Privacy Notice

Read HSBC's privacy and security policy to understand the steps we take to protect you and your Personal Data from harm.

Section I – Data Privacy Principles

Section II – Privacy Notice

Section III – Security

• Transparency: We will be clear and transparent about how we process Personal Data.
• Fair and lawful usage: We will only process Personal Data lawfully and where we have a legitimate reason to do so. Identifiable data must be processed in a way that is fair. This means we will not process identifiable data in a way that is unfairly detrimental, or misleading to the individuals concerned.
• Limited purposes: We will only process Personal Data for a specific purpose, and will not use it for another incompatible purpose unless we have followed any steps required by Data Privacy Law to enable us to do so lawfully.
• Minimal and Adequate Data: We will make sure we only process Personal Data in a proportionate way. We will find an appropriate balance to make sure that we (i) process enough Personal Data to carry out our business and achieve our specific purposes, but (ii) do not process excessive amounts of Personal Data.
• Data accuracy: We will maintain appropriate standards of data quality and integrity. We will implement policies about data accuracy, including taking steps to stop Personal Data becoming out of date, where appropriate.
• Data Protection by Design and by Default: We will take steps to make sure that new products and services, or changes to existing products or services, are designed to respect Data Privacy Law.
• Record Keeping: We will keep appropriate records to show that we have complied with Data Privacy Law.
• Rights of individuals: We will respect individuals’ rights relating to their Personal Data, in accordance with Data Privacy Law.
• Storage Limitation: We will store and retain Personal data in line with applicable Data Privacy Laws and HSBC’s retention standards. We will aim to delete or otherwise dispose of Personal data securely when it is no longer needed for a lawful purpose and wherever practicable.
• Data Security: We will maintain appropriate security standards for Personal Data that we process. We will make sure that only individuals who are permitted to process personal data for a lawful purpose are allowed to do so.
• Data Transfer: If we voluntarily transfer Personal Data to another HSBC entity, a third party or another jurisdiction, we will make sure that the transfer is allowed under Data Privacy Law. Where appropriate, we will review the privacy and security protections of the recipient to make sure that they are adequate and not inconsistent with the principles set out herein.
• Third parties: Where we appoint a vendor or agent, we will review their privacy and security protections to make sure that they apply the same or equivalent standards to the principles set out herein.
• Awareness and Data Excellence: We will raise data and privacy awareness amongst HSBC staff to help ensure that all colleagues and contractors understand how to properly process and safeguard personal data.
• Data Ethics: Effective data privacy compliance is not just about making sure that we follow Data Privacy Laws. We must consider if it is appropriate to do something as well as whether it is lawful to do something.

1. Before We Begin

This Privacy Notice (“Privacy Notice”) applies to Personal Data (as defined below) processed by HSBC Bank (Vietnam) Ltd. (hereinafter collectively referred to as “HSBC”, “we”, “us”, “our”), as the Personal Data Controller or the Personal Data Controller and Processor (as the case may be) in accordance with Personal Data Protection Laws and our internal policies.

In this Privacy Notice:

• Personal Data Protection Laws shall be understood as the Law on Personal Data Protection 2025, Decree No. 356/2025/NĐ-CP dated 31 December 2025 of the Government detailing certain articles and measures for the implementation of the Law on Personal Data Protection, and any other applicable laws and regulations of Vietnam having similar subject matter or otherwise relating to the protection of personal data;

• HSBC Group shall be understood as HSBC Holdings plc, its subsidiaries, related entities, affiliates and significant influencers, and any affiliates of these entities; and

• Any terms not defined in this Privacy Notice shall be read, understood and interpreted in accordance with Personal Data Protection Laws and/or any other relevant applicable laws.

The Privacy Notice explains what Personal Data we collect about our customer, potential customer and connected parties of customers (hereinafter collectively referred to as “you”, “your”), how we process that Personal Data, whom we share the Personal Data with, the circumstances under which we share Personal Data, and the steps we have taken and will continue to ensure it stays private and secure.

2. What Personal Data We Collect

Personal data means digital data or information in other forms that identifies or helps to identify a specific person, including basic personal data and sensitive personal data (“Personal Data”). In this Privacy Notice, your Personal Data refers to your Personal Data as a data subject, or the Personal Data of another data subject that you provide to us.

We collect and may use a combination of your Personal Data in specific circumstances, including but not limited to the following:

• when you or your employer, your lawful representative provides to us;

• when you visit our websites, mobile app, or premises and/or use our products or services (“Products”, “Services”);

• from public sources; from credit scoring, debt collection activities; from competent authorities; from our business partners; and/or

• from other lawful sources.

