PRIVACY POLICY

Introduction

1. Nirvana Memorial Park Company Limited (Enterprise Registration Certificate No. 3702307083) and its group of companies (“Group”) are committed to protecting and respecting the privacy of individuals with regard to Personal Data (as defined herein below) to ensure compliance with the legal and regulatory requirements in accordance with the relevant data privacy laws and Decree on Personal Data Protection No. 13/2023/ND-CP dated 17.4.2023 (“PDPD”) (collectively, “Privacy Laws”)
2. When using our services or logging in or browsing or accessing our website (“Website”) and/or during the course of your transaction and dealings with Group, you may be requested to furnish from time to time to Group, directly or through online forms and/or other electronic methods, your Personal Data.  
3. The following Personal Data Protection Notice is formulated to keep you informed about how we process the Personal Data we collect and receive during the course of providing the services or access to the Website to you. “Processing”, “process”, “processes” or “processed” in respect of personal data means one or more operations which are performed on personal data, such as: collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, retrieval, withdrawal, encryption, decryption, copy, sharing, transmission, provision, transfer, erasure, destruction of personal data or other relevant operations.
4. BY LOGGING IN OR USING OR BROWSING THIS WEBSITE, YOU ACKNOWLEDGE THAT YOU HAVE BEEN NOTIFIED OF AND UNDERSTOOD THE TERMS OF THIS PRIVACY POLICY AND THAT YOU HAVE AGREED AND CONSENTED TO THE COLLECTION, USE, DICLOSURE AND/OR PROCESSING OF YOUR PERSONAL DATA AS DESCRIBED UNDER OUR PERSONAL DATA PROTECTION NOTICE. IF YOU DO NOT AGREE WITH THESE TERMS, YOU MAY CHOOSE NOT TO USE THIS WEBSITE, AND PLEASE DO NOT PROVIDE ANY PERSONAL DATA THROUGH THIS WEBSITE.
5. We may update this Privacy Policy from time to time. Any changes we make to this Privacy Policy in the future will be posted on this page and whereupon your continued access to this Website including using any services offered by this Website, shall constitute your acknowledgment and acceptance of the changes we make to this Privacy Policy
6. Please note that this Privacy Policy complements, and does not limit or replace, the purposes for which you provide Group with your Personal Data which may be expressly stated in any form for submission of Personal Data to Group.

Personal Data Protection Notice

1. Objective

1.1.This Personal Data Protection Notice is issued by NIRVANA MEMORIAL PARK COMPANY LIMITED (“Company”) and its group of companies (“Group” or “we”, “our” or “us”) to all our valued customers/prospective customers (“you”, “your”, or “data subject”) pursuant to the Decree on Personal Data Protection No. 13/2023/ND-CP dated 17.4.2023 (“PDPD”) in accordance with the PDPD.

2. Definition

2.1. For the purpose of this Personal Data Protection Notice,

• “personal data” shall have the meaning as ascribed to it in the PDPD which means any information in the forms of symbols, letters, figures, images, sounds or similar forms in the electronic environment that is associated with a particular person or may lead to the identification of a particular person. Information for identification of a particular person means the information formed from an individual’s activities combined with other stored information and data leading to the identification of a particular person; and
• “processing”, “process”, “processes” or “processed” in respect of personal data means one or more operations which are performed on personal data, such as: collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, retrieval, withdrawal, encryption, decryption, copy, sharing, transmission, provision, transfer, erasure, destruction of personal data or other relevant operations.

3. Categories of Personal Data to be Processed

3.1. Personal data to be processed by us includes basic personal data and sensitive personal data, which will be depending on the nature of your dealings or transaction with us

3.2. Basic personal data to be processed by us includes:

1. Family name, middle name and first name as stated in a birth certificate, other name (if any);
2. Date of birth; date of death or missing;
3. Gender;
4. Place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence, native place, contact address;
5. Nationality;
6. Image of the individual;
7. Telephone numbers, people’s identity card number, personal identification number, passport number, driver’s license numbers, numbers in vehicles’ number plates, personal tax identification number, social insurance number, health insurance card number;
8. Marital status;
9. Information about family relationships (parents, children);
10. Information about digital account of the individual; personal data on activities, history of activities in cyberspace;
11. Other information associated with a particular person or leading to the identification of a particular person necessary for the purposes stated in Article 4 hereinbelow.

