Introduction
1.1 WMCLV is committed to safeguarding your personal data.
1.2 We value your right to privacy and strive to protect your personal data
in accordance with the Applicable Data Protection Law (as defined hereinafter).
1.3 In this Policy, we set forth how we collect your personal data, how and
for what purposes we may process your personal data and to whom your personal data may be
disclosed by us. Further, this Policy includes important information regarding your rights with
respect to our processing of your personal data. Therefore, we encourage you to read this Policy
very carefully.
1.4 We do not ask your consent to the processing of your personal data by
means of this Policy. As we will further clarify in this Policy, we have specific legal grounds
to process your personal data. In principle, we shall seek your consent for specific processing
activities required by us involving your personal data. Even if we have your consent, you may
choose to withdraw it at any time in accordance with this Policy and the Applicable Data
Protection Law.
1.5 In this Policy, the following terms shall have the meanings set out
below and cognate terms shall be constructed accordingly:
| "Applicable
Data Protection Law" |
means the legislation protecting the fundamental rights
and freedoms of individuals and, in particular, their right to privacy with respect
to the processing of personal data, including the GDPR and the PDPL; |
| "Data Subject" |
means an individual who is reflected by his/her personal
data; |
| "GDPR" |
means the Regulation (EU) 2016/679 of 27 April 2016 on
the protection of natural persons with regard to the Processing of Personal Data and
on the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation); |
| "PDPL" |
means the Law on Personal Data Protection and any law,
decree, circular and regulation of Vietnam on personal data; |
| "PDPO" |
means Personal Data Protection Officer who is an employee
of WMCLV who oversees WMCLV's personal data protection responsibilities and ensure
WMCLV's compliance with the PDPL; |
| "Websites" |
means (a) Wilmar CLV's applications; (b) Wilmar CLV's
official website; (c) Wilmar CLV's business pages on social media platforms (e.g.
Facebook page); or (d) websites of any Wilmar Group Entity which Wilmar CLV's
applications, official website or business pages on social media platforms redirect.
"Website" shall mean any of the aforementioned Websites; and |
| "Wilmar Group" |
means Wilmar International Limited and each of its
subsidiaries, and "Wilmar Group Entity" means any one of them. |
1.6 When we use "we", "us" or "our" in this Policy, we mean WMCLV.
1.7 This Policy applies to your personal data that we collect, use and
otherwise process regarding your relationship with us as a job applicant, business contact or
anyone who has an interest (for whatever reason) in WMCLV.
1.8 A reference to "Clause" or "Schedule" refer to a clause or schedule in
this Policy.
1.9 This Policy applies in conjunction with any other policies, notices,
contractual clauses and consent clauses that apply in relation to our processing of your
personal data.
1.10 We may revise this Policy from time to time without prior notice. The
latest version is available at https://www.pdpr.wilmar.com.vn.
1.11 Therefore, we encourage you to regularly review this Policy. You may
also ask us to send you a copy of the most recent version of this Policy at your cost.
1.12 We shall seek your consent for our processing of your personal data
for the purposes set out in this Policy. Depending on the specific circumstances, we may use
appropriate methods to obtain your consent. By giving your consent to allow us to process your
personal data, you acknowledge that your personal data will be processed in the manner as
described in this Policy.
1.13 Nonetheless, please note that we are allowed to process your personal
data without your consent in certain circumstances. Please refer to Clause 8.3 of this Policy.
Personal data is information, in the form of symbols, letters, numbers, images, sounds, or any
combination thereof, presented on digital environment or information in other forms that
identifies or helps identify a particular person. Personal data includes basic personal data and
sensitive personal data.
Whose personal data
do we process
3.1 We only process personal data that is relevant to our relationship with
you.
3.2 In the context of our businesses, we may process personal data relating
to our customers, suppliers, representatives of the authorities or non-governmental
organizations, or visitors of our Website. If your are a shareholder, director, corporate
officer, manager, employee or appointed contractor of any business entity, we may process your
personal data if it is relevant to our business relationship with you in that entity.
