ARTICLE 

1. ABOUT PV GAS

 1.1. PetroVietnam Gas Joint Stock Corporation (Vietnamese name: Tổng Công ty Khí Việt Nam – Công ty Cổ phần) is an enterprise established and operating under the laws of Vietnam, enterprise code 3500102710, with its head office at PV Gas Tower, 673 Nguyen Huu Tho Street, Phuoc Kien Commune, Nha Be District, Ho Chi Minh City, Vietnam, and its shares listed on the Ho Chi Minh City Stock Exchange under the ticker GAS (hereinafter “PV GAS”).

 1.2. PV GAS respects privacy and is committed to protecting the personal data of Data Subjects in accordance with Vietnamese law.

 1.3. This Personal Data Protection Policy (hereinafter the “Policy”) is developed on the basis of:

   a. The 2013 Constitution of the Socialist Republic of Vietnam;

   b. The 2015 Civil Code;

   c. Law on Personal Data Protection No. 91/2025/QH15 (effective from 01/01/2026);

   d. Decree No. 356/2025/ND-CP dated 31/12/2025 of the Government detailing a number of articles and measures to implement the Law on Personal Data Protection (replacing Decree No. 13/2023/ND-CP);

   e. The 2015 Law on Network Information Security; the 2018 Law on Cybersecurity and their guiding documents;

   f. Law on Data No. 60/2024/QH15;

   g. The 2023 Law on Electronic Transactions;

   h. The 2023 Law on Protection of Consumers’ Rights;

   i. The Law on Securities and regulations on information disclosure by public companies;

   j. Other relevant laws and regulations in effect from time to time.

 1.4. This Policy also serves as PV GAS’s Notice of personal data processing under the Law on Personal Data Protection and Decree No. 356/2025/ND-CP, and is published before PV GAS processes personal data. Where the law requires a separate notice for a specific processing activity, PV GAS will issue a supplementary notice for that activity.

ARTICLE 2. DEFINITIONS

In this Policy, the following terms are construed as follows:

 2.1. “Personal data” means information in the form of symbols, letters, numbers, images, sounds or similar forms in the electronic environment that is associated with a specific individual or helps identify a specific individual. Personal data includes basic personal data and sensitive personal data.

 2.2. “Basic personal data” and “Sensitive personal data” are determined according to the lists prescribed in Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. The specific lists currently applied are referenced by PV GAS in Appendix 01 of this Policy and are updated when the law changes.

 2.3. “Data Subject” means the individual to whom the personal data relates.

 2.4. “Processing of personal data” means one or more operations performed on personal data, including collection, recording, analysis, verification, storage, modification, disclosure, combination, access, retrieval, recall, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction of personal data or other related actions.

 2.5. “Personal Data Controller” means an organization or individual that determines the purposes and means of processing personal data. For the activities described in this Policy, PV GAS is the Personal Data Controller; in certain activities, PV GAS is both the Controller and the Processor of personal data.

 2.6. “Personal Data Processor” means an organization or individual that processes data on behalf of the Personal Data Controller under a contract or agreement with the Personal Data Controller.

 2.7. “Third Party” means an organization or individual other than the Data Subject, the Personal Data Controller and the Personal Data Processor that is permitted to process personal data.

 2.8. “Consent” means a clear, voluntary and affirmative indication by the Data Subject allowing PV GAS to process his or her personal data, given through a proactive and verifiable action.

 2.9. “Interaction Channels” means the channels provided by PV GAS for Data Subjects to access, transact or interact with PV GAS, including but not limited to: the website www.pvgas.com.vn and its subdomains, the shareholder portal, email, hotline, online forms, contracts and transaction documents, events organized by PV GAS, and access control systems at PV GAS’s premises and facilities.

 2.10. “Specialized Personal Data Protection Agency” means the competent state agency as prescribed by law, currently the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.

ARTICLE 3. SCOPE OF APPLICATION

 3.1. This Policy applies to the following groups of Data Subjects:

   a. Visitors and users of PV GAS’s website and online Interaction Channels;

   b. Shareholders, investors and authorized representatives of shareholders in their relationship with PV GAS;

   c. Individual customers; representatives and contact persons of corporate customers;

   d. Individual suppliers and partners; representatives and contact persons of corporate suppliers and partners;

   e. Candidates participating in recruitment at PV GAS;

   f. Guests visiting or working at PV GAS’s head office, units and gas facilities;

   g. Other individuals whose personal data is processed by PV GAS in the course of its operations.

 3.2. This Policy applies to the processing of personal data carried out by PV GAS and its affiliated units. PV GAS’s member units and subsidiaries may issue their own policies suited to their specific operations, but may not set a lower level of protection than this Policy.

