Data protection at Safeminute
At Safeminute Company Limited (“Safeminute”, “we”, “us”, “our”), we routinely collect and use personal data about individuals, including policyholders, insured persons, beneficiaries, agencies, business partners, or any individuals whose personal data we collect (collectively referred to as “you”). We value your privacy and the security of your personal data, treating them as a top priority. Hence, we are aware of our responsibility to handle your personal data with care, to keep it secure, and to comply with applicable personal data protection laws.

How this policy works
The purpose of this Policy is to provide a clear explanation of what, when, why, and how we collect and use information relating to you that allows us to identify you (“Personal Data”), whether directly or indirectly. It explains with whom we share Personal Data, how we retain it to keep it confidential and privileged, what actions you can take, and how you can contact us.

Important
Please read this Policy carefully. It provides important information on how we use Personal Data and explains your statutory rights. This Policy is not intended to override any terms of an insurance policy or contract you have with us, nor any rights available to you under applicable data protection laws.

Data protection policy
1. Who is responsible for your personal data?
SAFEMINUTE COMPANY LIMITED will be principally responsible for looking after your Personal Data.
Where your Personal Data has been passed to another Data Controller (e.g., a reinsurer or governmental agency), Safeminute will inform you of the Data Controllers with whom we have shared your Personal Data and whom you may contact regarding their use of your data, as outlined in Section 6 of this Policy.
Please be aware that although we are principally responsible for safeguarding your personal data, information may be held in databases accessible to other companies within the Safeminute Group, including our brands, affiliates, and subsidiaries (“Safeminute companies”). When accessing your personal data, Safeminute companies will comply with the standards set out in this Policy.

2. What personal data do we collect?
We collect and process personal data, including Basic Personal Data and Sensitive Personal Data, as defined below.
2.1. Basic Personal Data includes:

• Family name, middle name, first name, and any other names (if any)
• Date of birth; date of death or missing status
• Gender
• Place of birth, registered place of birth, permanent residence, temporary residence, current residence, hometown, contact address
• Personal image
• Nationality
• Phone number; ID card number; personal identification number; passport number; driver’s license number; license plate; personal tax code; social insurance number; health insurance card number
• Marital status
• Information on family relationships (parents, children)
• Digital account information; online activity data
• Other identifying information not classified as Sensitive Personal Data

2.2. Sensitive Personal Data includes:

• Political or religious opinions
• Health conditions and medical records (excluding blood type)
• Racial or ethnic origin
• Genetic characteristics
• Biometric or biological characteristics
• Sex life or sexual orientation
• Criminal records held by law enforcement authorities
• Financial and banking data received from licensed institutions
• Precise personal location data
• Other data requiring special protection under law

Prospective Policyholders, Insured Persons, Beneficiaries, and Related Parties
To underwrite and administer insurance policies, Safeminute collects relevant personal data, including background, risk-related, and contact information. Depending on the policy type, this may include Sensitive Personal Data such as health or medical information, subject to a lawful exemption as described in Section 5.
If you provide personal data of third parties (e.g., injured parties or beneficiaries), you confirm that you have informed them of this Policy and obtained consent where required. Safeminute will process such data in accordance with this Policy.

Claimants
If you submit a claim, we collect contact details, claim-related information, and prior claims history. Sensitive Personal Data may be required depending on claim nature (e.g., accident or illness).

Business Partners
We collect business contact details and may collect information related to professional expertise and experience.

Website Visitors
We may collect personal data when you visit our website, applications, or social media platforms, register for newsletters, or attend Safeminute events. Any data collected will be clearly identified with its purpose explained.

3. When do we collect your personal data?
Prospective Policyholders and Insured Persons

• Directly from you during applications
• From agents, brokers, employers, family members, or authorized third parties
• From public registries, credit reference agencies, and government sources where legally permitted

Claimants

• Directly from you or your representatives
• From employers, related parties, lawyers, or third-party claimants
• From public and online sources to validate claims or prevent fraud

Business Partners and Visitors

• During business interactions, events, website contact, or newsletter registration
• From public sources when necessary to manage relationships

Applicable to All
Safeminute may record calls, use IVR technology, and analyze recordings for contractual evidence, training, service quality, or fraud detection.

4. What do we use your personal data for?

• Underwriting, issuing, administering, and renewing insurance policies
• Managing claims and settlements
• Regulatory and legal compliance
• Fraud prevention
• Business operations and relationship management
• Marketing (subject to consent and opt-out rights)
• Data analytics using aggregated or anonymized data

5. Protecting your privacy
We process personal data only when lawful, based on:

• Contractual necessity
• Legal or regulatory obligations
• Legitimate business interests
• Your consent

Lawful exemptions include consent, legal claims, or statutory insurance exemptions.

6. Who do we share your personal data with?
This may include:

• Insurance agencies, brokers, reinsurers
• Assistance providers
• Healthcare providers
• Regulators (MOF, MPS)
• Fraud prevention agencies
• Professional advisors (lawyers, auditors, actuaries)
• Employers (where applicable)
• Service providers and TPAs

All third parties are required to protect your data and use it lawfully.

7. Direct marketing
Safeminute may send marketing communications via email, SMS, phone, post, or online ads. You may opt out at any time using provided links or by contacting us.

8. Cross-border transfers
Personal data may be transferred outside Vietnam within the Safeminute Group or to reinsurers and service providers, subject to adequate safeguards and legal compliance.

9. How long do we keep your personal data?
Typically, data is retained for 10 years after policy termination, unless a longer period is legally required. Data is securely deleted when no longer needed.

10. Important notice
If required data or consent is not provided or is withdrawn, Safeminute may be unable to provide services or maintain contractual relationships.

11. Security
Safeminute applies appropriate organizational, technical, and administrative measures under the Law on Cybersecurity and related legislation. Absolute security cannot be guaranteed.

12. Your rights regarding your personal data
You have rights to:

• Be informed
• Consent or refuse processing
• Access, correct, restrict, or delete data
• Withdraw consent
• Object to processing
• Request data provision
• File complaints, lawsuits, or seek damages
• Notify the Ministry of Public Security

Requests may be limited where legally required.

13. Changes to the policy
Safeminute may update this Policy. Changes will be posted on our website, with advance notice for material updates.

14. Contact and complaints
Data Protection Officer
Safeminute Company Limited
Email: info@safeminute.tech