Types of personal
data
3.3 If you are a job applicant, your personal data that we may process
includes the following:
- personal particulars, including full name, gender, date of birth, nationality;
- contact information, including mailing address, telephone number, email address;
- education details and professional qualifications (e.g. name of schools / universities /
institutions / training academies, types of qualification, field of specialization,
education / training period, training certificates);
- employment details, including employment history (name of companies, position/title and
employment period), salary from previous employment, expected salary for the applied
position and information about your professional references);
- photograghs and other audio-visual information (e.g. your profile picture in the job
application/CV, audio-visual recordings of online job interview);
- personal opinions that you make known to us;
- marital status;
- information about family relationships and information about next-of-kin (such as parents,
spouse, children, siblings, etc.), including their full names, name of the companies in
which such next-of-kin have ownership interests, management authority, or are employed
together with their job positions (in cases where such next-of-kin have ownership interests,
management authority or are employed within the Wilmar Group companies); and
- any other personal data as may be expressly specified at the time we request for your
consent to our processing of such personal data.
3.4 If you are not a job applicant, the personal data we may collect from
you includes the following:
- personal particulars including full name, gender, date of birth, personal identification
number, passport number;
- contact information including address, telephone number, email address;
- photograghs and other audio-visual information;
- personal opinions that you make known to us; and
- any other personal data as may be expressly specified at the time we seek your consent to
our processing of such personal data.
3.5 The personal data we collect generally, when you browse our Websites,
includes the following:
- information about your use of our Websites, contact centres; and/or
- information about your device and your geographical location (e.g. your Internet Protocol
(IP) address or unique device identification).
4.1 We may collect personal data:
- directly from you;
- through third parties when they are duly authorized by you to process and provide your
personal data to us;
- from third party sources (e.g. your family members, government agencies, market research
organisations or publicly available resources such as telephone or business directories)
without your involvement; and/or
- through CCTV we use in and around our premises at our production facilities and offices or
other (monitoring) technologies.
4.2 Collection of personal data may be done in person when you meet our
staff or representatives, over the telephone, by email or through our Websites. To the extent
allowed under applicable law, we may also legally collect your personal data from third party
sources without directly involving you.
We processt personal data about you, when:
- you apply for a job with us;
- you seek and/or enter into any business relationship with us;
- you provide any services and/or goods to us;
- you visit our Websites;
- you seek access to our business premises;
- you participate in seminars, presentations, events organized by us;
- you contact us with feedback, queries or complaints; or
- you request us to send you information or notify you of developments in WMCLV via post,
emails or telephone calls.
6.1 Our key purpose in collecting your personal data is to process your job
application or your request, to proceed with any business relationship with you or to contact
you so as to provide you with information pertaining to WMCLV.
6.2 If you are not a job applicant, we collect and process your personal
data to:
- facilitate the business or contractual relationship between you and us and where applicable,
the performance of the contract between us;
- facilitate the performance of the provision and performance of services to us; or
- handle your requests, feedback, queries or complaints.
6.3 If you are a job applicant, we collect and process personal data to
evaluate and process your job application.
6.4 We also process your personal data for other purposes connected to or
relevant to our business, such as:
- complying with our legal and regulatory obligations and requirements; or
- accounting, risk management and record keeping.
6.5 Please refer to other specific cases regarding the types of personal
data we process and the purposes for which we process such personal data as set out in
Schedule 1 attached hereto. In the event that we need to process any personal data not
listed in this Policy and/or for purposes not specified herein, we shall clearly inform you at
the time we seek your consent.
7.1 Generally, we try to limit the circumstances where we would process
sensitive personal data. However, we still need to process certain sensitive personal data as
specified in Clause 7.2 below for relevant purposes as listed in Clause 6.
7.2 Your sensitive personal data that we may process includes the
following:
- Image of your national ID card, citizenship card or passport;
- Information about your location identified via location services; and/or
- Data monitoring your behavior and/or use of our Websites.
8.1 We will only process your personal data when we have a legal basis to
do so.
8.2 The following are our legal basis for processing your personal data:
- you work for a business entity with whom we have a business relationship or with whom we are
exploring a business relationship;
- you applied for a job with us and we have to use your personal data to assess and evaluate
your suitability for the job;
- you have explicitly consented to us using your information for any particular purpose; or
- we exercise our legitimate rights and obligations.