If you provide us with Personal Data of another person, you must obtain that person’s consent as required by Personal Data Protection Laws, and at the same time, you must explain and ensure that the person understands how we process their Personal Data. You further represent and warrant that you have complied with all other personal data protection obligations applicable to you under the Personal Data Protection Laws, including the obligation to cooperate with us in the event that any violation of the Personal Data Protection Laws is identified.

We may collect the following basic Personal Data, which reflects common and frequently used identity and background elements in transactions and social relations, in accordance with the categories issued by the competent authorities, including:

• Surname, middle name, and given name at birth; other names (if any);

• Date of birth; date of death or missing;

• Gender;

• Place of birth; place of birth registration; place of permanent residence registration; place of temporary residence registration; current place of residence; hometown; contact address;

• Nationality;

• Images of the individual;

• Phone number; personal identification number; passport number; driver’s license number; vehicle registration plate number;

• Marital status;

• Information on family relationships (parents, children, spouse);

• Information on the individual’s digital accounts;

• Other information associated with, or capable of identifying, a specific individual and which does not constitute sensitive Personal Data.

We may also collect the following sensitive Personal Data, which is associated with individual’s privacy rights that, if infringed on, directly affect the legitimate rights and interests of agencies, organizations and individuals, in accordance with the categories issued by the competent authorities, including:

• Data revealing racial origin or ethnic origin;

• Opinions on politics, religion, and belief;

• Information on private life, personal secrets, and family secrets;

• Health status;

• Biometric data, including voice, fingerprints, facial images, and other unique and stable physical or biological characteristics of an individual used to identify and distinguish that person from others;

• Genetic characteristics;

• Data revealing an individual’s sexual life or sexual orientation;

• Data on crimes and violations of law collected and stored by law enforcement agencies;

• Location data of individuals determined through positioning services;

• Login names and passwords for access to individuals’ electronic identification accounts; images of ID cards, citizen ID cards, or 9-digit ID cards;

• Login names and passwords for access to bank accounts; bank card information; data on transaction history of bank accounts; financial and credit information and other information relating to financial activities and transaction history, securities, and insurance of clients at credit institutions, foreign bank branches, intermediary payment service providers, securities institutions, insurers, and other authorized organizations;

• Data monitoring behavior and activities related to the use of telecommunications services, social networks, online communication services, and other services in cyberspace, including IP address, referring URL, operating system, web browser and any other information automatically logged from the connection, cookies, flash cookies, pixel tags, web beacons, or other tracking technologies, third-party cookies, plug-ins, or social media connectors, location information or other metadata provided by a device;

• Other personal data that are required by law to be kept confidential or to which strict confidentiality measures must be applied.

We process your Personal Data solely to the extent necessary to provide Products, Services, and for purposes specified in this Privacy Notice in accordance with Personal Data Protection Laws.

3. How We Process Personal Data

HSBC, by automated means, semi-automated means, or other appropriate means, processes your Personal Data through activities that affect your Personal Data, including one or more of the following activities: collection, analysis, synthesis, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities affecting Personal Data as determined by HSBC and as permitted under Personal Data Protection Laws.

We only process your Personal Data with your consent for the following purposes (“Purposes”):

• Verifying the accuracy and completeness of the information you provide; identifying or authenticating your identity and performing customer verification processes;

• Processing your registration for any Products, Services we offer or provide (including but not limited to third-party products such as investment or insurance products);

• Assessing credit applications and determining your eligibility for using our Products or Services;

• Credit scoring, credit rating, credit information assessment, and evaluating your creditworthiness in accordance with applicable law;

• Providing Products, Services of HSBC or any HSBC Group companies;

• Contacting you to exchange information, deliver invoices, statements, reports, or other relevant documents;

• Managing and evaluating business operations, including designing, improving, and enhancing the quality of Products or Services;

• Preparing financial, operational, or other reports as required by law;

• Exploiting your data stored in the National Population Database in accordance with applicable laws;

• Performing checks with call-blocking registries or similar registries (if any); conducting market research, surveys, and data analysis related to any Products or Services we provide (whether performed by HSBC or jointly with another party) that may involve you;

• Protecting our legitimate interests and complying with applicable laws, including preventing fraud, financial crime, and/or other offenses; fulfilling other legal compliance obligations applicable to HSBC or any company of HSBC Group;

• Preventing or minimizing threats to life, health, or public interest of others;

• Supporting any division, separation, merger, consolidation, reorganization, dissolution, transfer, or acquisition of HSBC’s business;

• Fulfilling internal operational requirements of HSBC or HSBC Group (including but not limited to credit and risk management, system or product development and planning, insurance, auditing, and administrative management); and

• Maintaining our overall customer relationship.

