Privacy Policy

(Issued together with the internal regulations of SGLINK Import Export JSC)

PREAMBLE

SGLINK Import Export JSC (operating under the brand "ShipX", hereinafter referred to as "ShipX" or "We") is committed to respecting and protecting the privacy and personal data of our Customers throughout the provision of our logistics and international shipping services.

This Privacy Policy (the "Policy") is built on the basis of compliance with:

• Decree No. 13/2023/ND-CP dated 17 April 2023 of the Government on personal data protection;
• Law on Cybersecurity No. 24/2018/QH14;
• Law on Electronic Transactions No. 51/2005/QH11 (as amended and supplemented in 2023);
• Decree No. 72/2013/ND-CP and guiding documents on the management, provision, and use of Internet services;
• Other relevant prevailing laws of Vietnam.

By using ShipX's website, application, or services, You confirm that You have read, understood, and agreed to the entire content of this Policy.

ARTICLE 1. DEFINITIONS

1.1. "Personal Data"

Means information in the form of symbols, letters, numbers, images, sounds, or similar forms in the electronic environment that is associated with a specific person or that helps to identify a specific person, including basic personal data and sensitive personal data as defined in Article 2 of Decree 13/2023.

1.2. "Data Subject"

Means the individual to whom the personal data relates.

1.3. "Processing of Personal Data"

Means one or more activities affecting personal data, including: collection, recording, analysis, confirmation, storage, modification, disclosure, combination, access, retrieval, recovery, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, and destruction of personal data, or other related actions.

1.4. "Consent"

Means the clear, voluntary, and affirmative expression by the Data Subject permitting the processing of his/her personal data, in accordance with Article 11 of Decree 13/2023.

1.5. "Data Controller"

Means ShipX — the organization that determines the purposes and means of processing personal data.

1.6. "Data Processor"

Means an organization or individual that processes data on behalf of the Data Controller under a contract.

1.7. "Third Party"

Means any organization or individual other than the Data Subject and ShipX.

ARTICLE 2. SCOPE OF PERSONAL DATA COLLECTED

2.1. Basic Personal Data (Article 2, Clause 3 of Decree 13/2023)

• Surname, middle name, and birth name; aliases (if any);
• Date of birth; gender;
• Place of birth, place of permanent residence, place of temporary residence, contact address, nationality;
• Phone number, ID card number / Citizen ID number / personal identification number, passport, driver's license, personal tax identification number;
• Email address, digital accounts;
• Bank information, credit card information, electronic payment information;
• Other information associated with or that helps to identify a specific individual.

2.2. Sensitive Personal Data (Article 2, Clause 4 of Decree 13/2023)

In certain mandatory cases required by law, or to provide services at Your request, ShipX may collect:

• Biometric information (when required to verify the identity of recipients of high-value shipments);
• Detailed financial information when processing payments, refunds, and debt reconciliation.

⚠ Note: The processing of Sensitive Personal Data is carried out only with Your explicit consent or as provided by law (Article 9, Clause 2 of Decree 13/2023).

2.3. Technical Information and Usage Behavior

• IP address, browser type, operating system, device parameters;
• Website/application access history, cookies, session ID, access time;
• Location data (GPS) when You grant permission while using the ShipX application to track orders.

ARTICLE 3. PURPOSES OF PROCESSING PERSONAL DATA

ShipX processes Your Personal Data for the following purposes (the "Purposes"):

• Performing contracts and providing domestic and international logistics and freight transportation services, including: first-mile pickup, warehouse handling, customs clearance, long-haul transportation, last-mile delivery, and value-added services;
• Processing account registration, managing accounts, and providing services at Your request on the shipx.asia website;
• Processing payments, issuing VAT invoices, refunds, debt reconciliation, and accounting and financial operations;
• Fulfilling legal obligations: customs declaration, taxes, anti-money laundering, international sanctions screening, and reporting to competent authorities;
• Customer care: support, answering inquiries, handling complaints, and tracing orders via hotline 1900 633027 and email info@shipx.asia;
• Managing loyalty programs, promotional policies, and reward point accumulation;
• Researching, analyzing, and improving service quality; developing new products and services;
• Direct marketing activities — sending newsletters, promotions, and event invitations — only where You have consented, and You may withdraw your consent at any time;
• Ensuring cybersecurity, detecting and preventing fraud, and protecting the legitimate rights and interests of ShipX, customers, and related parties;
• Using cookies and similar technologies to improve user experience, analyze traffic, and measure marketing effectiveness.

ARTICLE 4. LEGAL BASIS FOR DATA PROCESSING

ShipX processes Your Personal Data based on one or more of the following bases, in accordance with Article 17 of Decree 13/2023:

• Your consent (Article 11 of Decree 13/2023);
• Performance of a contract to which You are a party, or pre-contractual steps taken at Your request;
• Compliance with ShipX's legal obligations (Article 17, Clause 1, Point c of Decree 13/2023);
• Protecting the life and health of You or others in emergency situations;
• Serving the operations of state agencies in accordance with specialized laws;
• Serving public interests, scientific research, and statistics without harming the legitimate rights and interests of the Data Subject.

ARTICLE 5. DATA RETENTION PERIOD

5.1.

ShipX stores Personal Data for the period necessary to fulfill the Purposes set out in Article 3, specifically:

5.2.

Upon expiry of the retention period, ShipX will delete or anonymize Your Personal Data in accordance with Article 16 of Decree 13/2023.