8.3 We are allowed by PDPL to process your personal data without your
consent in the following cases:
- To protect the life, health, honor, dignity, rights and lawful interests of you or others in
emergency circumstances; to reasonably protect the legitimate rights or interests of ours or
of others, or the interests of Vietnam or other countries against infringement of such
rights or interests. We are responsible for proving the existence of such circumstances;
- To respond to emergencies or threats to national security that have yet to escalate to the
level of a declared emergency; to prevent and combat riots, terrorism, crimes, and
violations of law;
- To serve the operations of governmental agencies or state management activities in
accordance with the laws;
- To implement your agreement with relevant authorities, organizations and individuals in
accordance with the laws; or
- Otherwise as stipulated by applicable laws and regulations, as may be amended from time to
time.
9.1 Your personal data will be collected by us and thereafter processed by
us, or processed by an organization or individual who processes personal data on our behalf
under a contract or agreement with us (as may be relevant).
9.2 If you are a job applicant, your personal data will be processed by us
and such personal data may thereafter be transferred and processed by the relevant Wilmar Group
Entity to the extent necessary.
10.1 Subject to provisions in this Clause 10, we shall keep secret and
strictly confidential by not disclosing or divulging to any person or to enabling or causing any
person besides you, without your consent, to become aware of the contents of your personal data.
10.2 Notwithstanding Clause 10.1, we may disclose your personal data to any
Wilmar Group Entity for business improvement purposes, purposes consistent with the purpose of
that collection and/or for any other purposes allowed under the Applicable Data Protection Law.
(a) For more details on the Wilmar Group, please visit Wilmar International Limited's
official Website at www.wilmar-international.com.
(b) We may, from time to time, disclose your personal data to any Wilmar Group Entity's
directors, officers, employees, agents and advisers, including accountants, legal counsels
and other advisers (it being understood that the persons to whom such disclosure is made
will be informed of the confidential nature of such information and instructed to keep such
information confidential) if such personal data is necessary to be disclosed to such persons
on a need-to-know basis.
10.3 Notwithstanding Clause 10.1, we may disclose information to you upon
you submitting a valid request in accordance with Clause 14.
Transfer of personal
data to third parties
10.4 Notwithstanding Clause 10.1, we may disclose or share your personal
data with the following third parties for the following purposes:
- third parties which provide products and services requested by you;
- our third-party service providers, such as our information technology (IT) systems
maintenance provider who perform services that may involve data processing;
- law firms and law courts, to prepare, apply or enforce any contract with you;
- accountants and auditors who maintain or are required to audit our financial records;
- bankers, credit reference agencies and anti-fraud screening service providers to process
payments or carry out fraud screening;
- law enforcement agencies to enforce our rights and protect our properties or to enforce any
of your regulatory obligations to any individual or organization;
- regulatory, governmental and tax authorities to comply with any legal or regulatory
obligations or industry requirements;
- requirement by applicable laws or regulations, including the Applicable Data Protection Law,
or by any subpoena or similar legal process; or
- your representatives (such as your lawyer or the executor, administrator or trustee of your
estate).
We will ensure that, where relevant, contractual safeguards are implemented to ensure the
protection of your personal data when we disclose your personal data to a third party.
10.5 We shall make reasonable efforts to ensure that your personal data is
accurate and complete before we transfer your personal data to any of the aforementioned
third-party.
Transfer of personal
data overseas
10.6 We shall ensure that the international transfer of your personal data
out of Vietnam shall comply with the Applicable Data Protection Law.
We agree and warrant that:
- we only provide your personal data to third parties when you have agreed for us to do so,
unless otherwise stipulated by applicable laws;
- we do not not sell your personal data to any third parties;
- your personal data has been received by us in accordance with the relevant provisions of the
Applicable Data Protection Law; and
- we will be processing your personal data in accodance with the Applicable Data Protection
Law and this Policy.
12.1 When we process your personal data, the processing activity is subject
to adequate technical and organisational security measures in order to safeguard your personal
data. Please contact our PDPO, details as set forth in Clause 20, if you would like to find out
more about the security measures that we have put in place.
