Privacy Policy

This Information Privacy Policy (hereinafter referred to as the “Privacy Policy”) is issued by GSSP Company Limited, tax code: 0318103335, located at: 2nd Floor, Saigon Paragon Building, 3 Nguyen Luong Bang, Tan My Ward, Ho Chi Minh City, Vietnam (hereinafter referred to as “GSSP Company Limited (Công ty TNHH GSSP)”). This policy applies to any organization or individual, including but not limited to: End-users (cardholders), Customers/vendors/stores/businesses (card creators), Counter staff/Store managers (point accumulators) (hereinafter collectively referred to as “Users”) when accessing, registering, or using products and services on the website cardstra.com, the Cardstra App, or the Cardstra Staff App (which are loyalty card wallet platform applications operating on mobile devices, established, managed, and operated by GSSP Company Limited (Công ty TNHH GSSP)).

GSSP Company Limited (Công ty TNHH GSSP) recognizes the importance of the data and information (including Users' Personal Data) that Users have trusted and provided to GSSP Company Limited (Công ty TNHH GSSP) (“Confidential Information”) and believes that GSSP Company Limited (Công ty TNHH GSSP) has the responsibility to manage, protect, and process such Confidential Information appropriately. This Privacy Policy helps Users understand how GSSP Company Limited (Công ty TNHH GSSP) collects, uses, discloses, processes, and/or stores the Confidential Information provided, as well as to assist Users in making informed decisions before providing any Confidential Information to GSSP Company Limited (Công ty TNHH GSSP).

This Privacy Policy relates to the collection, processing, use, disclosure, and storage of Confidential Information by GSSP Company Limited (Công ty TNHH GSSP) and/or its subsidiaries, member units, dependent units, affiliates, managers, partners, employees, staff, or consultants of GSSP Company Limited (Công ty TNHH GSSP) (hereinafter collectively referred to as “Representatives”). Confidential Information includes information and data about Users that GSSP Company Limited (Công ty TNHH GSSP) holds or collects directly or indirectly from Users, or information collected through Users' access, registration, or provision/use of products and services on the website, Cardstra App, or Cardstra Staff App, or from other information and data sources in accordance with the law.

By accessing, registering, or using products and services on the website and/or the Cardstra App or Cardstra Staff App, Users acknowledge, accept, and agree to the provisions of this Privacy Policy and hereby consent to and allow GSSP Company Limited (Công ty TNHH GSSP) and/or its Representatives to collect, process, use, disclose, and store Confidential Information as prescribed herein. If a User does not agree to allow GSSP Company Limited (Công ty TNHH GSSP) to collect, process, use, disclose, and store their Confidential Information as specified in this Privacy Policy, the User should not/stop using the products and services on GSSP Company Limited (Công ty TNHH GSSP)'s website, Cardstra App, or Cardstra Staff App.

In the event that a User withdraws their consent for GSSP Company Limited (Công ty TNHH GSSP) and/or its Representatives to collect, process, and use Confidential Information, or requests GSSP Company Limited (Công ty TNHH GSSP) and/or its Representatives to delete Confidential Information by sending a notice to GSSP Company Limited (Công ty TNHH GSSP), the User acknowledges and agrees that: such withdrawal shall not affect the lawfulness of any prior collection, use, or processing of Confidential Information based on the User's consent; and the Confidential Information will continue to be stored in accordance with applicable laws. Furthermore, if a User refuses to provide or provides incomplete or inaccurate information as requested or fails to comply with legal obligations, GSSP Company Limited (Công ty TNHH GSSP) may be unable to provide the User with full products and services of the declared quality.

Users agree not to provide GSSP Company Limited (Công ty TNHH GSSP) and its Representatives with any inaccurate or misleading information and agree to notify GSSP Company Limited (Công ty TNHH GSSP) of any inaccuracies or changes in their information.

Users should be aware that the internet is not a secure form of communication, and all risks associated with sending and receiving information via the internet include the risk of unauthorized access and interference by third parties. Information transmitted via the internet may have to pass through many countries and territories (even when the sender and receiver reside in the same country or territory), including countries and territories where privacy and data protection laws are not as comprehensive as those in the User's country or territory of residence. GSSP Company Limited (Công ty TNHH GSSP) and its Representatives do not assume responsibility or liability for the privacy, security, or integrity of Users' Confidential Information when such data is transmitted via the internet.

The consent and withdrawal of consent regarding the collection, processing, use, and storage of Confidential Information that constitutes User Personal Data shall be carried out in accordance with the Personal Data Protection Law.

GSSP Company Limited (Công ty TNHH GSSP) commits to complying with the following principles during the collection, processing, use, and disclosure of Confidential Information:

• a) Confidential Information is processed lawfully, fairly, transparently, and in accordance with applicable laws.
• b) Appropriate technical and organizational measures are applied in accordance with applicable laws to ensure the security of Confidential Information at an appropriate level, including protection against unauthorized or illegal access and accidental destruction, loss, or damage.

