PRIVACY POLICY

This Privacy Policy explains how Aggregatori Capaci Joint Stock Company (“We”, “Us”, or “Our”) collects, uses, stores, shares, and protects information when You access or use the website, application, account, and features of 2driver.com. This Policy must be read in conjunction with the Terms of Use and the Personal Data Protection Policy of 2driver.com. When You register, log in, verify, provide information, or continue to use the Services, You acknowledge that You have read this Policy. If You use the Services on behalf of an organization or another individual, You warrant that You have proper authority and have provided the necessary notices and obtained the required consents under applicable law.

Article 1. Scope of the Policy

1.1. This Policy applies to the website, application, account, Vehicle Profiles, public pages, scheduling features, service history, support channels, and other features operated or provided by 2driver.com.

1.2. This Policy applies to Users, vehicle owners, vehicle operators, Garages, fleet management enterprises, service providers, representatives, and individuals whose information is processed during the course of using the Services.

1.3. Certain features or processes may be subject to specific privacy notices. In the event of any conflict, the specialized notice shall prevail within the scope of the matter it regulates.

1.4. This Policy may be updated to reflect changes in Services, applicable laws, technology, or data processing methods.

Article 2. Privacy Principles

2.1. We process information for specific, lawful, transparent purposes and strictly within the scope necessary to deliver, protect, and improve the Services.

2.2. We adhere to the data minimization principle, requesting only information appropriate to the role, feature, or process You select, unless otherwise required by law.

2.3. We do not sell Your personal data. Sharing of information is conducted solely within necessary boundaries, based on proper legal grounds, and for the purposes specified in this Policy or relevant notices.

2.4. We respect Your lawful choices regarding notifications, public displays, location settings, and Service utilization.

Article 3. Categories of Information Collected

3.1. Account and Contact Information: May include full name, phone number, email address, authentication details, role, organizational details, and content You provide upon registration or profile updates.

3.2. Vehicle Information: May include license plate, VIN, engine number, make, model, year of manufacture, images, vehicle condition, mileage, verification status, and supporting documentation.

3.3. Service Usage Information: May include Garages, service providers, appointments, booking date/time modifications, requests, service progress, service history, quotations, vouchers/invoices, reviews, complaints, and support communications.

3.4. Technical Information: May include IP address, device type, operating system, browser type, device ID, access logs, system errors, timestamps, and interaction patterns with the Services.

3.5. Feature-Specific Information: Depending on deployed features, We may process approximate location data, QR code scan logs, payment details, or information from integrated platforms as notified at the time of collection.

3.6. Identification and Authentication Information: May include full name, date of birth, personal identification number, Citizen Identity Card (CCCD) / identity card number, photos or extracted data from identity documents, as well as verification status and results. We process only details that are appropriate for the authentication purpose and feature You utilize.

Article 4. Sources of Information

4.1. Direct Collection: Collected directly from You when You register, log in, set up a profile, declare a Vehicle, book an appointment, upload documents, submit reviews, raise inquiries, or contact customer support.

4.2. Automated Collection: Collected automatically from Your device, browser, application, cookies, system logs, and similar technologies when You interact with the Services.

4.3. Third-Party and Partner Sources: Received from Garages, fleet management enterprises, service providers, integrated platforms, or other users where the information relates to Your requests, Vehicles, or transactions.

4.4. Other Lawful Sources: Received from other legal channels or competent state authorities when permitted or mandated by law.

4.5. Identity Verification Providers: Upon completing identity verification, We may receive data from identity documents, comparison results, or verification statuses provided directly by You or performed by authorized, lawful verification service providers under contract/authorization; We do not require You to supply data beyond what is strictly necessary.

Article 5. Purposes of Information Use

5.1. Creating, verifying, maintaining, and protecting Accounts; determining user roles; managing access rights; and supporting user login.

5.2. Establishing and operating Vehicle Profiles, Garage profiles, public pages, verification badges, search tools, tracking systems, QR functions, location services, and associated management features.

5.3. Receiving, coordinating, and tracking bookings; assisting with rescheduling booking dates/times; transmitting requirements to appropriate Garages, service providers, or integrated platforms.

5.4. Retaining service histories, quotes, invoices/vouchers, reviews, complaints, and communications to deliver features, resolve disputes, prevent fraud, and protect lawful rights.

5.5. Operating, securing, testing, analyzing, and improving the Services; detecting bugs, abuse, fraud, cyberattacks, or policy violations; fulfilling statutory obligations and requests from competent authorities.

5.6. Verifying identities via CCCD, identity cards, or other lawful identification documents to protect Accounts, prevent fraud, process Bookings, and enable features requiring high-assurance verification.