12.2 These technical and organisational security measures are appropriate
to protect personal data against accidental or unlawful destruction or accidental loss,
alteration, unauthorised disclosure or access, in particular where the processing involves the
transmission of data over a network, and against all other unlawful forms of processing, and
that these measures ensure a level of security appropriate to the risks presented by the
processing, and the nature of the data to be protected having regard to the state of the art and
the cost of their implementation as per WMCLV IT's security policies.
Subject to Clause 14, we will retain your personal data for as long as necessary to fulfil the
purposes (such as those stated in Clause 6, Clause 7 and Schedule 1) for which it was collected,
or for any necessary legal purposes.
14.1 Right to know
You have the right to be made aware of the processing activities of your personal data, unless
otherwise stipulated by applicable laws.
14.2 Right of consent
You have the right to agree or disagree on the processing of your personal data or to give
partial or conditional consent, unless otherwise stipulated by Clause 8.3 of this Policy.
14.3 Right to view, modify and request for modification
(a) You have the right to view and modify, by yourself, your personal data that is in our
possession if any of such personal data is inaccurate or outdated.
(b) If you are not able to make such modification by yourself due to technical or any other
reasons, you have the right to request us to modify your personal data that is in our
possession if any of such personal data is inaccurate or outdated.
(c) Notwithstanding Clauses 14.3(a) and 14.3(b), you are responsible for ensuring the
accuracy of your personal data, and any modification of your personal data shall be carried
out solely on the basis of ensuring the accuracy of such data.
(d) We will respond to you within 2 working days upon receipt of your request to access and
modify your personal data or your request for modification of your personal data.
(i) If the implementation of your request is feasible, we shall implement your request
within 10 days (if the personal data processing is directly carried out by us) or 15
days (if the personal data processing involves our personal data processor or a third
party). Depending on the nature and level of complexity of the request, we may extend
the implementation period by up to an additional 10 days and shall notify you of the
reasons for such extension.
(ii) If the implementation of your request is not feasible, we shall notify you of the
reasons.
14.4 Right to request for withdrawal or restriction of consent; right to
object
(a) You have the right to request the withdrawal of your consent for our processing of your
personal data, to request a restriction on our processing of your personal data, or to
object to our processing of your personal data, when you have concerns regarding the scope
or purposes of such processing or the accuracy of your personal data held by us. Such
requests must be made in writing (either in hard-copy with wet ink signature or in
electronic form) and submitted to our PDPO with the contact details set out in this Policy.
(b) Please note that possible consequences and damages may occur when consent to us
processing your personal data is withdrawn.
(c) Notwithstanding Clause 14.4(a) above:
(i) any request to withdraw consent, restrict our processing of your personal data, or
written objection to our processing of your personal data shall not be applicable in the
cases specified in Clause 8.3 of this Policy or in other cases as provided by law; and
(ii) the exercise of your right to request for withdrawal of consent and the right to
request for restriction of personal data processing shall not be applicable to the
processing which has been carried out prior to the time you submit such request.
(d) We will respond to you within 2 working days upon receipt of your request to withdraw
consent / request to restrict our processing of your personal data / written objection to
our processing of your personal data.
(i) If the implementation of your request is feasible, we shall implement it within 15
days (if the personal data processing is directly carried out by us) or 20 days (if the
personal data processing involves our personal data processor or a third party).
Depending on the nature and level of complexity of the request, we may extend the
implementation period by up to an additional 15 days and shall notify you of the reasons
for such extension.
(ii) If the implementation of your request is not feasible, we shall notify you of the
reasons.
14.5 Right to request for provision of personal data
(a) You have the right to request us to provide you with your personal data that is in our
possession or under our control. Such personal data is your personal data which you have
provided to us and/or generated by your activities in using our product and/or services.
(b) You also have the right to request us to provide such personal data to a third party with
a Vietnam presence. We have no obligation, but may however choose to do so voluntarily, to
provide such personal data to a third party if the third party is based overseas. Approriate
technical and organisational security measures will be imposed to ensure the security of
your personal data provided to the third party. However, please note that in the case of
provision of your personal data as per your request, we will not be responsible for the
security of the personal data or how it will be processed thereafter.