 3.3. This Policy does not apply to third-party websites, applications or services that Data Subjects access via links placed on PV GAS’s Interaction Channels. Data Subjects should refer to the respective policies of those parties.

 3.4. The processing of personal data of PV GAS employees is governed by separate internal regulations on personal data protection in labor relations, in accordance with the Law on Personal Data Protection and labor law.

ARTICLE 4. PRINCIPLES AND COMMITMENTS ON PERSONAL DATA PROTECTION

  4.1. PV GAS commits to the following principles when processing personal data:

    a. Lawfulness, fairness and transparency: personal data is processed only in accordance with the law; Data Subjects are informed of processing activities relating to their data.

   b. Purpose limitation: personal data is processed only for the purposes registered and declared in Article 6 of this Policy. If a new purpose arises, PV GAS will notify the Data Subject and obtain consent again before processing.

   c. Data minimization: only personal data that is appropriate and necessary to achieve the declared purposes is collected.

   d. Accuracy: personal data is updated and supplemented when necessary; inaccurate data is corrected or deleted promptly.

   e. Security: managerial and technical measures are applied to protect personal data against loss, destruction, unauthorized access, disclosure or use.

   f. Storage limitation: personal data is retained only for a period appropriate to the processing purpose, unless otherwise provided by law.

  g. Accountability: PV GAS establishes and keeps records of personal data processing activities and is responsible for demonstrating compliance.

 4.2. PV GAS commits not to:

   a. Buy or sell personal data in any form;

   b. Process personal data beyond the declared purposes without consent or another legal basis;

   c. Use Data Subjects’ personal data for advertising or direct marketing without their separate consent for that purpose;

   d. Make fully automated decisions that affect the lawful rights and interests of Data Subjects without human review;

   e. Require Data Subjects to provide images or videos containing identity documents as an authentication factor on public online channels.

 4.3. PV GAS requires Personal Data Processors and Third Parties receiving data to maintain an equivalent level of protection through binding clauses in contracts or personal data processing agreements.

ARTICLE 5. TYPES OF PERSONAL DATA PROCESSED

 5.1. Depending on the group of Data Subjects and the Interaction Channel, PV GAS processes the following types of personal data:

   a. Identification and contact data

Surname, middle name and given name; date of birth; gender; nationality; personal identification number or identity document number; contact address; telephone number; email address; job title and workplace.

   b. Data generated when accessing online Interaction Channels

IP address; device and operating system information, browser type and version; language and time zone; pages visited, time and duration of visits, referring URLs; cookie data and browser local storage; technical data generated by anti-bot verification systems.

   c. Interaction content data

Content of requests, questions, feedback and complaints sent by Data Subjects to PV GAS; attachments uploaded by Data Subjects; content of email correspondence; recordings of calls to PV GAS’s hotline where callers have been notified in advance.

   d. Data relating to shareholder relations

Full name, identity document number, securities account number, number of shares held, contact address, information on authorized representatives, data on registration for and attendance at General Meetings of Shareholders, and voting data.

   e. Data relating to recruitment

Candidate files including curriculum vitae, educational background, work experience, certificates, contact information, interview results and assessments.

   f. Data relating to site safety and security

Registration data for entry to the head office, units and gas facilities; images and video data from closed-circuit television (CCTV) systems in areas with surveillance notices.

   g. Data relating to transactions and contracts

Information on representatives, contact persons and signatories; payment account information for contract performance; records and documents arising in the course of transactions.

 5.2. Sensitive personal data. PV GAS’s website and online forms are not designed to collect sensitive personal data. PV GAS processes sensitive personal data only where truly necessary, with a clear legal basis and the separate consent of the Data Subject, together with a notice that the data being processed is sensitive. Data Subjects are advised not to include sensitive personal data in online forms.

 5.3. The actual scope of data processed for each Data Subject is limited to the types of data necessary for the corresponding relationship and purpose, not the entire list in clause 5.1.

