PERSONAL DATA PROCESSING POLICY

of UNION PQ CO., LTD (trademark UNION MARINA)

website unionmarina.vn, Phu Quoc Island, Socialist Republic of Vietnam

This Personal Data Processing Policy (hereinafter referred to as the "Policy") defines the procedure for the collection, storage, use, transfer, and protection of personal data of users of the website https://unionmarina.vn (hereinafter referred to as the "Website") and guests booking services by CÔNG TY TNHH UNION PHÚ QUỐC (UNION PHU QUOC COMPANY LIMITED, abbreviated name — UNION PQ CO., LTD, trademark "UNION MARINA") (hereinafter referred to as the "Company", "Operator"). The applicable regulatory framework is specified in Section 3 of this Policy.
The use of the Website, its viewing, or sending a general inquiry by itself is not considered by the Operator as consent to the processing of personal data. Legally significant consent of the personal data subject is voluntary, specific, informed, and verifiable, and is provided separately, prior to the commencement of the corresponding processing, in accordance with the procedure established by Section 7 of this Policy. Processing necessary for the review of a booking request and performance of a contract, and processing for marketing purposes are drafted separately and are not mixed in a single consent.

1. Terms and Definitions
  • "Personal Data" — any information relating to a directly or indirectly identified or identifiable individual (personal data subject).
  • "Personal Data Processing" — any action (operation) or set of actions performed with personal data, including the collection, recording, organization, accumulation, storage, adaptation, use, transfer (dissemination, provision, access), anonymization, blocking, erasure, or destruction of personal data.
  • "Personal Data Subject" ("User", "Guest", "Customer") — an individual whose personal data is processed by the Company in connection with the use of the Website and/or booking and provision of services.
  • "Operator" — CÔNG TY TNHH UNION PHÚ QUỐC (UNION PQ CO., LTD), independently or jointly with third parties organizing and (or) carrying out the processing of personal data.
  • "Website" — the internet resource https://unionmarina.vn and its language versions, including booking and feedback forms.
  • "Sensitive Personal Data" — special categories of personal data (in particular, information on the status of health, including dietary restrictions and medical contraindications) requiring enhanced security measures in accordance with applicable legislation.
  • "Consent" — a free, specific, informed, and unambiguous expression of the personal data subject's will, confirming their permission to process personal data for the specified purpose.

2. Personal Data Operator
2.1. The processing of personal data for the purposes set forth in this Policy is carried out by: CÔNG TY TNHH UNION PHÚ QUỐC (UNION PHU QUOC COMPANY LIMITED, UNION PQ CO., LTD), enterprise registration number 1702345751, legal address: Căn nhà B6-905, Phú Quốc Waterfront, Khu phố Đường Bào, Đặc khu Phú Quốc, Tỉnh An Giang, Việt Nam; email: info@unionmarina.vn; phone: +84 977 01 85 01.
2.2. On issues related to the processing of personal data, the realization of the rights of the personal data subject, as well as for the revocation of consent to processing, one can contact the Operator using the contact details specified above.

3. Applicable Regulatory Framework
3.1. This Policy has been developed and shall be interpreted in accordance with the legislation of the Socialist Republic of Vietnam on personal data protection effective as of the publication date of the edition, including (in the applicable part and subject to subsequent amendments):
  • Law on Personal Data Protection No. 91/2025/QH15, effective from January 1, 2026;
  • Decree No. 356/2025/NĐ-CP, detailing the procedure for the protection of personal data, effective from January 1, 2026;
  • Decree No. 330/2026/NĐ-CP on administrative liability in the field of cybersecurity and personal data protection, effective from August 19, 2026.
  • 3.2. In the event of changes to the specified regulatory acts or the adoption of new applicable acts, the Company shall bring this Policy into compliance with the current legislation in the manner prescribed by Section 18 of this Policy. This Policy constitutes a public notification of the processing rules and does not replace the internal compliance procedures specified in Section 13.

