including countries with more restrictive Personal Data protection legislation than Vietnam. When providing/transferring Personal Data overseas (including but not limited to using cyberspace, equipment, electronic means or other means to transfer Personal Data out of the territory of Vietnam), BSL will require the third party receiving to ensure the safety and security of the Personal Data provided/transferred. BSL is committed to fully complying with regulations and compliance requirements of Vietnamese law to protect the safety of Personal Data.

2.3. Parties related to the Purpose
We may disclose Personal Data to the necessary and lawful extent for the purposes of disclosure, to the respective recipients on a case-by-case basis, including, but not limited to, the following:

a. Stakeholders of BSL

(1) Parent Banks (including the Joint Stock Commercial Bank for Investment and Development of Vietnam, Sumitomo Mitsui Trust Bank and our other capital contributors – hereinafter collectively referred to as the “Mother Bank”); or subsidiaries/affiliated companies/agents/partners of the Parent Bank;

b. Competent authorities

(2) Authorities having competence to request for providing information such as tax authorities, commercial arbitration, courts, procuracies, security or investigative agencies, judgment enforcement, or any other authority required by law to enforce liability from BSL;
(3) Any person, authority or regulatory body or third party to whom BSL is authorized or required to disclose pursuant to any country’s regulation or under any other contract or commitment between BSL and third parties.

c. Third parties assist in verifying Personal Data Subject information

(4) Units with the function of providing credit information and credit assessment services; credit scoring units; credit rating agencies; insurance company; insurance brokerage company; and other credit service providers;
(5) Vietnam National Credit Information Center (CIC), a licensed credit information institution, or any agency or organization established by the State Bank of Vietnam or any other any other authority over the BSL.
(6) The provider of credit checking, AML/CTF, KYC, PEP, fraud prevention and other crime detection services to which BSL is obligated to comply.

d. Service providers for BSL and service providers with BSL

(7) Any contractor, service provider, consultant or other party cooperating with BSL (including its leaders, managers, employees); organizations/individuals who are sellers, suppliers, partners, agents including but not limited to companies providing support services for BSL’s business activities such as: organizations that provide administrative services, correspondence, telemarketing, direct sales, call centers, business processes, travel, visas, knowledge management, human resource management, data processing, information technology, computing, payments, debt collection, credit reference and other background checks, market research, data modeling, redemption, record storage and management, data entry, prescreening and verification, legal, website or social media, telecommunications, texting or emailing, networking, telephoning, infrastructure and technology support, workforce management, risk reporting, credit decisions, information security, maintenance of software and licenses, data centers, conversations and conferences, consulting services, payment intermediary services, switching and/or other services related to, or to support support, for the operation of BSL’s business;
(8) Business partners, related partners that cooperate with BSL to develop, provide or are involved in the development and provision of products and services of BSL.

e. Authorized Third Party by Personal Data Subject

(9) Any person acting on behalf of the Personal Data Subject (payee, beneficiary, designee in connection with the account, intermediaries, confirming banks, correspondent banks, etc.);
(10) Any person notified, authorized by the Personal Data Subject to be authorized to provide transaction information on behalf of the Personal Data Subject.

f. Financial institutions, intermediaries

(11) Any credit institution, foreign bank branch and agent, financial institution, trader, intermediary in connection with any product or service provided by BSL to You.

g. Other third parties

(12) Other stakeholders that BSL deems necessary to meet and protect the legitimate rights and interests of the Personal Data Subject;
(13) Personal Data Subject’s, Your or BSL’s advisors including accountants, auditors, attorneys, financial advisors;
(14) Parties to the transaction of buying or selling debt and assets of BSL;
(15) Any person or entity intending to pay any outstanding amount under any of Your contract(s)/transaction(s) with BSL;
(16) Other Personal Data Processing parties carried out upon Your consent.

2.4. Duration for Personal Data Processing

a. BSL may begin processing Personal Data pursuant to this Notice as soon as we receive the Personal Data from You and will retain it for as long as is necessary to fulfill the purposes for which the Data was collected, subject to the respective legal regulations. The reasonable period for retention of Personal Data includes:
(1) The period required by law on the protection of Personal Data;
(2) Other longer periods of time as we deem necessary. For example: To serve the settlement of complaints, lawsuits, investigations according to internal procedures or as prescribed by law.
b. After the retention period, BSL may destroy, delete or take any appropriate action in relation to Personal Data in any reasonable, practicable and appropriate manner that we understand to be permitted by law. We will not be obligated to return or destroy Personal Data if it is unreasonable or impossible.

2.5. Storage of Personal Data
Personal Data will be stored by BSL and take appropriate measures for security. To the extent permitted by law, BSL may store Personal Data in Vietnam or abroad, including cloud storage solutions. The storage of Personal Data is carried out for the period necessary to fulfill the purposes of this Notice, contracts, agreements and other documents entered into with You.

