Canon

PRIVACY POLICIES & NOTICES

Canon Vietnam Co., Ltd understands that privacy is important to you.

Canon Vietnam Co., Ltd (hereinafter referred to as “Company”, “Canon Vietnam”, “We”) commit to conform to current laws and regulations in protecting personal data and we want you to trust that Company treat your privacy thoroughly with the utmost care and respect.

Thereby, this privacy policies & notices (“Notices”) covers our purposes and the collection, use, disclosure, store (“Processing”) of your personal data when having business/ interacting with us, in your capacity as visitors, business partners or other persons whom are non-employees of Company (“Outsiders”).

1. PURPOSES OF PERSONAL DATA PROCESSING

We only collect and process your personal data for limited and appropriate purposes, in compliance with law and regulation. In this manner, your personal data is handled as following main objectives:

- To maintain safety and security of Canon Vietnam;

- To authenticate the identity of individual having business/ interacting with us and support you accordingly;

- To manage our business needs on day-to-day basis to ensure the stability, efficiency and lawfulness of Company’s operation;

- To ensure rights of owner of personal data and consider legitimate interests of the Company;

- To manage the compliance with legal obligations, regulations and audit activities of the Company (external and internal).

2. COLLECTION OF PERSONAL DATA

2.1. Sources of personal data collection

We collect personal data from a variety of sources, including:

- Personal data you give us directly when visiting our premises or in other direct interacting occasions (websites, social networking pages, etc.);

- Personal data we collect automatically, such as surveillance camera record, telephone transcript, cookies, etc.;

- Personal data we collect from other sources, including but not limited to authorities, government agencies, third-party platforms.

We may ask you to provide your personal data if you are in contact with us but not require you to do so. However, should you choose not to deliver the personal data, we may perhaps limit your accessibility or refuse to perform related activities.

2.2. Types of collected personal data

The personal data we collect including but not limited to:

- Personal information:

• Last name, middle name and first name, other names (if any);

• Gender;

• Date of birth, place of birth, nationality;

• ID card, equivalent passport, other documents issued by a government agency to identify an individual;

• Personal image, biometric or biological characteristics (i.e.: fingerprint data, iris recognition data and face recognition data, etc.);

• Marital status;

- Contact information:

• Address, place of permanent residence, place of temporary residence, current place of residence;

• Phone number, email, account ID;

Digital information:

Digital accounts in online platforms, information reflecting activities and history in cyberspace, IP address, cookies.

Depending on our purposes in particularly circumstances, we may ask you to provide some or all personal data mentioned above.

For your information, if you agree and provide us your requested personal data, it is considered that you are aware of all relevant issues and give us permission to process your personal data.

3. PERSONAL DATA PROCESSING

3.1. Uses made of your personal data

The basis of personal data processing is compatible with its purposes.

Purposes of using personal data	Grounds/ Legal basis for processing
- To authenticate your identity and register when visiting the Company - To ensure safety and security of people, properties and the Company in general and prevent criminal and scam by recording images, sounds, videos of people under surveillance cameras inside and around premises of Canon Vietnam - To record information of candidate and help them follow recruitment procedure of the Company - To confirm information and support contacting person accordingly - To perform social activities and other actions - To comply with regulations and internal/ external audit activities - To manage and operate the business activities	• Legal obligations • Our legitimate interests • With your consent (when required) • Our necessity to conduct business in a responsible manner and in line with local laws and regulations
- To perform a contract or take pre-contractual steps - To comply with law and regulations and rules - To perform other activities according to decision of our authorized person	• Legal obligations • Basis of contract • Our necessity to conduct business in a responsible manner and in line with local laws and regulations

If owner of personal data is 7-year old child and above, we commit to process on their personal data only when having consent of the child and their father, mother or legitimate guardian of the child.

3.2. Store of your personal data

Personal data processing is commenced as your consent since you deliver us the personal data. Your personal data is retained for as long as necessary for purposes described in this Privacy notice or as law requires us to.

When the personal data we hold is no longer required in accordance to law and regulation, business needs or purposes of collecting and processing personal data are archived, we will delete it or anonymize it securely. In case you withdraw your consent of personal data processing, we will delete your personal data in appropriate period after receiving your request of withdraw, unless prescribed by law.