Article 6. Publicly Displayed Information

6.1. Public Vehicle Pages display only basic, publicly permissible Vehicle parameters and verification statuses. Public pages do not display repair logs, booking histories, identity data, uploaded identity documents, private contact details, or transaction data, unless a specific, clearly notified public feature dictates otherwise.

6.2. Public Business or Garage pages may display commercial details, service areas, service categories, business contact info, reviews, and operational status.

6.3. We may utilize information You explicitly choose to make public across search results, profile pages, QR codes, or corresponding sharing functions.

6.4. You are advised to review details prior to publishing. Where functionalities permit, You may edit, conceal, or request restrictions on information display pursuant to platform guidelines and applicable laws.

Article 7. Cookies and Similar Technologies

7.1. The website and applications may deploy cookies, device identifiers, SDKs, pixels, system logs, and similar technologies to maintain active login sessions, remember preferences, measure performance, secure systems, and enhance user experience.

7.2. Essential technologies are required to deliver core functionalities. Analytical or optional technologies may be managed through browser settings, device permissions, or displayed preference controls.

7.3. Disabling or restricting cookies, device permissions, or similar technologies may cause certain features to function improperly or incompletely.

Article 8. Information Sharing

8.1. We may share necessary information with Garages, fleet management entities, service providers, or processing partners to execute bookings, verifications, support, notifications, and requested features.

8.2. We may engage technical vendors for data storage, hosting, OTP delivery, notifications, analytics, customer care, cybersecurity, data backup, payment processing, or infrastructure operations. These parties are restricted to processing data strictly within their authorized or contracted scope.

8.3. We may share information with affiliated entities, integrated platforms, or third parties when necessary to deliver integrated workflows, based on Your selections or explicit notices.

8.4. We may disclose information to public authorities, courts, legal counsel, auditors, or relevant parties upon legal grounds to comply with statutory obligations, safeguard legal rights and property, or address safety incidents.

8.5. Identity data and details extracted from identity documents are not publicly displayed or shared by default with Garages, fleet managers, service providers, processing partners, or integrated platforms. Disclosures occur strictly under proper legal grounds or Your explicit consent, and solely to the extent necessary for stated purposes. Receiving entities are prohibited from using shared data for unauthorized secondary purposes.

Article 9. Integrated Platforms and Third-Party Services

9.1. 2driver.com may integrate with or redirect Users to third-party services, including vehicle rentals, vehicle sales/trading, roadside assistance, insurance, financing, valuation, charging networks, fueling, or other automotive services added over time.

9.2. When You utilize an integrated platform, necessary information may be transmitted to the third party to fulfill Your request. Third parties operate under their own independent privacy policies, terms, and data processing practices.

9.3. We remain responsible for data processing activities determined or executed within Our own Services; third parties remain responsible for processing activities occurring within their own systems, purposes, and control domains.

9.4. You should read the privacy notices and terms of integrated platforms before providing additional personal data or executing transactions with them.

Article 10. Location Data, QR Codes, and Notifications

10.1. Upon receiving Your permission, 2driver.com may process approximate location data to facilitate Garage searches, identify service coverage areas, coordinate requests, or display relevant features. You may deny location access, though location-dependent functionalities may become restricted.

10.2. QR codes may lead to Vehicle Profiles, Garage pages, support requests, or authentication flows. Depending on the purpose, scanning or interacting with QR codes may be logged for security, analytics, or request fulfillment.

10.3. We may dispatch communications via app notifications, SMS, email, voice calls, or other channels regarding system safety, Account updates, bookings, transactions, customer support, platform changes, and operational notices.

10.4. You may opt out of promotional or optional notifications via settings, but opting out does not stop mandatory service communications concerning security, Account integrity, financial transactions, or legal mandates.

Article 11. Data Storage and Retention Periods

11.1. We store information for the duration necessary to fulfill the collection purposes, deliver Services, handle complaints, resolve disputes, maintain cybersecurity, conduct audits, and ensure legal compliance.

11.2. Retention periods vary based on data category, user role, functional scope, statutory obligations, evidentiary requirements, and legitimate interests of the involved parties.

11.3. Verification details, identity data, document scans/copies, or service files may be subject to access restrictions, unlinking, anonymization, or segregated storage, and are not made public by default.

11.4. When information is no longer required, We will delete, destroy, anonymize, or apply other appropriate measures in accordance with the Personal Data Protection Policy and applicable law.

Article 12. Account Closure and Post-Closure Data

12.1. When You request Account deletion or closure, the Account enters a 30-day pending state. Logging back in within this 30-day window revokes the closure request and reactivates the Account, unless stated otherwise.

12.2. If You do not log in within the 30-day period, the Account is permanently closed. Subsequent use of that phone number is treated as a new Account registration and will not restore data from the closed Account.

12.3. Account closure does not mean all data is immediately erased from system databases. A portion of data may be retained under restricted access, unlinked identifiers, or anonymized formats for the timeframe necessary to satisfy legitimate security, complaint resolution, dispute handling, and statutory compliance needs.

