CAREERLINK.VN PERSONAL DATA PRIVACY POLICY

1. Purpose of the Policy

This Policy transparently discloses how CareerLink Co., Ltd. ("CareerLink", "we", "us" or "our") collects, stores, uses, shares, and protects users' personal data on the CareerLink.vn platform, and ensures data subjects' rights under the Personal Data Protection Law No. 91/2025/QH15, Decree 356/2025/ND-CP, and related laws.

2. Personal Data Collected

Data provided by users: full name; date of birth; address; email; phone number; education information; work experience; skills, career interests, and other information voluntarily declared by users when creating an account, creating a profile/CV, or interacting on the platform.

Technical data generated when accessing the platform: IP address, browser type, operating system, access time, cookies, and similar data.

CareerLink does not require and does not collect personal identification number/citizen ID, bank account number, or payment card number from job seekers. Users should not include this information in their profile/CV.

3. Purposes of Processing Personal Data

Personal data is processed for the following purposes, each tied to separate user consent under Section 4:

• (a) Providing core services: creating and maintaining accounts; managing profiles; sending profiles to Employers when users actively apply for jobs; responding to support requests.
• (b) Allowing Employers to search profiles: when users enable searchable mode, their profiles will be visible to Employers using CareerLink's candidate search service. Users may enable or disable this mode at any time in account settings.
• (c) Referring profiles through Executive Search services: CareerLink consultants only send a candidate's profile to recruitment clients after discussion with and consent from the candidate for each specific position; CareerLink may retain the candidate's confirmation through email, messages, or other electronic methods.
• (d) Communications and marketing: sending suitable job alerts, newsletters, and event information. Users may choose not to subscribe or unsubscribe at any time without affecting their use of core services.
• (e) Security and operations: preventing impersonation and fraud, protecting the system, and analyzing and improving service quality.
• (f) Performing legal obligations at the request of competent state authorities.

4. Consent Mechanism

• User consent must be clear, affirmative, and expressed through a specific action (checking a confirmation box, enabling an option in settings, or confirming through an action on the system), and is logged by CareerLink for traceability;
• Consent is collected separately for each purpose stated in Section 3. Purposes (b), (c), and (d) are optional: users have the right to refuse consent while still being able to use core services;
• Silence or continued use of the service is not considered consent;
• Users may withdraw consent at any time in account settings or through the contact point in Section 13. Withdrawal does not affect the lawfulness of processing performed before withdrawal. When a user withdraws consent, CareerLink stops processing data for the relevant purpose and notifies recipients of the data (if any).

5. Scope of Use and Data Sharing

• CareerLink only uses personal data within the purposes disclosed in Section 3;
• Sharing with Employers: in the cases stated in Section 3 (a), (b), and (c). From the time an Employer receives a profile, the Employer is an independent data controller, has the obligation to protect candidate data under the Personal Data Protection Law, and is responsible for its own data processing activities;
• Sharing with technical and operational service partners: only within the necessary scope, based on contracts containing data protection and confidentiality terms;
• Providing data at the request of competent state authorities in accordance with law;
• If CareerLink merges, consolidates, transfers, or reorganizes its business, personal data may be transferred to a successor entity with equivalent protection; CareerLink will notify users before the transfer takes effect;
• If a dispute arises between a user and an Employer, CareerLink only provides related data with the data subject's consent or at the request of a competent authority.

6. Data Storage and Protection

• Personal data of job seekers and Employers on CareerLink.vn is stored and processed in Vietnam. Some non-personal data, including data related to job postings, may be stored or processed on other technical infrastructure for service operation. If any transfer of personal data outside Vietnam arises, CareerLink will complete all procedures and protection measures required by current law before making the transfer.
• CareerLink applies appropriate technical and organizational security measures (encryption, access controls, and system monitoring) to prevent unauthorized access, leakage, loss, or destruction of data;
• Retention period: personal data is retained while users maintain their accounts and use the services. When users complete account deletion or withdraw consent, personal data on CareerLink's system will be deleted or anonymized within the timeframe suitable for internal operational processes. However, application data already sent by users to Employers before account deletion or consent withdrawal may continue to be retained by Employers as independent data controllers for recruitment, dispute resolution, or legal obligations under current regulations.

7. Rights and Obligations of Data Subjects

Users have the following rights under the Personal Data Protection Law No. 91/2025/QH15:

• The right to know about the processing of their personal data;
• The right to consent or refuse consent; the right to withdraw consent;
• The right to access, view, and edit data; the right to request a copy of data;
• The right to request data deletion; the right to request restriction of or object to processing;
• The right to complain, denounce, or initiate lawsuits; the right to claim compensation for damage in accordance with law;
• The right to self-protection under civil law and related laws.

How to exercise rights: users may perform actions themselves in their account (see Section 11) or send a request to the contact point in Section 13. CareerLink verifies the requester's identity through the registered email, phone number, or other reasonable verification measures to protect the lawful rights and interests of the data subject. CareerLink responds within 72 hours for deletion/consent withdrawal requests and 07 working days for other requests.

8. Data Incident Notification

If a leakage, loss, or unauthorized access to personal data occurs, CareerLink will: (i) notify the specialized personal data protection authority within the timeframe prescribed by Decree 356/2025/ND-CP; (ii) notify affected users of the scope of the incident and measures users should take; and (iii) immediately apply measures to prevent, remedy, and mitigate damage.

9. Users Under 16

• CareerLink.vn services are intended for users aged 16 or older. When registering for and using the services, users confirm that they are at least 16 years old. CareerLink may apply appropriate measures to verify age in accordance with law;
• If CareerLink discovers that an account of a person under 16 was created without consent from a parent/guardian as required, CareerLink will temporarily lock and delete the account and related data after verification.

10. Cookies

• The website uses cookies to remember user preferences, improve experience, and optimize system performance;
• For non-essential cookies (analytics and advertising), CareerLink provides a tool allowing users to accept or reject them;
• Users may configure their browsers to reject or delete cookies at any time; this may affect some website features.

11. Editing Information and Deleting Account

• Users may edit personal information or delete their account at: MyCareerLink -> Settings -> Account -> Delete Account; or send a request to the contact point in Section 13;
• For data already received by Employers before deletion/consent withdrawal, the Employer is an independent data controller and is obligated to process data subject requests in accordance with the Personal Data Protection Law. CareerLink may assist in forwarding the data subject's request to the Employer that received the profile (if identifiable); however, processing the request remains the Employer's responsibility as an independent data controller.

12. Links to Other Websites

CareerLink.vn may contain links to third-party websites. When accessing these links, users leave our platform; CareerLink does not control and is not responsible for the content or privacy policies of those websites. Users should read each website's privacy policy before providing information.

13. Data Protection Department and Contact

Data controller: CareerLink Co., Ltd. - 270-272 Cong Hoa, Tan Binh Ward, Ho Chi Minh City.

Contact point for issues related to personal data protection:

CareerLink Co., Ltd. or the person designated by the Company to be in charge of personal data protection.

Email: contact@careerlink.vn - Phone: (028) 3813 0501.

For any questions, requests to exercise data subject rights, or complaints related to personal data, please contact the point above. CareerLink confirms receipt of the request within 02 (two) working days from the time a valid request is received.