3.3. Disclosure of your personal data

As part of a global business or under the contract requirements, we may share, disclose and transfer (domestic or oversea) your personal data within Canon Group and with our trusted third-party organizations with your consent and in compliance with law and regulation:

- Companies in Canon Group, your personal data is possibly disclosed, transferred to and used by Canon Group in essence business and operation purposes;

- Service providers, including external vendors who do business for the Company. Vendors and their selected employees are only allowed to access and use your personal data on our behalf for the specific requested tasks according to our instruction. All service providers are required to keep your personal data confidential and secure;

- Other third-parties related to our business but not considered as vendors, which can be analytics companies, persons authorized to audit activities and business operations of the Company, etc.;

- Government, relevant authorities and law enforcement agencies for legal reasons in some specific cases as below:

• In compliance with legal obligation;

• As requirement of applicable law and authorities;

• In respect of legitimate rights, interests and security of you, the Company, the third-parties or public;

• Other significant cases.

In any circumstances, Canon Vietnam will make every reasonable effort to protect your personal data by appropriate security system to which data can be accessed by authorized persons in order to minimize the possibility of illegally access, leakage or other data violations.

4. DATA SUBJECT RIGHTS

When collecting and processing personal data of subjects, in addition to complying with our legal obligations, we always recognize and respect the legal rights and interests of the data subject.

According to Vietnamese law, you have the following rights:

- Right to be informed: You have the right to be informed fully and clearly about your personal data processing, including information about the processing purposes; data type; method; undesirable consequences and damage that may occur; processing time; information of relevant organizations and individuals.

- Right to give consent: You can consent or not consent to the processing of your personal data. With your consent, we have the right to process your personal data in accordance with the information you have already been informed.

- In some special cases as prescribed by law, in order to ensure the rights of you and other related subjects, we may process your data without your consent.

- Right to access: You the right to access to look at, correct or ask to correct your personal data.

- Right to withdraw consent: You have the right to withdraw your consent. However, this action will not affect the legality of the data processing that has been conducted by us before. When we receive your request, we will notify you of possible consequences and damages. After receiving your request to withdraw consent, we will stop processing your personal data and ask other relevant parties to do so.

- Right to delete personal data: You can delete or request us to delete your personal data.

- Right to restrict data processing: You can require to restrict the part or all your personal data processing.

- Right to provide data: You can require us to provide your personal data. You can to come or authorize others to visit our headquarters to request data. In our jurisdiction, we will notify the appropriate request resolution.

- Right to object to data processing: You can object to the processing of your personal data to prevent or limit the disclosure of personal data or use for advertising and marketing purposes.

- Right to complain, denounce, sue: You have the right to complain, denounce or sue to competent authorities when detecting any violations in the data processing.

- Right to claim damages: You have the right to claim damages in accordance with the law when there are violations against regulations on protection of your personal data

- Right to self-protection: in addition to the above basic rights, you have other related rights to protect your own rights according to the provisions of Vietnamese law.

Note that, there may be situations as prescribed by law that we are entitled to deny or restrict your privacy rights in order to promptly ensure your interests, interest of the Nation and public or other subjects (if any); or in the event that your request has no legal basis. We always try to deal with your requests legally and quickly. As mentioned, you have the right to complain to us if you think the decision is unreasonable.

5. RECEIVING FEEDBACK AND COMPLAINTS

From this notice, we have provided information about the relevant rights and obligations of you and the Company in the personal data processing. If you have any questions or concerns regarding this Privacy Notice or our data processing, or if you would like to make the complaint about a possible breach, please contact us at information below:

- Canon Vietnam Company Limited - Headquarters

• Lot A1, Thang Long Industrial Park, Kim Chung Commune, Dong Anh District, Hanoi City, Vietnam

• Phone: 024 3881 2111

- Canon Vietnam Company Limited - Que Vo factory

• Lot B1, Que Vo Industrial Park, Van Duong ward, Bac Ninh City, Bac Ninh Province, Vietnam

• Phone: 022 2362 2111

- Canon Vietnam Company Limited - Tien Son factory

• No. 12, TS10 str. Tien Son Industrial Park, Hoan Son Commune, Tien Du District, Bac Ninh Province, Vietnam

• Phone: 022 2371 2111

6. UPDATE NOTIFICATIONS

This notice is part of the Personal Data Protection Regulation issued by Canon Vietnam dated 14 August 2023. We may change the content of this notice if there is any change in Company regulations or legal regulations. In that case, the 'last updated' date at the bottom of this page will also change.

Last updated on 14 August 2023.

Issued and approved by

CANON VIETNAM CO., LTD.

SHIGEYUKI OKAMOTO

General Director