2.6. Consequences, unexpected damage that may occur
The processing of Personal Data always carries a risk of data leakage or inappropriate data processing. BSL is aware of the importance and responsibility of protecting Personal Data. We are committed to applying appropriate protection measures in accordance with applicable laws and regularly reviewing and updating the most optimal technical measures to ensure the safety of processing Personal Data, make the best effort to prevent risks and limit the consequences and possible damage, protect the legitimate rights and interests of the Personal Data Subject and of BSL.

3.  Rights and obligations of Data Subject

3.1. Data Subject’s rights

a. BSL respects and endeavors to protect the following rights of the Personal Data Subject:

(1) The right to know;
(2) The right to consent;
(3) The right of access (including viewing, rectifying or requesting rectification of Personal Data);
(4) The Right to withdraw consent;
(5) The right to delete data;
(6) The right to obtain restriction on processing;
(7) The right to provide data;
(8) The right to object to processing
(9) The right to file complaints, denunciations and lawsuits;
(10) The right to claim damage;
(11) The right to self-protection.
BSL will process Your requests in accordance with the law and consider Your legitimate interests. However, in case You withdraw your consent, request for data deletion and/or exercise other relevant rights above in respect of any or all Personal Data, the ability of BSL to provide/maintain our products and services to You may be effected. Then, depending on the nature of your request, BSL may consider and decide not to continue providing BSL’s products and services to You. Actions taken by You under this provision shall be deemed to be a unilateral termination on Your part of any relationship between You and BSL, and may completely lead to a breach of Your obligations or contractual commitments between You and BSL. Accordingly, BSL will not be liable to You for any loss incurred. At the same time, BSL reserves the rights and legal remedies of BSL in such cases.

b. With reasonable efforts, BSL will fulfill a lawful and valid request from You within the time required by law.
c. For security purposes, You may need to make your request in writing or use another method to prove and verify the identity of the Personal Data Subject. BSL may ask You to verify your identity before processing Your request.
d. For clarification, BSL reserves the right to refuse to comply with Your requests in certain circumstances, including but not limited to: (i) You do not follow the correct order and procedures instructed by BSL; (ii) You do not provide or provide insufficiently any papers and documents to verify your identity; or (iii) in the event that BSL assesses there are signs of fraud, violation of Personal Data protection; or (iv) The law does not permit the fulfillment of Your request.

3.2. Obligations of the Personal Data Subject
The Personal Data Subject has the following obligations:
(1) Protect Your own Personal Data; request other relevant organizations and individuals to protect Your Personal Data;
(2) Respect and protect others’ Personal Data;
(3) Provide complete and accurate Personal Data when agreeing to allow the processing of Personal Data;
(4) Participate in dissemination of Personal Data protection skills;
(5) Comply with the provisions of the law on the protection of Personal Data and participate in the prevention and combat of violations of regulations on the protection of Personal Data;
(6) Immediately notify BSL if discovering or suspecting that your Personal Data has been exposed, which may lead to risks in the process of using the service, or any violation of the protection of Personal Data under this Notice that is recognizable to You;
(7) Regularly check the official website of BSL to update and follow any changes (if any) related to the Personal Data protection policy in this Notice;
(8) Other obligations as prescribed by law.

4.  Notice of Personal Data Processing and Change of Notice

4.1. You acknowledge that, by accepting this Notice, You have been notified by BSL, have known and agreed to all of the contents that need to be notified before BSL processes the Personal Data. You agree that BSL does not need to give any notice before processing Personal Data.

4.2. This Notice is an integral part and should be read and construed in accordance with the contracts, agreements, terms, conditions and other documents entered into between You and BSL.

4.3. This Notice may be updated from time to time and the update will be posted on the website at or sent to You. You are advised to regularly visit this website to check for any amendments.

5.  Contact Information

If you have any questions, requests or concerns regarding this Notice or our data handling practices, please contact BSL Head Office or the nearest BSL Branch with the following information:

  • Head Office

    23rd Floor, TNR Tower Building, 54A Nguyen Chi Thanh, Lang Thuong Ward, Dong Da District, Hanoi

    (024) 39743838
  • BIDV – SuMi TRUST Leasing Company Limited – Hanoi Branch

    23rd Floor, TNR Tower Building, 54A Nguyen Chi Thanh, Lang Thuong Ward, Dong Da District, Hanoi

    (024) 39743838
  • BIDV – SuMi TRUST Leasing Company Limited – Da Nang Branch

    5th Floor, 271 Nguyen Van Linh, Vinh Trung Ward, Thanh Khe District, Da Nang City

    (0236) 384 9759
  • BIDV – SuMi TRUST Leasing Company Limited – Ho Chi Minh City Branch

    472-472A-472C Nguyen Thi Minh Khai, Ward 02, District 3, Ho Chi Minh City

    (028) 3835 6666