ARTICLE 6. PURPOSES OF PERSONAL DATA PROCESSING

 6.1. PV GAS processes personal data for the following purposes:

• Receiving, classifying, handling and responding to requests, questions, feedback and complaints sent via Interaction Channels
• Contacting the Data Subject to clarify or supplement information needed to handle requests
• Exercising shareholders’ rights, performing information disclosure obligations and other obligations of a public company
• Preparing, entering into and performing contracts and transactions with customers, suppliers and partners
• Organizing recruitment, assessing and onboarding candidates
• Ensuring the safety and security of the head office, units and gas facilities; preventing, detecting and handling incidents and violations
• Ensuring information security and cybersecurity for PV GAS’s systems; detecting and preventing unauthorized access, cyberattacks, spam and fraud
• Compiling aggregate visit statistics and analyses to improve content and user experience on online Interaction Channels
• Providing information on PV GAS’s activities upon the Data Subject’s subscription
• Preparing and keeping records and documents; resolving disputes; complying with lawful requests of competent state agencies

 6.2. If a new processing purpose not covered by clause 6.1 arises, PV GAS will notify Data Subjects via Interaction Channels and will process the data only after obtaining consent, except where the law permits processing without consent.

 6.3. PV GAS does not use open-ended clauses such as “other purposes as required by operations” as a basis for processing personal data. All processing purposes must be specifically stated in this Policy or in a supplementary notice.

ARTICLE 7. METHODS OF COLLECTING AND PROCESSING PERSONAL DATA

 7.1. PV GAS collects personal data from the following sources:

   a. Directly from Data Subjects: via online forms, email, hotline, written documents, contracts, registration forms, application files, site access registration procedures and events organized by PV GAS.

   b. Automatically when Data Subjects use online Interaction Channels: via system activity logs, cookies and similar technologies, anti-bot verification systems, and CCTV systems in areas with surveillance notices.

  c. Lawfully from other organizations and individuals: from the organization for which the Data Subject is a representative or contact person; from securities depository and registration organizations and depository members in shareholder management; from PV GAS’s member units, partners and service providers where such provision is lawful; from competent state agencies; from lawfully published sources.

 7.2. For personal data received from other organizations or individuals under point c, clause 7.1, PV GAS requires the provider to ensure a valid legal basis for the provision, including the Data Subject’s consent where required by law.

 7.3. Personal data is processed manually and automatically on PV GAS’s information systems, within the scope of the purposes in Article 6 and in accordance with internal access rights.

ARTICLE 8. CONSENT AND THE RIGHT TO WITHDRAW CONSENT

 8.1. For processing based on consent, the Data Subject’s consent must be expressed through a proactive and clear action, for example: ticking the consent box before submitting a form, or signing a written consent. Consent boxes must not be pre-ticked.

 8.2. Silence or non-response by the Data Subject is not considered consent.

 8.3. Consent is given for each specific purpose. Where there are several purposes, PV GAS lists them clearly so that the Data Subject can consent to one or more of them.

 8.4. PV GAS keeps records of consent, including: the identity of the Data Subject, the time of consent, the content and version of the Policy consented to, and the method of expressing consent, to ensure verifiability in accordance with Decree No. 356/2025/ND-CP.

 8.5. Data Subjects have the right to withdraw consent at any time by letter or email sent to the contact point in Article 17. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

 8.6. Upon receiving a request to withdraw consent, PV GAS stops processing personal data for the corresponding purpose, unless the law requires continued retention or processing. PV GAS informs the Data Subject of the possible consequences, including the possibility that submitted requests can no longer be processed or that part of the services can no longer be provided.

ARTICLE 9. ORGANIZATIONS AND INDIVIDUALS INVOLVED IN PERSONAL DATA PROCESSING

 9.1. Within PV GAS. Personal data is transferred only to units, departments and employees who are authorized and need to process it according to their functions, on the principle of role-based access.

9.2. Organizations and individuals receiving personal data.

• Units operating and administering information systems, server infrastructure and data backup to maintain operations, carry out maintenance and remedy system incidents
• Providers of system protection services, content delivery networks and anti-bot services to ensure information security and cybersecurity
• Providers of email, hotline and cloud storage services
• Securities depository and registration organizations; units supporting the organization of General Meetings of Shareholders; auditors, for the performance of obligations to shareholders and of a public company
• Legal advisers and dispute resolution bodies, to protect the lawful rights and interests of the parties
• Competent state agencies upon lawful written request in accordance with the law

 9.3. All organizations and individuals receiving personal data under clause 10.2 must: sign a confidentiality undertaking; process the data only within the scope and according to PV GAS’s instructions; not use it for their own purposes; apply equivalent protection measures; and delete or return the data upon termination of the contract.

 9.4. Transfer of personal data abroad. Certain technical services supporting the operation of online Interaction Channels (content delivery networks, anti-bot services, email, cloud storage) may process data on infrastructure located outside Vietnam. In such cases, PV GAS will:

   a. Prepare and keep a Cross-border Personal Data Transfer Impact Assessment Dossier in the form prescribed by Decree No. 356/2025/ND-CP;

   b. Submit the dossier to the Specialized Personal Data Protection Agency within the time limit prescribed by law;

   c. Sign a legally binding agreement with the overseas data recipient, including commitments to protect the rights of Vietnamese Data Subjects;

   d. Carry out change notification procedures when there are changes in the receiving partner, the purpose of transfer or the types of data transferred.