4. Categories and Composition of Processed Personal Data
4.1. When booking services through forms on the Website, by phone, email, or in messengers (WhatsApp, Telegram, Zalo, KakaoTalk, etc.), the Operator processes the following personal data:
  • last name, first name;
  • contact phone number;
  • email address (if specified);
  • place of residence on Phu Quoc Island (district/hotel — for the purposes of organizing transfer, including cases of applying an additional transfer fee for the North Island district);
  • information about the selected program, date, number of guests;
  • payment data in the scope necessary to perform settlements (without storing full payment card details, the processing of which is carried out by the payment provider);
  • other data voluntarily provided by the personal data subject when contacting the Operator (including in reviews, requests, correspondence).
  • 4.2. When visiting the Website, technical data may also be collected automatically: IP address, type and version of browser, interface language, cookies and similar technologies, data on visited pages and actions on the Website, used for the purposes specified in Section 5 of this Policy.
  • 4.3. Certain information that the personal data subject may voluntarily communicate in connection with a booking (in particular, dietary restrictions, allergies, or other medical circumstances significant for safety on board) relates to sensitive personal data and is processed in a special regime established by Section 11 of this Policy.

5. Purposes of Personal Data Processing
  • receipt, processing, and confirmation of booking requests for programs (day trip on a catamaran, sunset cruise, private charter, individual rental of a Yamaha FC-27 boat, VIP fishing, etc.);
  • organization of service provision, including a transfer "hotel — pier — hotel", including calculation and collection of an additional transfer fee for guests of the North Island district;
  • performing settlements, invoicing, refunding funds;
  • communication with the Guest on booking issues (confirmation, schedule changes, cancellation, informing about weather conditions and other circumstances affecting the provision of services);
  • ensuring safety on board vessels/boats and proper quality of service;
  • review of requests, complaints, and reviews;
  • sending informational and promotional messages about the Company's programs and promotions — solely if there is a separate consent obtained in accordance with Section 7, with the possibility to opt out of such mailing at any time;
  • execution of the requirements of the legislation of Vietnam (accounting, tax reporting, responses to requests from authorized bodies);
  • improving the operation of the Website, analysis of traffic and user experience (anonymized and aggregated statistics).

6. Legal Grounds for Processing
6.1. The processing of personal data is carried out by the Operator on the basis of:
  • the consent of the personal data subject obtained in accordance with Section 7 of this Policy;
  • the necessity to perform a contract (public offer) to which the personal data subject is a party, or to take steps at their request prior to entering into a contract;
  • the necessity to comply with legal obligations directly imposed on the Operator by the current legislation of Vietnam.
  • 6.2. The Operator does not use a general reference to "legitimate interests" as an independent ground for processing without consent. Processing without the consent of the personal data subject is permitted only in cases and within the limits directly provided for by the applicable legislation of Vietnam. For each processing operation, the Operator maintains an internal register fixing the purpose, data categories, legal ground, retention period, and data recipients.

7. User Consent: Obtaining, Recording, and Revocation
7.1. When filling out the booking form on the Website, the User is offered separate, unchecked-by-default selection fields (checkboxes):
  • a mandatory checkbox of consent to the processing of personal data necessary for the review of the request and execution of the booking (without such consent, the request cannot be processed);
  • a separate, optional checkbox of consent to receive marketing, promotional, and informational messages — is not a condition for booking and may be left unchecked by the User.
  • 7.2. The Operator stores a verifiable record of each consent provided, including the date and time, the text (wording) of the consent, the version (edition) of this Policy in force at the time of consent, the source of communication (form on the Website, phone, messenger, etc.), and the identifier of the respective request/booking.
  • 7.3. The personal data subject has the right to revoke consent to processing at any time, in a manner no more complicated than the method of its provision — in particular, by contacting the Operator using the contact details specified in Section 2 of this Policy, via the same communication channel (form, phone, messenger, email) through which the consent was given.
  • 7.4. Revocation of consent to processing does not affect the lawfulness of the processing carried out by the Operator prior to the moment of such revocation, and does not prevent data processing in the scope necessary for the performance of already commenced contractual obligations (for example, completion of a paid booking) or to comply with legal requirements.

8. Procedure and Conditions for Personal Data Processing
8.1. The processing of personal data is carried out with the use of automation tools and without such (including on paper media — for example, when filling out paper forms at the pier).
8.2. The Operator processes personal data only in the scope necessary to achieve specific, predetermined, and lawful purposes specified in Section 5 of this Policy, and does not allow processing incompatible with these purposes.
8.3. Personal data are stored no longer than necessary for the purposes of their processing, unless another retention period is established by the laws of Vietnam (in particular, requirements for the storage of accounting and tax documents). Upon expiration of the retention period, personal data are anonymized or destroyed.