In addition to the above, GSSP Company Limited (Công ty TNHH GSSP) commits to complying with other principles prescribed by law regarding the protection of Confidential Information, especially regulations related to the rights of the owner of the Confidential Information.

GSSP Company Limited (Công ty TNHH GSSP) collects User Confidential Information from various sources. GSSP Company Limited (Công ty TNHH GSSP) may collect, link, and combine User Confidential Information to create the best conditions for Users to provide/use products and services on the website cardstra.com, Cardstra App, or Cardstra Staff App.

Information collected by GSSP Company Limited (Công ty TNHH GSSP):

• a) Basic Personal Data: Surname, middle name, and birth name; other names (if any); Date of birth; Gender; Address; Phone number; Email address; Occupation, workplace; Tax code.
• b) Documentation/Requests: Information from files, declarations, or registrations required by GSSP Company Limited (Công ty TNHH GSSP) for the User to be eligible to provide/use GSSP Company Limited (Công ty TNHH GSSP)'s products and services.
• c) Payment Card Information: Credit or debit card details such as cardholder name, card number, expiration date, and security code.
• d) Social Media Information: Depending on the settings of the social network the User uses, GSSP Company Limited (Công ty TNHH GSSP) may receive information (aliases, images, videos, posts, etc.) from social network providers when the User uses a social media account to connect, participate, or register for access to the website/Cardstra App or Cardstra Staff App.
• e) Program-specific Information: Information provided by Users through programs or events where they agree to declare and provide information to GSSP Company Limited (Công ty TNHH GSSP)/Representatives.
• f) Transaction Information: Details of transactions (time, location, distance, point addition/deductions, etc.).
• g) Payment Information: Details regarding payments (amount, method, time, etc.).
• h) Feedback: Ratings and comments regarding the provision/use of services.
• i) Location: The User's geographical location.
• j) Device Information: Information about the configuration, software, hardware, etc., of the device used to access the website and/or Cardstra App or Cardstra Staff App.
• k) Communications and Logs: Interactions and feedback between the User and GSSP Company Limited (Công ty TNHH GSSP) or partners providing services/goods alongside GSSP Company Limited (Công ty TNHH GSSP), including but not limited to: Internet Protocol (IP) address, operating system, browser type of computer/mobile device, mobile device type, device characteristics, unique device identifier (UDID), or mobile equipment identifier (MEID), pages visited on the website/Apps, and access times.
• l) Information from other sources: In accordance with legal regulations on Confidential Information protection, including but not limited to:
  • (i) From third parties authorized to provide or disclose the User's Confidential Information;
  • (ii) From publicly available data sources;
  • (iii) From competent state authorities;
  • (iv) From member units, dependent units, affiliates, partners, or other service providers of GSSP Company Limited (Công ty TNHH GSSP).

To the extent permitted by law, GSSP Company Limited (Công ty TNHH GSSP) may record (audio/video) and monitor electronic communications between Users and GSSP Company Limited (Công ty TNHH GSSP) to ensure compliance with legal obligations, management, and internal policies for the purpose of collecting Confidential Information.

1. Provision of Products and Services:

• a) Processing requests for products and services.
• b) Providing products and services as requested and maintaining the relationship between the User and GSSP Company Limited (Công ty TNHH GSSP).
• c) Assessing eligibility when Users register or provide/use products and services.
• d) Analysis and statistics, including behavioral and profile analysis.
• e) Establishing, continuing, and managing the relationship with Users and accounts.
• f) Conducting market research and surveys to improve products and services.
• g) Providing promotional programs and loyalty programs.
• h) Proposing, obtaining, providing, facilitating, or maintaining insurance or financial solutions.
• i) Introduction of value-added products and services by GSSP Company Limited (Công ty TNHH GSSP)/Member units or Partners.

2. Loyalty Programs:

GSSP Company Limited (Công ty TNHH GSSP) uses Confidential Information to: (i) update information on new policies and regulations of loyalty programs, (ii) send membership incentives and promotions, (iii) contact Users to resolve requests, (iv) provide requested membership services, (v) manage and analyze membership data to provide appropriate policies, and (vi) receive feedback and complaints to improve service quality.

3. Accounting and Tax Compliance:

GSSP Company Limited (Công ty TNHH GSSP) collects, stores, and uses Confidential Information for internal business purposes such as record-keeping and compliance with legal obligations regarding accounting, sales invoices, and taxes under current laws.

4. Customer Support:

GSSP Company Limited (Công ty TNHH GSSP) uses Confidential Information for: (i) receiving feedback and complaints to improve quality, (ii) contacting Users to resolve requests, (iii) statistical analysis to develop services and incentives, (iv) providing faster support and improving website/App content and design, (v) conducting satisfaction surveys, and (vi) resolving User complaints.