 9.5. PV GAS prepares and updates the Personal Data Processing Impact Assessment Dossier in accordance with Decree No. 356/2025/ND-CP and keeps it at PV GAS for inspection by competent authorities.

ARTICLE 10. PERSONAL DATA PROTECTION MEASURES

10.1. Managerial measures

   a. Issuing internal regulations on personal data protection; assigning departments and personnel for personal data protection who meet the requirements of Decree No. 356/2025/ND-CP;

   b. Role-based access control; reviewing and revoking access rights periodically and upon personnel changes;

   c. Binding confidentiality obligations in employment contracts and contracts with suppliers and partners;

   d. Training and raising awareness for employees with access to personal data;

   e. Periodic internal inspection and assessment of compliance with personal data protection.

10.2. Technical measures

   a. Encrypting transmission with the HTTPS/TLS protocol across all online Interaction Channels;

   b. Multi-factor authentication for accounts accessing the content management system and systems containing personal data;

   c. Recording and keeping audit logs of access to and operations on data for tracing and incident investigation;

   d. Regular backups and testing of data recoverability;

   e. Vulnerability scanning and security patching; information security testing and assessment before systems go live and periodically during operation;

   f. Measures to protect systems against cyberattacks, automated access and spam.

10.3. Physical measures

Controlling access to server rooms and paper record storage areas; managing storage devices; securely destroying records and devices containing personal data upon disposal.

ARTICLE 11. PROCESSING OF PERSONAL DATA IN CERTAIN SPECIAL CASES

 11.1. Personal data of children. PV GAS’s online Interaction Channels are not directed at persons under 16 years of age. PV GAS does not knowingly collect personal data of persons under 16. Before processing children’s personal data where necessary, PV GAS verifies age and obtains the consent of children aged 7 or older and of their parents or guardians as prescribed by law. If it is found that children’s personal data has been collected without a lawful basis, PV GAS will delete such data within 72 hours of the determination.

 11.2. Personal data of persons declared missing or deceased. PV GAS processes the personal data of persons declared missing or deceased with the consent of the relevant persons as prescribed by law, unless otherwise provided by law.

 11.3. CCTV systems. Images and video data from CCTV systems at PV GAS’s head office, units and gas facilities are used for the following purposes: ensuring the security and safety of facilities and employees; preventing and detecting intrusion, sabotage and violations of safety regulations; investigating and verifying incidents; and serving lawful requests of competent authorities. Monitored areas display notice signs. This data is not used to regularly assess or track individuals beyond the above purposes.

 11.4. Location data. PV GAS processes individuals’ location data only when necessary for operations, incident response and safety assurance, and with the Data Subject’s consent, unless otherwise provided by law. Location data is classified as sensitive personal data and is subject to corresponding protection measures, including separate breach notification obligations as prescribed.

 11.5. Biometric data. Where PV GAS applies access control systems using biometric data, processing is carried out only with the Data Subject’s separate consent, with a non-biometric alternative available, and with protection measures applicable to sensitive personal data.

 11.6. Processing on specific technology platforms. Where PV GAS processes personal data in big data, artificial intelligence or cloud computing activities, PV GAS complies with the specific personal data protection requirements for each field and technology prescribed in Decree No. 356/2025/ND-CP.

ARTICLE 12. RIGHTS AND OBLIGATIONS OF DATA SUBJECTS

 12.1. Rights of Data Subjects

• To be informed of the processing of their personal data, unless otherwise provided by law
• To consent or not consent to the processing of their personal data
• To access and request PV GAS to provide their personal data being processed, together with information on the types of data, processing purposes and recipients
• To withdraw consent at any time in accordance with Article 8 of this Policy
• To request correction of inaccurate or incomplete personal data
• To request deletion of their personal data in cases prescribed by law
• To request suspension or restriction of the processing of their personal data
• To request PV GAS to provide their personal data for their own use or for transfer to another organization under conditions prescribed by law
• To object to processing in order to prevent or restrict the disclosure or use of personal data for advertising and marketing purposes
• To lodge complaints, denunciations and lawsuits in accordance with the law
• To claim compensation for damage where PV GAS violates personal data protection regulations and causes damage, unless otherwise agreed by the parties or provided by law
• To self-protect or request competent agencies and organizations to protect their rights

 12.2. Procedure for exercising rights

Step 1. The Data Subject sends a request to the contact point in Article 17 by email or letter, stating clearly: full name and contact details used when providing the data; the right to be exercised; and the specific content of the request.