Direct Marketing

In addition, we may process your Personal Data with your consent to conduct communications, advertising, and marketing activities. In such cases, we use your Personal Data to send you details about Products and Services, reward programs, and customer loyalty privileges, including personalized advertising and marketing content via SMS, emails, phone calls, or other methods with appropriated frequency according to applicable regulations.

You may notify us at any time if you do not wish to receive advertising or marketing communications from us by contacting us directly through the contact channels provided in this Privacy Notice (it may take a short period of time to update our records to reflect such changes). You should also note that your opting out of receiving advertising or marketing communications does not restrict us from contacting you to exchange information, deliver invoices, statements, reports, or other documents related to the provision of the Products, Services, or on other legal bases.

Use of Big Data and Artificial Intelligence (AI)

Big data technologies and artificial intelligence enable us to process and analyze data with depth and breadth. At HSBC, we use big data and AI to:

• Improve and enhance the quality of customer service;

• Manage risks for HSBC and customers;

• Improve the identification and provision of suitable products and services to customers;

• Improve operational efficiency.

We must ensure that big data and AI are used ethically.

In exceptional cases, if we process your Personal Data for purposes beyond those stated here, we will notify you and obtain your additional consent before carrying out such processing, in accordance with Personal Data Protection Laws.

We may also disclose your Personal Data in the following circumstances:

• with your consent;

• when required by applicable laws;

• when processing your Personal Data without your consent is permitted by applicable law;

• when performing contractual obligations.

4. Who We May Share Your Personal Data With

HSBC may, to the extent not prohibited by Personal Data Protection Laws, and when necessary and consistent with the Purposes, share, transfer, transfer cross-border and disclose your Personal Data to the following global recipients (who may also share, transfer, send abroad, and disclose such Personal Data for the Purposes):

• any function within HSBC;

• any member of HSBC Group;

• any subcontractor, agent, service provider, business partner, or associate of ours and/or HSBC Group (including their employees, directors, and officers);

• any competent authority;

• any party acting on behalf of the customer, payee, beneficiary, account agent, correspondent bank, clearing or settlement system, or any party making payments for the customer;

• any party with an interest or bearing risk in or relating to the Products or Services;

• financial institutions, card organizations, credit reference agencies, or credit bureaus to collect or provide credit references;

• any third-party fund manager providing asset management services to customers;

• any brokers provided or introduced;

• any other individual and organization subject to your consent.

5. Cross-Border Transfers of Your Personal Data

To conduct the Purposes specified in this Privacy Notice, your Personal Data may be transferred to and processed outside the territory of Vietnam, including countries or territories that may not provide the same level of Personal Data protection. When conducting such transfers, we have taken and will continue to take appropriate security measures and ensure the transfer is lawful. In some countries/territories, the law may require us to share certain Personal Data with authorities. Even in such cases, we only share your Personal Data with persons who have the right to access it. We comply with our legal and regulatory obligations regarding the transfer of your Personal Data.

6. How We Store and Secure Your Personal Data

Your Personal Data is stored and processed by us in Vietnam or abroad, including in environments involving big data, artificial intelligence, blockchain, metaverse, and cloud computing, in accordance with Personal Data Protection Laws, from the date it is obtained until the date the Purposes are fulfilled, under HSBC’s internal data processing, storage and retention policies or Personal Data Protection Laws. Your Personal Data will be deleted, destroyed thereafter or upon your request, in accordance with this Privacy Notice and Personal Data Protection Laws.

HSBC protects your Personal Data throughout the entire transfer, processing, and storage process. We have implemented and will maintain reasonable measures to protect your Personal Data. We apply HSBC Group global data security standards, consistent with Personal Data Protection Laws.

Although we employ security measures, data breaches and unauthorized access may still occur. In such cases, we will coordinate with you and the competent authorities to address the incident and mitigate the harm caused by such breach or unauthorized access; we will also comply with all other obligations applicable to us under the Personal Data Protection Laws, including the obligation to notify personal data breaches in accordance with the Personal Data Protection Laws. You should also note that HSBC is not liable for damages or losses resulting from such breaches or unauthorized access unless caused by our intentional misconduct or gross negligence.

7. Your Rights and Obligations Regarding Personal Data

Unless otherwise provided by Personal Data Protection Laws, you have the following rights regarding your Personal Data:

• To be informed of your Personal Data processing activities;

• To consent or refuse consent, request withdrawal of consent for the processing of Personal Data, including to consent or refuse consent, or to request withdrawal of consent, in relation to HSBC’s automated processing of Personal Data as described in this Privacy Notice;

• To access, correct, or request correction of Personal Data;

• To request provision, deletion, destruction, or restriction of Personal Data; to submit objections to the processing of Personal Data;

• To file complaints, denunciations, lawsuits, and seek compensation for damages as provided by law;

• To request competent authorities or relevant organizations or individuals involved in Personal Data processing to take measures to protect your Personal Data as required by law.