12.4. System backup archives, security logs, financial vouchers, or records involving other Users may be retained for applicable statutory periods and processed pursuant to this Policy.

Article 13. Security Measures

13.1. We implement appropriate administrative, technical, and organizational measures—such as access control, multi-factor authentication, data encryption or equivalent safeguards, data backups, system monitoring, logging, and security audits commensurate with risk levels.

13.2. No method of transmission or storage is 100% secure. Therefore, You must safeguard Your OTPs, passwords, physical devices, active login sessions, QR codes, and authentication credentials, and immediately report any suspicious activity.

13.3. Internal data access is restricted on a strict need-to-know basis for job execution, and is routinely audited, revoked, or adjusted based on job roles.

13.4. We reserve the right to temporarily suspend Accounts, specific features, or access sessions when necessary to mitigate or respond to cyber risks or safety threats.

Article 14. User Choices and Control

14.1. You may update profile details, inspect public disclosures, adjust notification preferences, manage location permissions, and utilize control tools embedded within the Services.

14.2. You may refuse to provide optional information. However, withholding required details may prevent 2driver.com from creating an Account, verifying Vehicles, processing Bookings, or delivering specific features.

14.3. You may request Account closure or submit data inquiries using the contact channels specified in Article 20 of this Policy.

Article 15. Data Subject Rights

15.1. Detailed rights of Data Subjects, exercise procedures, verification conditions, and exceptions are set forth in the Personal Data Protection Policy of 2driver.com and applicable laws.

15.2. Subject to legal conditions, You may exercise rights to know, access, rectify, withdraw consent, restrict processing, object to processing, request erasure, or exercise other statutory rights regarding Your personal data.

15.3. We may request necessary information or documentation to verify Your identity, authority, and request scope prior to processing.

15.4. Requests may be refused or limited if fulfilling them impairs the rights of third parties, breaches statutory obligations, compromises system security, risks evidence preservation, or where permitted by law.

Article 16. Protection of Children and Vulnerable Users

16.1. The Services are not intended to collect personal data from children in violation of law. Legal representatives are responsible for ensuring that Service usage and data submission by minors or dependents comply with applicable laws.

16.2. If You or a legal representative discover that data belonging to a child or vulnerable individual has been provided improperly, You may contact 2driver.com to request review and corrective measures.

16.3. We may apply age gates, additional verification steps, or feature restrictions to safeguard users and comply with legal requirements.

Article 17. Cross-Border Data Transfers and Foreign Vendors

17.1. To operate the Services, We may utilize infrastructure, hosting, security, analytics, or support vendors located within Vietnam or in other jurisdictions.

17.2. When transferring data or granting remote access outside of Vietnam, We implement appropriate safeguards and procedures tailored to applicable legal requirements, functional necessity, and risk levels.

17.3. Specific details regarding cross-border transfers, recipient categories, protective mechanisms, and Data Subject rights are detailed in the Personal Data Protection Policy or specialized notices.

Article 18. Security Incident Management

18.1. Upon detecting or receiving notice of a potential data security incident, We will receive, verify, contain, remediate, and perform impact assessments following established security workflows.

18.2. We may temporarily lock Accounts, alter authentication methods, restrict features, or request that You take additional security precautions to mitigate risks.

18.3. Where mandated by law or deemed necessary, We will notify affected Data Subjects, competent authorities, and relevant stakeholders regarding the incident, remediation steps, and protective recommendations.

18.4. You must promptly notify Us if You detect unauthorized access, lost devices, compromised OTPs/passwords, or suspicious activity relating to Your Service usage.

Article 19. Policy Amendments

19.1. We reserve the right to amend this Policy to reflect changes in Services, governing laws, technology, vendors, or processing practices.

19.2. Updated versions will state their effective date or revision date. We may notify Users via website posts, app notices, email, push notifications, or other appropriate communication channels.

19.3. For material changes, We may require You to re-confirm acceptance prior to granting continued access to partial or full Services.

19.4. We may maintain an archive of prior Policy versions for transparency, auditability, and dispute tracking purposes.

Article 20. Contact Information

20.1. Operating Entity Name: Aggregatori Capaci Joint Stock Company

20.2. Contact Address: No. 192, Group 8, Lang Ward, Hanoi City, Vietnam

20.3. Privacy & Security Inquiries: Customer support channels officially published by 2driver.com on the website, application, or within User Accounts.

20.4. 2driver.com may update its contact channels from time to time and will publish updated details directly on the Services.

20.5. When submitting requests, please state Your full name, verification details, request summary, relevant Account or Vehicle details, and necessary supporting documents. We may request additional information to verify Your identity and process the request accurately.

COMPANY REPRESENTATIVE