Step 2. PV GAS verifies the identity of the requester to ensure that data is not disclosed to unauthorized persons, and may ask for additional information for verification.

Step 3. PV GAS responds within the time limit prescribed by law, no later than 72 hours from receipt of a valid request. Where a complex request requires more time, PV GAS will notify the reason and the expected time frame.

Step 4. If a request is refused, PV GAS will reply in writing, stating the legal grounds and providing guidance on how to file a complaint.

 12.3. No fee is charged for exercising the rights in clause 14.1.

 12.4. Cases where rights may be restricted. The rights of Data Subjects may be restricted as prescribed by law, for example: to protect national security, social order and safety; to enforce judgments and decisions of competent authorities; to fulfil statutory retention obligations; or where exercising the right would affect the lawful rights and interests of others.

 12.5. Obligations of Data Subjects

   a. To protect their own personal data and request other organizations and individuals to protect their personal data;

   b. To provide truthful, accurate information and update it when changes occur;

   c. When providing the personal data of others (representatives, contact persons, dependants), to ensure that the lawful consent of such persons has been obtained and that they are informed of this Policy;

   d. To respect and not infringe upon the personal data of others;

   e. Not to include their own or others’ sensitive personal data in online forms when unnecessary;

   f. To keep login credentials and one-time passwords (OTP) confidential for Interaction Channels with accounts, and to log out after use.

ARTICLE 13. POSSIBLE UNDESIRED CONSEQUENCES AND DAMAGE

 13.1. PV GAS applies the protection measures set out in Article 12 to a degree appropriate to legal requirements and practice. However, no information system is absolutely secure. Certain undesired consequences and damage may occur, including but not limited to:

   a. Hardware or software errors during processing leading to loss or distortion of personal data;

   b. Security vulnerabilities in third-party products or services beyond PV GAS’s control; system attacks leading to data leaks;

   c. Data leaks caused by the Data Subject disclosing login credentials or OTP codes, by the Data Subject’s device being compromised or infected with malware, or by fraud;

   d. Misuse of data by employees or third parties in breach of their undertakings and contrary to PV GAS’s instructions.

 13.2. PV GAS advises Data Subjects: do not share login credentials or OTP codes with anyone; check the official domain name before providing information; do not provide personal data through channels impersonating PV GAS.

 13.3. PV GAS is not liable for damage arising entirely from the fault of the Data Subject or from force majeure events as prescribed by law. This exemption does not exclude PV GAS’s liability for violations of personal data protection regulations caused by PV GAS.

ARTICLE 14. NOTIFICATION OF PERSONAL DATA BREACHES

 14.1. Upon detecting a violation of personal data protection regulations, PV GAS will:

   a. Contain, stop and remedy the incident immediately upon detection;

   b. Notify the Specialized Personal Data Protection Agency within 72 hours of detection, using the form and method prescribed by Decree No. 356/2025/ND-CP; if notification is made after 72 hours, the reason must be stated;

   c. Notify affected Data Subjects where the violation is likely to cause damage to their lawful rights and interests, stating the types of data affected, possible consequences, remedial measures and the contact point;

   d. Prepare minutes and keep incident records; analyze the causes and implement measures to prevent recurrence.

 14.2. For violations involving location data and biometric data, PV GAS will give notification in accordance with the specific provisions of Decree No. 356/2025/ND-CP.

ARTICLE 15. GENERAL PROVISIONS

 15.1. This Policy is publicly posted on PV GAS’s website.

 15.2. PV GAS may amend or supplement this Policy to reflect changes in the law or actual operations. New versions are published on the website with a version number and effective date. For changes that affect the rights of Data Subjects or expand processing purposes, PV GAS will give prior notice and obtain consent again where required by law.

 15.3. A Data Subject’s continued use of PV GAS’s Interaction Channels after the effective date of an amended version is deemed acknowledgement of the amendments. This does not replace separate consent for new processing purposes under clause 18.2.

 15.4. This Policy is governed by and construed in accordance with the laws of Vietnam.

 15.5. If one or more provisions of this Policy are declared invalid by a competent authority, the remaining provisions remain in full force and effect.

 15.6. In case of any discrepancy between this Policy and the personal data protection clauses of a contract signed between PV GAS and a Data Subject, the provision offering a higher level of protection to the Data Subject prevails.

 15.7. Any disputes arising shall preferably be resolved through negotiation and conciliation. If no agreement is reached, the dispute shall be brought before a competent Court in Vietnam.