3.3. Sensitive personal data means any personal data associated with an individual’s privacy rights of which the violation directly affects his/her lawful rights and interests. Sensitive personal data to be processed by us includes:

1. Religious opinions;
2. Information relating to racial origin, ethnic origin;
3. Information about physical characteristics;
4. Client information of credit institutions, foreign bank branches, intermediary payment service providers, and other authorized organizations, including: client identification information prescribed by law provisions, information on accounts, deposits, deposited assets, transactions, organizations and individuals being securing parties at credit institutions, bank branches, intermediary payment service providers;
5. Location data of the individual identified through location services;
6. Other information necessary for the purposes stated in Article 4 hereinbelow.

4. Purposes of Personal Data Processing

4.1. We will process your personal data for the following purposes (“Purposes”):

1. To process your application or registration under any program and/or activities organized or conducted by us or in connection with any of our products and/or services when the deposit form, contract of sale, transfer form and/or other documents have been submitted;
2. The delivery of notices, letters and other printed materials in connection with the Company’s products and services, whether present or future, updates and promotions and/or information related to third parties which we think you may be interested, to you;
3. Sale of the products offered by us to you which shall include all matters relevant for the completion of the sale and purchase transactions, delivery of the Products and other post sale services;
4. Entering into any transactions, agreements or instruments in our ordinary course of business and for discharging our contractual obligations in the ordinary course of business;
5. Conducting marketing and client profiling activities in connection with our products and services including new products;
6. Our internal record keeping;
7. For payment and debt collection and recovery purposes;
8. To respond to your enquiries or complaints including processing instructions and generating confirmation, advice and statements;
9. To match data held by us relating to you from time to time;
10. To investigate complaints and suspicious transactions;
11. With your consent, for cross selling purposes for new products and funeral services packages launched by us;
12. Discharging our duties and obligations under the appropriate law, regulation, direction and guideline applicable to us;
13. In anticipation of, and in the course of an actual or potential sale, reorganization, consolidation, merger, or amalgamation of all or part of our business or operations; and/or
14. For all other purposes incidental or associated with the above.

4.2. If you have provided personal data of individuals other than yourself to us (for example, including but not limited to the intended user of product designated by you), you also confirm that you have sought the requisite consent from these individuals in accordance with the requirements of the laws to the collection, use, disclosure and transfer of their Personal Data. In particular, you confirm that you have informed these individuals of the purposes for collection, use, disclosure and transfer of their personal data as set out in this Personal Data Protection Notice.

5. Means of Processing Personal Data

5.1. Your personal data will be processed in the following means:

1. Physical/manual (non-electrical) processing such as processing using human effect, printed paper, documents, files, journals, books and other printed materials and other non-electronic means, including for filing and archiving purposes; and
2. Electronic processing such as processing using computers, hard-disk, software, internet networks and computer servers and systems and other electronic devices.

6. Organizations, Individuals Allowed to Process Personal Data

6.1. Your personal data may be disclosed to the following person or entities for processing for the Purposes stated in Article 4 hereinabove:

1. Any related companies and subsidiaries of the Company and/or any members of the Group including those to be established in the future;
2. Our authorized agents who provide related services or sell the Products on our behalf;
3. Our auditors, consultants, accountant, lawyers or other financial or professional advisers, including any relevant financial institutions;
4. Our designated contractors, sub-contractors, network operators or any third-party service or products providers/suppliers or management companies as may be necessary or appropriate;
5. Our business partners and affiliates;
6. Any other persons under a duty of confidentiality to us;
7. Any person to whom we are compelled or required to do so under law or in response to a competent or government agency;
8. Government agencies, statutory authorities and industry regulators; and/or
9. Any other entities that we may think fit and necessary for the Purposes stated in Article 4 hereinabove;

6.2. Whenever we deem necessary or appropriate, we may transfer your personal data to another member of our Group or authorized agents which operate in a number of countries. This may entail a transfer of your personal data from your home country to other jurisdiction(s) where the level of personal information protection may be different. We will take commercially reasonable steps to protect the personal data we hold from misuse and loss and from unauthorized access, modification or disclosure in accordance with the applicable privacy laws that may from time to time be in force.