(c) We shall not provide your personal data as per your request if:
(i) such provision may cause harm to national defense, national security or public order
and safety; or
(ii) such provision may infringe on the life, health or property of others.
(d) We will respond to you within 2 working days upon receipt of your request for the
provision of your personal data.
(i) If the implementation of your request is feasible, we shall implement within 10 days.
Depending on the nature and level of complexity of the request, we may extend the
implementation period by up to an additional 10 days and shall notify you of the reasons
for such extension.
(ii) If the implementation of your request is not feasible, we shall notify you of the
reasons.
14.6 Right to request for deletion
(a) You have the right to request us to delete your personal data. When requesting for
deletion of your personal data, you acknowledge and accept all risks and damage that may
arise in connection with such a request. In addition, you should note that such request must
fully comply with the following principles: compliance with applicable laws; for the purpose
of fulfilling obligations and protecting your lawful rights and interests; not causing
difficulty or obstruction to the performance of our legal rights and obligations; and not
infringing on the lawful rights and interests of Vietnam or other countries, of other
agencies, organizations and individuals.
(b) In some circumstances, deletion of your personal data may mean that we will not be able
to provide you with your requests for information.
(c) Notwithstanding Clause 14.6(a):
(i) a separate and restricted copy of your personal data may be retained for any period
required by the applicable laws, law enforcement, national authorities and legal
proceedings; and
(ii) certain elements that relate to any contract between you and us may be retained, for
our own legal and auditing purposes,
and we shall ensure the confidentiality of such personal data as required in Clause 10 and
that such personal data is only processed as necessary for the purpose(s) specified above.
(d) Notwithstanding Clause 14.6(a), we cannot delete your personal data:
(i) so long as you have a contractual relationship with us;
(ii) if you have made a complaint that remains open or we are required to keep such
personal data for a certain period after a prior complaint;
(iii) your request does not satisfy the principles set out in Clause 14.6(a); or
(iv) in the cases as specified in Clause 8.3 or otherwise stipulated by applicable laws.
(e) The request for deletion of your personal data must be made in writing (either in
hard-copy with wet ink signature or in electronic form) and submitted to our PDPO at the
contact details set out in this Policy. We will respond to you within 2 working days upon
receipt of such request.
(i) If the implementation of your request is feasible, we shall implement it within 20
days (if the personal data processing is directly carried out by us) or 30 days (if the
personal data processing involves our personal data processor or a third party).
Depending on the nature and level of complexity of the request, we may extend the
implementation period by up to an additional 20 days and shall notify you of the reasons
for such extension.
(ii) If the implementation of your request is not feasible, we shall notify you of the
reasons.
14.7 Right to complain, accuse and initiate lawsuits
You have the right to complain, accuse and initiate lawsuits with respect to our processing of
your personal data in violation with the Applicable Data Protection Law.
14.8 Right to claim damages
You have the right to claim damages when there is a violation of Applicable Data Protection Law
with regard to our processing of your personal data.
14.9 Right of self-protection
(a) You have the right to self-protect or request competent agencies, relevant organizations
or individuals involving in the processing of your personal data to implement measures or
solutions to protect your personal data in accordance with applicable laws.
(b) We will respond to you within 2 working days upon receipt of your request for
implementation of measures or solutions to protect your personal data.
(i) If the implementation of your request is feasible, we shall implement it within 15
days. Depending on the nature and level of complexity of the request, we may extend the
implementation period by up to an additional 15 days and shall notify you of the reasons
for such extension.
(ii) If the implementation of your request is not feasible, we shall notify you of the
reasons therefor. You may consider exercising your right to request for withdrawal of
your consent in accordance with this Policy.
15.1 To exercise any of your rights, such as those provided in Clause 14,
please submit your request to the PDPO at the contact details set out in this Policy, with
sufficient particulars, including your full name, your contact details such as telephone number
and email, and details of your request together with supporting documents, to enable us to
verify your identity, setting out your request and the grounds for your request.