You have the following obligations with respect to Personal Data:

• To protect your own Personal Data;

• To respect and protect the Personal Data of others;

• To provide complete and accurate Personal Data as required by law, contracts, or when you consent to Personal Data processing;

• To comply with Personal Data Protection Laws and participate in preventing and combating Personal Data infringement.

In all cases, you may exercise your rights under this Privacy Notice by contacting us using the communication channels provided herein. Subject to our policies from time to time, you may be required to complete certain procedures or forms in accordance with our detailed instructions in order to exercise your rights. In accordance with applicable laws and HSBC’s internal policies, we will process your requests to exercise your rights, including requests to withdraw consent, restrict or object to processing, access, amend, provide, and implement measures and solutions to protect Personal Data, as well as requests to delete or destroy Personal Data after the Purpose has been fulfilled, within the time limits permitted under Personal Data Protection Laws, and we will notify you accordingly.

However, you should note that your refusal to consent, or to withdraw, amend, delete, destroy, or restrict your consent in respect of any or all Purposes or methods of processing your Personal Data may affect our ability to provide Products or Services to you. The withdrawal of consent does not affect the legality of the data processing that HSBC and/or third parties have conducted based on your consent prior to the withdrawal and/or the contractual obligations you have committed to HSBC.

Given our reliance on your Personal Data to deliver Products and Services, it is imperative that you ensure the accuracy, correctness, and completeness of your Personal Data at all times. You are required to promptly update us of any changes to the Personal Data you have provided.

When You Need to Contact Us About Your Information

• HSBC Bank (Viet Nam) Ltd
Address: Metropolitan, 235 Dong Khoi Street, Sai Gon Ward, Ho Chi Minh City, Viet Nam.

• Contact Center: (84 28) 38 292 288. If you are our existing customer, please contact your Relationship Manager/ Customer Service Manager for support.

• In case you require a copy of this Privacy Notice or have any related questions, please contact us through our Personal Data Protection Department at: DPOmailbox@hsbc.com.vn

Amendments and Updates

This Privacy Notice may be amended or supplemented from time to time, and you can always find the latest version on our official website.

The latest update has been in effect since 1 November 2026.

Customers may access the version that was effective before 1 November 2026 here: https://www.business.hsbc.com.vn/en-gb/regulations/privacy-and-security-before-1-nov26

Data security

• Security is our top priority. HSBC Bank (Vietnam) Ltd. ("the Bank") will strive at all times to ensure that your personal data will be protected against unauthorised or accidental access, processing or erasure. We maintain this commitment to data security by implementing appropriate physical, electronic and managerial measures to safeguard and secure your personal data.

• The secure area of our website supports the use of Secure Socket Layer (SSL) protocol and 256-encryption technology - an industry standard for encryption over the Internet to protect data. When you provide sensitive information such as credit card details, it will be automatically converted into codes before being securely dispatched over the Internet.

• Our web servers are protected behind "firewalls" and our systems are monitored to prevent any unauthorised access. We will not send personal information to you by ordinary email. As the security of ordinary email cannot be guaranteed, you should only send email to us using the secure email facility on our website.

• All practical steps will be taken to ensure that personal data will not be kept longer than necessary and that the Bank will comply with all statutory and regulatory requirements in Vietnam concerning the retention of personally identifiable information.

Security assurance

• Both you and HSBC play an important role in protecting against online fraud. You should be careful that your bank account details including your User ID and/or Password are not compromised by ensuring that you do not knowingly or accidentally share, provide or facilitate unauthorised use of it. Do not share your User ID and/or password or allow access or use of it by others. We endeavor to put in place high standards of security to protect your interests. If, in the unlikely event, unauthorised transactions have been conducted through your account through no fraud, fault or negligence on your part, we will see that you are covered for your direct loss up to the full amount of the unauthorised transaction.

• You should safeguard your unique User ID and Password by keeping it secret and confidential. Never write them down or share these details with anyone. HSBC will never ask you for your Internet Banking Password, in order to ensure that you are the only person who knows this information. When choosing your unique User ID and Password for the first time, do not create it using easily identifiable information such as your birthday, telephone number or a recognisable part of your name. If you think your User ID and/or password has been disclosed to a third party, is lost or stolen and unauthorised transactions may have been conducted, you are responsible to inform us immediately.