7. Time for Starting and Completing the Processing of Personal Data

7.1. We shall start processing your personal data upon you giving your consent under this Personal Data Protection Notice in the manner hereinabove stated and after receiving your personal data.

7.2. Your personal data will be processed by us for as long as it is needed for the Purposes stated in Article 4 hereinabove or as required by laws, regulations and/or by-laws. If any personal data is no longer required for the purpose for which it was processed, we shall take all reasonable steps to ensure that it is destroyed, erased or permanently de-identified.

8. Unexpected Consequences and Damages Likely to Occur

8.1. To safeguard your personal data against any unexpected consequences and damages that likely to occur such as loss, misuse, unauthorized or accidental access or disclosure, alteration or destruction, we shall take all practical and appropriate measures, by having regard to:

1. the nature of the personal data and the harm that would arise;
2. the place or location where the personal data is stored;
3. any security measures incorporated into any equipment in which the personal data is stored;
4. the measures taken for ensuring the reliability, integrity and competence of personnel having access to the personal data; and
5. the measures taken for ensuring the secure transfer of the personal data.

8.2. We will notify the authority regarding any breach of personal data protection regulation in accordance with Article 23 of the PDPD upon discovering the same.

9. Security

9.1. We shall process and store your personal data in a secure manner (including appropriate management and technical measures) by adopting the commercially reasonable measures and procedures so that any unauthorized or unlawful processing of your Personal Data may be prevented.

10. Your Rights and Obligations

10.1 Pursuant to the PDPD, you have the following rights in respect of your personal data, unless otherwise provided by law:

1. Right to be informed: Right to be informed about activities relating to the processing of your personal data.
2. Right to consent: Right to agree or not agree to the processing of your personal data, unless cases specified in Article 17 of the PDPD.
3. Right of access: Right to access your personal data for viewing, rectifying or requesting rectification of such data.
4. Right to withdrawal of consent: Right to withdraw your consent relating to the processing of your personal data.
5. Right to erasure: Right to erase or request the erasure of your personal data.
6. Right to restriction of data processing: Right to request the restriction of processing of your personal data.
7. Right to provision of data: Right to request us to provide your own personal data for yourself.
8. Right to object: Right to object to processing of your Personal Data for the purposes of preventing or limiting the disclosure of personal data or its use for advertising or marketing.
9. Right to complaint, denunciation and initiation of lawsuits: Right to complaint, denunciation and initiation of lawsuits in accordance with the law.
10. Right to request for compensation for damage: Right to request compensation for damage in accordance with the law upon breaches of protection of your personal data, unless otherwise agreed upon by the parties or provided by law.
11. Right to self-defense: Right to protect by yourself in accordance with the Civil Code of Vietnam 2015 (Law No. 91/2015/QH13) (“Civil Code”), other relevant laws and the PDPD, or request competent agencies or organizations to implement methods of protection of civil rights prescribed in Article 11 of the Civil Code.

10.2. Pursuant to the PDPD, you have the following obligations:

1. Protect your personal data by yourself; request other relevant organizations and individuals to protect your personal data;
2. Respect and protect others’ personal data;
3. Provide complete and accurate personal data upon consent to the personal data processing;
4. Participate in propaganda and dissemination of personal data protection skills; and
5. Comply with the law on personal data protection and participate in the prevention and fighting of breaches of personal data protection regulation.

10.3. You may send your request when exercising your rights under the PDPD (including request for provision of personal data, request for erasure of personal data, request for rectification of personal data and withdrawal of consent, etc.) or inquiries by post or electronic mail to the following address:

11. Processing of Personal Data without Consents

11.1. Notwithstanding anything contained herein, we shall be allowed to process your personal data without consent pursuant to Article 17 of PDPD, when the processing of your personal data is necessary to inter alia: (i) protect the life and health of yours or others in urgent case; (ii) comply with law; and/or (iii) fulfill your contractual obligations with us.

12. Language

12.1. This Personal Data Protection Notice is issued in English and Vietnamese versions. In the event of conflicts in the interpretation of the Personal Data Protection Notice hereof, English version shall prevail over the Vietnamese version