Personal Data Privacy Policy

When you use WECHA's website and services, we collect the following basic personal data:

• Full name

• Phone number

• Email address

• Delivery address

This data is collected when you: register for membership; place an order (including the cash-on-delivery (COD) payment method); fill in a consultation form, register as a dealer, or request export consulting; or communicate with us via the chat box on the website.

We only collect data that you voluntarily provide yourself. WECHA does not intentionally collect sensitive personal data; if you choose not to provide a particular piece of information, certain corresponding features may not be available.

We process your personal data for the following purposes:

• Processing and delivering orders: confirming orders, preparing goods, delivering to the correct address, and handling exchanges/returns where applicable.

• Customer consultation and customer care (CSKH): answering questions and providing support by phone, email, or chat.

• Member care: managing membership accounts and the associated benefits.

• Marketing: sending information about programs, promotions, and new products — done ONLY when you have consented to receive it, and you may opt out at any time.

WECHA does not use your data for purposes beyond those stated above without your consent.

The processing of your personal data is based on the following grounds under Decree 13/2023/ND-CP:

• Consent of the data subject: for marketing activities and non-mandatory purposes, we process data only when you consent.

• Performance of a contract/transaction: for order processing and delivery, this data is necessary to fulfill your purchase request.

• Compliance with legal obligations: for example, retaining records to meet accounting and tax obligations as required by law.

Your consent is given clearly and proactively (for example, by checking a consent box) and is recorded. You have the right to withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

WECHA does not sell your personal data. We share data only to the extent necessary to provide our services, specifically:

• Delivery providers: we provide your full name, phone number, and delivery address to delivery partners so they can deliver your order to you.

• Payment providers: for online payment methods (VNPay, MoMo, bank transfer — currently being finalized), the information necessary for the transaction will be processed through the corresponding payment gateway/provider. At present, WECHA mainly applies the cash-on-delivery (COD) method.

• Competent state authorities: when there is a lawful request in accordance with the law.

The third parties mentioned above are responsible for keeping data confidential and may only use the data for the agreed purpose.

We retain personal data only for as long as necessary for the stated purposes, or for the period required by law:

• Data used for orders and customer care: retained throughout the period you use our services and for a reasonable period thereafter to handle complaints, warranty, and exchanges/returns.

• Records related to transactions and accounting: retained for the period required by accounting and tax laws.

• Data used for marketing: retained until you withdraw your consent or request deletion.

When the retention period expires or when the data is no longer needed, we will securely delete or anonymize the data.

Under Decree 13/2023/ND-CP, you have the following rights over your personal data:

• Right to be informed: to know about the processing of your data.

• Right of access (to view): to request to view the personal data we are holding.

• Right to rectification (to correct): to request that inaccurate data be updated or corrected.

• Right to erasure: to request deletion of personal data in cases permitted by law.

• Right to withdraw consent: to stop receiving marketing or withdraw consent to processing at any time.

• Right to restrict, object to processing, and the right to complain: to request restriction of processing, object to processing, or lodge a complaint with us and with competent state authorities if you believe your rights have been infringed.

To exercise the above rights, please contact us using the information in the Contact section below. We will receive and respond to your request within the time limits prescribed by law.

WECHA applies reasonable technical and managerial measures to protect your personal data from unauthorized access, use, disclosure, or alteration.

We limit access to data to only those personnel who need it to perform their work, and we require our data-processing partners to comply with confidentiality obligations.

Although we make every effort to protect data, no method of transmission or storage is absolutely secure. In the event of an incident affecting personal data, we will provide notification and handle it in accordance with the law.

WECHA's website may use cookies and similar technologies to help the website operate reliably, remember your preferences, and improve your experience.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect some features of the website.

Your continued use of the website means you consent to our use of cookies in accordance with this policy, unless you adjust your browser settings to refuse them.

For any request related to personal data, exercising data subject rights, or a privacy complaint, please contact:

• Entity: CONG TY TNHH VUA AN TOAN (VUA AN TOAN CO., LTD) (WECHA brand)

• Tax code: 0313334177

• Address: Ba Diem, Hoc Mon, Ho Chi Minh City

• Data Protection Officer (DPO) / Receiving email: dpo@wecha.vn

• Hotline: 0777 722 777

We will receive, verify, and respond to your request within the time limits prescribed by law.

This privacy policy may be updated from time to time to reflect changes in the law or in WECHA's operations.

The latest version will be posted on the website. We recommend that you check periodically to stay informed of updates. Your continued use of our services after the policy is updated means you accept the changed content.