9. Transfer of Personal Data to Third Parties
9.1. The Operator has the right to transfer the Guest's personal data to the following categories of third parties solely in the scope necessary to render services:
  • transport partners and drivers carrying out the transfer "hotel — pier — hotel", including additional transfer for the North Island district;
  • payment systems and banks — to perform settlements;
  • the provider of the Website's technological platform, the request and booking tracking system (CRM/booking system), and providers of cloud services and backup;
  • telecom operators and messenger providers (WhatsApp, Telegram, Zalo, KakaoTalk, etc.) — to send messages related to booking;
  • state authorities of Vietnam — in cases provided for by law (upon a motivated request or by virtue of a direct statutory provision).
  • 9.2. The Operator does not transfer personal data to third parties for marketing purposes without a separate consent of the personal data subject and does not carry out the sale of personal data.
10. Cross-Border Transfer of Personal Data
10.1. Part of the recipients and services specified in Section 9 (in particular, foreign hosting, CRM/booking system, messengers, analytics services, payment providers, backup providers) may process and (or) store data on servers outside of Vietnam, which may qualify as a cross-border transfer of personal data.
10.2. For the purposes of complying with applicable legislation, the Operator compiles and maintains a data flow map reflecting for each service used: the country of processing/storage, the recipient, the categories of transferred data, the purpose of transfer, the retention period, the applied security measures, and the legal ground for transfer.
10.3. Regarding flows to which the exemption provided for by legislation does not apply (in particular, for small businesses or operations of a limited volume and nature), the Operator ensures the conclusion of contractual terms on data protection with the respective service providers and prepares documentation, including a personal data cross-border transfer impact assessment, for submission to the competent state authority of Vietnam in the manner and within the time limits established by law, if such an obligation is applicable.
10.4. The Operator limits the volume of cross-border transferred data to the limits necessary for the operation of the specific service used, and does not transfer sensitive personal data outside of Vietnam beyond the volume objectively necessary for the purposes specified in Section 11 of this Policy.

11. Sensitive Personal Data (Health Information)
11.1. The Operator collects information relating to sensitive personal data (in particular, dietary restrictions, allergies, or other medical circumstances significant for safety on board) only in the scope objectively necessary to ensure the safety of a specific tour, and only if the personal data subject voluntarily provided such information.
11.2. The Operator separately notifies the personal data subject about the purpose and regime of processing sensitive personal data and, when required by applicable legislation, requests a separate explicit consent to their processing.
11.3. Access to sensitive personal data is limited to the dispatcher and (or) another responsible employee of the Operator, as well as persons (crew, catering supplier) to whom such information is directly necessary to ensure safe service provision; each case of access is recorded in the access log.
11.4. Sensitive personal data are not used by the Operator for marketing purposes and are stored for the period objectively necessary to provide the corresponding service, after which they are deleted on a priority basis compared to other categories of personal data.

12. Personal Data Protection Measures and Incident Response
12.1. The Operator takes necessary legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, dissemination, as well as from other unlawful actions of third parties, including: limiting the circle of persons having access to personal data to the necessity of performing their labor (official) duties; using secure communication channels and information storage facilities; regularly assessing the effectiveness of the taken security measures.
12.2. In the event of an incident involving a leak or other unlawful disclosure of personal data, the Operator has an internal response plan in place, including: detection and initial recording of the incident; localization (termination of unauthorized access); preservation of logs and evidence; assessment of affected persons and data categories; legal qualification of the incident; notification of authorized bodies and affected personal data subjects in cases and in accordance with the procedure provided for by the legislation of Vietnam; subsequent analysis of the causes of the incident. The Operator undertakes to act within the time limits and in accordance with the procedure established by the applicable legislation.

13. Internal Compliance Measures
13.1. In addition to this public Policy, the Operator maintains a set of internal documentation on personal data protection, including, in particular: a data protection impact assessment (DPIA) and, if necessary, a cross-border transfer impact assessment; a register of processing operations and their recipients; a log of consents of personal data subjects; contractual terms with processors and service providers; a matrix of employee access to personal data; approved retention periods by data categories; an internal procedure for considering requests of personal data subjects and their deletion; a staff training program on personal data processing rules.
13.2. The specified internal documentation is not published on the Website, however, the availability and up-to-date status of such documentation is a necessary condition for the Operator's compliance with the applicable legislation of Vietnam and may be requested by competent state authorities in accordance with the established procedure.