ARTICLE 6. SHARING AND DISCLOSURE OF DATA

Your Personal Data may be shared, disclosed, or transferred to the following third parties in order to fulfill the Purposes set out in Article 3:

• Transportation and logistics partners: airlines, shipping lines, last-mile providers, and freight-forwarding agents at domestic and international destinations;
• Customs authorities and competent state agencies in Vietnam and destination countries;
• Banks, payment institutions, and electronic payment gateways serving financial transaction processing;
• Parent company, strategic shareholders, and member companies within the group, for administration and cross-border service provision;
• Technology service providers: cloud computing infrastructure, CRM software, transportation management systems (TMS), marketing automation, and data analytics;
• Professional advisors: legal counsel, auditors, tax advisors, financial advisors, and insurance advisors;
• Market research, event, and advertising partners: only after data has been anonymized, or with Your explicit consent;
• Competent state agencies upon written request in accordance with the law.

⚠ ShipX's commitment: All third parties are required to sign confidentiality agreements and process Personal Data only within the scope of the stated Purposes. ShipX does NOT sell Your Personal Data to any third party.

ARTICLE 7. TRANSFER OF PERSONAL DATA ABROAD

Due to the nature of international shipping services, Your Personal Data may be transferred to other countries depending on the shipment's route and Your requirements.

ShipX's compliance commitments under Articles 25 and 27 of Decree 13/2023:

• Preparing a Personal Data Processing Impact Assessment dossier and a Cross-Border Data Transfer dossier as required;
• Submitting the dossier to the Department of Cybersecurity and High-Tech Crime Prevention (A05 — Ministry of Public Security) within 60 days from the date of data processing;
• Applying Standard Contractual Clauses (SCCs) with foreign partners to ensure an equivalent level of protection;
• Periodically monitoring the compliance of the data recipient abroad.

ARTICLE 8. RIGHTS OF THE DATA SUBJECT

Pursuant to Chapter II of Decree 13/2023, You have the following full rights with respect to Your Personal Data:

Exercising your rights:

To exercise the above rights, please contact ShipX through the contact channels in Article 14. ShipX will respond within 72 hours and complete the processing of the request within a maximum of 15 working days, except where there is a legitimate reason requiring an extension, in which case You will be notified in writing.

ARTICLE 9. DATA SECURITY AND SAFETY

9.1. Technical and Management Measures

ShipX applies the following measures to protect Your Personal Data:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
• Access control based on the principle of least privilege;
• Two-factor authentication (2FA) for personnel accessing systems containing Personal Data;
• 24/7 cybersecurity monitoring, with periodic backup and recovery;
• Regular employee training on information security and personal data protection;
• Signing non-disclosure agreements (NDAs) with all employees, contractors, and partners;
• Periodic information security assessment and auditing in accordance with the ISO/IEC 27001 standard.

9.2. Breach Notification (Article 23 of Decree 13/2023)

In the event of an incident involving Personal Data, ShipX will:

• Notify Department A05 — Ministry of Public Security within 72 hours from the time of detection;
• Notify affected Data Subjects as soon as possible;
• Cooperate with the authorities to investigate and resolve the incident.

ARTICLE 10. COOKIES AND TRACKING TECHNOLOGIES

The shipx.asia website and ShipX's applications use cookies and similar technologies to:

• Maintain login sessions and account security;
• Remember user preferences (language, time zone, currency);
• Analyze traffic and marketing campaign effectiveness;
• Personalize relevant content and advertising.

You can disable or manage cookies through your browser settings. However, some website features may be affected when cookies are disabled.

ARTICLE 11. PERSONAL DATA OF CHILDREN

ShipX does not actively collect the Personal Data of children under 16 years of age. Where it is necessary to process a child's data (for example, where the recipient is a child authorized by a parent), ShipX will act in accordance with Article 20 of Decree 13/2023:

• Obtain the consent of the parent or legal guardian;
• Apply protective measures consistent with the best interests of the child;
• Minimize, to the greatest extent possible, the scope and purposes of processing data relating to children.

ARTICLE 12. DATA PROTECTION OFFICER (DPO)

Pursuant to Article 28 of Decree 13/2023, ShipX designates a Personal Data Protection unit (Data Protection Officer — DPO) responsible for:

• Monitoring compliance with personal data protection regulations;
• Receiving and handling requests from Data Subjects;
• Coordinating with the state management agency on personal data protection;
• Conducting periodic personal data protection impact assessments in accordance with Article 24 of Decree 13/2023.

ARTICLE 13. CHANGES TO THE POLICY

ShipX reserves the right to amend and supplement this Policy at any time to align with changes in law, business operations, or technology. The updated version will be published on the shipx.asia website together with its effective date. For material changes, ShipX will notify You at least 30 days in advance, via email or a prominent notice on the website, before they take effect.

ARTICLE 14. CONTACT INFORMATION

For any inquiries, requests, or complaints relating to this Policy and the processing of Personal Data, please contact:

ARTICLE 15. GENERAL PROVISIONS

15.1. Language

This Policy is made in Vietnamese. In the event of any translation into another language, the Vietnamese version shall prevail and have priority legal validity.

15.2. Governing Law

This Policy is governed by the laws of Vietnam. Any disputes arising shall be resolved through good-faith negotiation and mediation; failing that, they shall be settled at the competent Court in Ho Chi Minh City, Vietnam.

15.3. Severability

If any provision of this Policy is deemed invalid or unenforceable by a competent authority, the remaining provisions shall continue in full force and legal effect.

15.4. No Waiver

ShipX's failure or delay in exercising any of its rights under this Policy shall not be construed as a waiver of such right.

15.5. Registration and Filing

ShipX commits to fully performing its obligations to register and submit personal data processing impact assessment dossiers to the competent state authorities within the deadlines prescribed in Decree 13/2023.

Date of issuance: 30 April 2026 | Version: 2.1 | Effective from: 1 May 2026

This Policy supersedes all previous versions of ShipX's Privacy Policy.