5. Communication:

GSSP Company Limited (Công ty TNHH GSSP) uses Confidential Information to contact Users via: email, phone calls, SMS, post, or other forms of notification to provide services or in cases of necessity.

6. Direct Marketing:

For the purpose of marketing products and services of GSSP Company Limited (Công ty TNHH GSSP) and/or third parties (including but not limited to: partners, member units, sponsors, affiliates) which may be sold or promoted currently or in the future. GSSP Company Limited (Công ty TNHH GSSP) may contact Users via: email, phone calls, SMS, post, or other notification forms.

Note: If Users wish to unsubscribe from marketing processing, they can use the "unsubscribe" link in emails/messages or decline incoming calls.

7. R&D and Security:

Testing, research, and analysis to understand User preferences, protect Confidential Information, improve safety and security for products/Apps, and develop new features or financial/insurance solutions.

8. Legal and Safety Assurance:

Protecting Users and others by: (i) verifying identity, (ii) consulting with legal, financial, accounting, auditing, or insurance professionals, and (iii) sharing identification and related information with competent state authorities as required by law. Additionally, Confidential Information may be used in relation to corporate actions such as mergers, acquisitions, joint ventures, asset sales, restructuring, or financing.

9. Other Purposes:

• a) Maintaining and managing software updates and support.
• b) Preventing or investigating fraudulent, illegal, or wrongful acts, whether occurred or potential.
• c) Any other purpose that GSSP Company Limited (Công ty TNHH GSSP) notifies the User of at the time consent is required, or where GSSP Company Limited (Công ty TNHH GSSP) has strictly complied with applicable laws.

6.1. GSSP Company Limited (Công ty TNHH GSSP) will not provide or share User Confidential Information with any third party, except as provided in Clause 6.2 of this Article.

6.2. To perform the collection purposes stated in this Policy, GSSP Company Limited (Công ty TNHH GSSP) may share Confidential Information with:

• a) Member units, subsidiaries, branches, and collaborating individuals of GSSP Company Limited (Công ty TNHH GSSP) involved in providing services.
• b) Partners and marketing affiliates involved in providing products/services introduced or displayed on the website/Apps.
• c) Departments, officers, employees, and agents of GSSP Company Limited (Công ty TNHH GSSP) (e.g., payment processing, support, debt collection, background checks).
• d) Service providers: hosting/software providers, data analysts, legal consultants, auditors, and financial advisors.
• e) Organizations conducting joint programs or events with GSSP Company Limited (Công ty TNHH GSSP).
• f) Courts, specialized state management agencies (domestic and/or foreign), enforcement agencies, tax authorities, or other competent state agencies as required by law.
• g) Any organization or individual as required by applicable laws.

Cookies are small data files set on User devices when accessing the website/Apps or online advertisements. Cookies are used to recognize devices for:

• a) Determining if cookies are enabled to know if data can be collected.
• b) Storing access preferences so Users do not have to re-select them.
• c) Tracking visits to generate statistics on new and returning users and evaluate effectiveness.
• d) Temporarily storing access information for a better experience.
• e) Making the website/Apps more practical to User needs.
• f) Providing online advertisements and offers that interest the User.

Users can choose to "decline" cookies via browser/app settings. However, blocking essential cookies may cause some website/App functions to fail to work properly.

Users have the right to provide Confidential Information to GSSP Company Limited (Công ty TNHH GSSP) and may change that decision at any time.

Users have the right to check, update, adjust, or cancel their Confidential Information by:

• Logging into their account on the website/App (if available) to edit information.
• Requesting access, correction, restriction, or cancellation of processing (unless law prohibits cancellation).
• Sending inquiries or complaints to GSSP Company Limited (Công ty TNHH GSSP) using the contact information in Article 11.

GSSP Company Limited (Công ty TNHH GSSP) will store Confidential Information until the User requests its cancellation, deletion, or blocking, unless current law permits or requires a longer storage period (permanent or defined term). GSSP Company Limited (Công ty TNHH GSSP) will comply with legal storage obligations accordingly.

This Privacy Policy does not apply to third-party linked websites and applications where online advertisements for GSSP Company Limited (Công ty TNHH GSSP) are placed, or to third-party websites and applications that GSSP Company Limited (Công ty TNHH GSSP) does not operate or control.

Information of the unit collecting and managing Confidential Information:

This Policy is applicable from the date of issuance: March 18, 2026.

GSSP Company Limited (Công ty TNHH GSSP) reserves the right to adjust, amend, supplement, or terminate parts of this Privacy Policy at any time by publishing the changes on the website https://cardstra.com and/or the Cardstra Apps prior to application. Continued access, registration, or use of products and services after such changes are published constitutes User acceptance of the modifications. Users are encouraged to regularly visit the website/Apps for updates.

The original version of this Information Privacy Policy is presented in Vietnamese. In the event of any conflict between the Vietnamese version and other language versions, the Vietnamese version shall prevail.