14. Rights of the Personal Data Subject
14.1. The personal data subject has the right to:
  • know about the processing of their personal data by the Operator;
  • consent to the processing of their personal data or refuse such processing;
  • withdraw previously given consent to processing at any time in accordance with the procedure established by Section 7 of this Policy;
  • gain access to their personal data and demand its correction if it is incomplete, outdated, or inaccurate;
  • demand the provision of their personal data, as well as its deletion in cases provided for by applicable legislation;
  • demand the restriction of the processing of their personal data in cases provided for by law;
  • object to the processing of their personal data, in particular for direct marketing purposes;
  • file complaints, requests, and lawsuits on issues of personal data processing with competent state authorities of Vietnam and (or) in a judicial proceeding;
  • demand compensation for damage caused by a violation of personal data protection legislation in accordance with the procedure established by applicable legislation;
  • demand the adoption of protection measures regarding their personal data in cases provided for by legislation.
14.2. To realize the specified rights, the personal data subject applies to the Operator using the contact details specified in Section 2 of this Policy, with the indication of information allowing the identification of the applicant (in particular, to check that the request comes from the personal data subject themselves or their legal representative).
14.3. The realization of individual rights may be limited in cases directly provided for by legislation — in particular, when further processing (including storage) is necessary for the performance of the Operator's contractual obligations, to comply with its legal duties (accounting, tax reporting, responses to requests from authorized bodies), or to protect the legal rights and interests of the Operator or third parties.
14.4. In the event of the Operator's refusal to satisfy the request, the personal data subject has the right to appeal such refusal in accordance with the procedure provided for by clause 14.1 of this Policy (application to competent authorities or to court).

15. Terms for Considering Requests of Personal Data Subjects
15.1. The Operator registers each received request of a personal data subject immediately after its receipt.
15.2. The Operator sends a primary response (confirmation of receipt of the request) to the personal data subject within the shortest reasonable period, and the final response on the merits of the request — within the period established by the applicable legislation of Vietnam for the corresponding type of request (realization of the right to access, correction, deletion, restriction of processing, withdrawal of consent, etc.), without applying a single universal term for all types of requests. Specific terms by types of requests and grounds for their extension are determined by the Operator in accordance with Law No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP and are brought to the attention of the personal data subject when considering a specific request.

16. Cookies and Similar Technologies
16.1. The Website may use cookies and similar technologies to ensure the correct operation of booking forms, remember language settings, analyze traffic, and increase the convenience of using the Website.
16.2. The User can independently manage the use of cookies in their browser settings, including disabling them; in this case, certain functions of the Website (in particular, booking forms) may work incorrectly. More detailed rules for using cookies, including separate management of their non-essential categories, are established by the "Privacy Policy" published on the Website.

17. Processing of Personal Data of Minors
17.1. The Website and the Company's services are not intended for independent booking by persons who have not reached the age of majority. Personal data of minor guests (for example, when booking a family trip) are processed on the basis of data provided by their legal representatives (parents, guardians), who are responsible for the lawfulness of such provision and act on behalf of the minor when realizing the rights provided for by Section 14 of this Policy.

18. Changes and Action of the Policy
18.1. The Operator has the right to make changes to this Policy, including in connection with changes in the legislation of Vietnam on personal data protection. The current edition of the Policy is always placed on the Website at https://unionmarina.vn (Section "Personal Data Processing"), indicating the version number and publication date.
18.2. Continuation of the use of the Website and (or) services of the Company after making changes to the Policy signifies the familiarity of the personal data subject with the current edition of the Policy; such familiarity does not replace the separate consent to processing provided in accordance with Section 7 of this Policy.
18.3. This Policy acts indefinitely until its replacement by a new edition.

19. Contact Information of the Operator
  • Full Name (in Vietnamese): CÔNG TY TNHH UNION PHÚ QUỐC
  • Full Name (in English): UNION PHU QUOC COMPANY LIMITED
  • Abbreviated Name: UNION PQ CO., LTD
  • Trademark: UNION MARINA
  • Enterprise Registration Number (Mã số doanh nghiệp): 1702345751, issued by the Department of Planning and Investment (Business and Cooperative Registration Office) of An Giang Province on 26.12.2025, amendment No. 1 dated 09.01.2026
  • Registered Address: Căn nhà B6-905, Phú Quốc Waterfront, Khu phố Đường Bào, Đặc khu Phú Quốc, Tỉnh An Giang, Việt Nam
  • Phone: +84 977 01 85 01
  • Email: info@unionmarina.vn
  • Website: https://unionmarina.vn
  • Edition Publication Date: September 21, 2026