Personal Information Privacy Policy

1Office publishes this Personal Information Privacy Policy (the “Policy”) to explain clearly to individuals who are data subjects how 1Office collects, uses, shares and protects personal data, as well as the rights of data subjects under the law. This Policy is public and applies generally, requires no signature, takes effect from the date of publication and may be updated under Article 14 below.

1. Introduction and scope

This Policy applies to every individual whose personal data 1Office collects or processes, including: visitors to 1Office's website and product information pages; individuals registering for a trial and contact representatives of business customers; and Users granted access to the 1Office software Platform by a business customer (the “Customer”) for work purposes.

This Policy does not replace the separate agreements between 1Office and the Customer, including the Master Agreement, the Terms of Service (ToS) and the Personal Data Processing Agreement (DPA) — those documents govern the relationship between 1Office and the Customer as data processor and data controller respectively for data the Customer enters into the Platform.

2. 1Office's role in relation to personal data

Depending on the type of data, 1Office acts in one of the following two roles:

• Data controller: For personal data 1Office collects directly for its own business activities (for example: website visitor information, trial registrants, Customer contact representatives, job applicants, partners). For such data 1Office determines the purposes and means of processing itself and is the direct point of responsibility towards the data subject.
• Data processor: For Customer Data that the Customer or a User enters into the Platform while using the Service (for example: HR records, attendance data, payroll of the Customer's employees). For such data the Customer (as employer or as the party that originally collected the data) is the data controller, and 1Office processes it only on the Customer's instructions and under the DPA. If a data subject wishes to exercise their rights over this type of data, please contact the Customer directly (your employer or the organisation that collected your data); 1Office will support the Customer in handling that request under Article 5 of the DPA.

3. Personal data we collect

3.1. Data collected directly by 1Office (1Office as data controller)

• Contact information: full name, phone number, email, job title and company name of trial registrants, contact representatives, job applicants and partners;
• Account information: username, password (encrypted), login history;
• Technical data (system logs): IP address, device type, browser, operating system, access time and website/Platform usage behaviour, for the purposes of operation, information security, measurement and service improvement;
• Information exchanged through customer support channels: The content of tickets, chats and support emails.

3.2. Customer Data entered into the Platform (1Office as data processor)

This includes basic personal data and sensitive personal data (as defined in Article 1 of the DPA) that the Customer or a User enters into the Platform for business management purposes, for example: HR records, attendance data, payroll and performance reviews. Collecting such data and establishing the legal basis for processing it is the Customer's responsibility as data controller, under Article 2 of the DPA.

4. Purposes of processing personal data

1Office processes the personal data described in Article 3.1 for the following purposes:

• Providing, operating, maintaining and improving the Platform and the Service;
• Handling trial registrations, sales consulting, customer care and technical support;
• Administering accounts, authenticating logins and ensuring information security;
• Sending operational notices (system updates, policy changes, invoices) and, where the data subject consents, marketing information about new products and services;
• Complying with legal obligations and resolving complaints and disputes (if any).

5. Legal bases for processing

1Office processes personal data on one or more of the following legal bases, in accordance with the Personal Data Protection Law No. 91/2025/QH15:

• The data subject's consent;
• Performing a contract or preparing to enter into one at the data subject's request (for example: processing trial registration details in order to advise on the product);
• Complying with 1Office's legal obligations;
• The legitimate interests of 1Office or a third party, provided the data subject's rights and legitimate interests are not affected (for example: ensuring information security, preventing fraud).

6. Sharing personal data with third parties

1Office does not sell personal data to anyone. 1Office shares personal data only with:

• Infrastructure and technical service providers supporting operation of the Platform (hosting, cloud storage, digital signature, SMS, AI models/platforms), in line with the third-party list and the notification/objection procedure in Article 4 of the DPA;
• Competent state authorities, upon a lawful written request, under Article 8 of the DPA;
• 1Office's legal advisers and auditors, to the extent necessary and under corresponding confidentiality undertakings;
• A transferee in the event of corporate restructuring, sale or merger, provided the transferee continues to comply with this Policy.

7. Cross-border data transfers

Personal data is primarily stored in a Data Centre in Vietnam under Article 11.3 of the ToS. Where the use of certain third parties (for example AI model providers) results in personal data being transferred abroad, 1Office complies with the cross-border personal data transfer rules in the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP, including carrying out a cross-border transfer impact assessment where the law so requires.

8. Data retention periods

• Account data and technical data: retained for as long as the data subject continues to use the account, and for at most 06 (six) months after the Master Agreement between 1Office and the Customer terminates, under Article 7 of the DPA;
• Contact details of trial registrants/partners with no resulting transaction: retained for at most 24 (twenty-four) months from the most recent contact, unless the data subject requests earlier deletion or the law requires longer retention;
• After the retention period, data is deleted or anonymised in accordance with 1Office's internal procedures.

9. Data security measures

1Office applies technical and organisational security measures consistent with ISO/IEC 27001:2022, including: data encryption, need-to-know access control, 24/7 information security monitoring, periodic backups and an incident response procedure, under Article 12 of the ToS and Article 3 of the DPA.

10. Rights of data subjects

In accordance with the Personal Data Protection Law No. 91/2025/QH15, data subjects have the following rights over their personal data controlled by 1Office (the data described in Article 3.1 of this Policy):

• The right to be informed about the processing of their personal data;
• The right to consent or refuse consent to the processing of personal data;
• The right of access to view, correct or request correction of their personal data;
• The right to withdraw consent;
• The right to erasure of personal data;
• The right to restrict processing of personal data;
• The right to object to processing of personal data;
• The right to complain, denounce and bring legal action as provided by law;
• The right to claim compensation as provided by law where their personal data protection rights are breached, unless the parties agree otherwise or the law provides otherwise;
• The right of self-protection as provided by law, or to request competent authorities or organisations to apply civil rights protection measures.

1Office responds to such requests within the periods set out in Decree 356/2025/ND-CP: 02 (two) working days for requests to withdraw consent, restrict or object to processing; 10 (ten) days for requests to access, correct or provide data; 20 (twenty) days for requests to delete data, or another period as provided by law as amended from time to time.

11. How to exercise data subject rights

• For the data described in Article 3.1 (1Office as data controller): the data subject sends a request to support@1office.vn or another official 1Office channel, together with reasonable identity verification details;
• For the Customer Data described in Article 3.2 (the Customer as data controller): the data subject contacts the Customer directly (your employer or the organisation that collected your data); 1Office will support the Customer in handling the request within the scope and time limits set out in Article 5 of the DPA.

12. Children's personal data

The 1Office Platform is not directed at children and does not intentionally collect the personal data of children (persons under 16 under Vietnamese law). If 1Office discovers that it has collected a child's personal data without the lawful consent of a parent or guardian, it will delete that data as soon as possible.

13. Cookies and tracking technologies

The 1Office website and Platform may use cookies and similar technologies to remember login sessions, analyse traffic and improve the user experience. Data subjects can adjust or refuse non-essential cookies through their browser settings; however, refusing certain essential cookies may affect the ability to use the Platform.

14. Changes to this Policy

1Office may update this Policy from time to time to reflect changes in its data processing activities or in the law. The updated version is published on 1Office's official website with its effective date; for material changes, 1Office will give notice by email or on the Platform before it takes effect.

15. Contact information

1Office Joint Stock Company

Address: 5th Floor, Diamond Place Building, 25 Le Van Luong Street, Thanh Xuan Ward, Hanoi, Vietnam

Phone: 1900 3313

Email: support@1office.vn