15.2 In many circumstances, we may need to process your personal data in
order to proceed with your application or request. If you do not provide us with the required
personal data, or you withdraw your consent to our processing of your personal data for such
purposes, it may be impossible for us to proceed further with your application or respond to
your request.
As a Data Subject, you are responsible for:
- protecting your own personal data;
- providing us with the correct and complete personal data in accordance with the laws, your
employment contract or probation contract with us, or upon giving your consent to our
processing of your personal data. You understand and acknowledge that the provision of
incorrect and/or incomplete information may affect our ability to process your personal data
or to fulfill your requests, or may adversely affect the achievement of the purposes for
which your personal data is processed;
- respecting and protecting the personal data of other Data Subjects. In the event that you
provide us with personal data that does not belong to you, you are responsible for obtaining
the consent of the relevant data subject, and you guarantee with us that you have duly
obtained such consent, in accordance with the Applicable Data Protection Law, to your
disclosure of such personal data to us and to our processing of such personal data; and
- comply with the Applicable Data Protection Law.
17.1 Our Websites implant cookies, which are the small text files placed on
your computer or mobile device, on your computer or mobile device when you visit our Website.
17.2 By clicking "Agree" to the use of cookies on our Website, you consent
to our use of cookies to collect and process your personal data for the purposes of collecting
website usage data and to facilitate your internet sessions, track visitor's use of our websites
and compile statistics on website activites.
17.3 The personal data we collect from visitors of our Website include but
are not limited to your IP address, how you arrived at the Website (e.g. through a search engine
or from an external website), how you navigate within the Website, what device you use to access
our Website and your geographical location.
17.4 In the event that you do not wish for our placement of cookies on your
computer or mobile device, you can change the settings in your web browser to block cookies, or
you may manually remove cookies stored on your computer or mobile device. In addition, you may
set up your mobile or browser settings such that you receive a notification every time you
receive a cookie on your computer or mobile device, so that you can decide whether you wish to
accept this cookie.
However, please note that if you decide to block cookies, you may not be able to use certain
features and functions of our Website.
17.5 By continuing your visit to our Website, you agree to this Clause 17
and any other relevant Clauses in this Policy.
18.1 We shall delete your personal data in the following cases:
- upon your request as stipulated in Clause 14.6 of this Policy;
- the purposes for processing your personal data which you have given consent to has been
completed;
- the retention period of your personal data expires in accordance with the applicable laws;
- upon decision of competent governmental agencies;
- upon mutual agreement;
- we are dissolved, no longer operate or insolvent or has terminated our operations, business
activities in accordance with applicable laws; or
- otherwise as stipulated by applicable laws.
18.2 The deletion of your personal data shall be carried out by either
deleting such personal data or anonymizing such personal data in our active systems.
Third party Websites
19.1 Our Website may contain links to other websites which are not
maintained by us or any Wilmar Group Entity. This Policy only applies to our Website, and not
third-party websites.
Other rules and
processes
19.2 In certain cases, there may be specific rules or processes that govern
our use of your personal data, which are not stated in this Policy. In any such rules or
processes apply, we will make them known to you in advance.
20.1 To contact us on any aspect of this Policy or your personal data in
our possession, you can e-mail the PDPO at wmclv-pdpo@vn.wilmar-intl.com or write in to
the PDPO at Wilmar Marketing CLV Company Limited, 2nd Floor and 10th Floor, CornerStone
Building, No. 16 Phan Chu Trinh Street, Cua Nam Ward, Hanoi, Vietnam.
20.2 All requests, complaints and feedback will be evaluated by the PDPO in
a timely manner as stipulated by PDPL. After the PDPO has completed his or her evaluation, he or
she will respond to you in writing.
In addition to the provisions of this Policy, below sets out some specific examples of personal
data which we process and the purposes for processing such personal data:
|
Personal data |
Purpose of processing and legal grounds |
Your identification and contact information:
- Full name
- Date of birth
- Gender
- Address
- Telephone number
- Email address
- Identification number, passport number, driving licence number, licence
plate number
- Bank account information
- Other information to be specified at the time we seek your consent
|
- customer administration
- supplier administration
- administration and management intermediaries
- to deliver the services or products that the company you represent or
are employed with ordered
- for administrating payment of invoices and collecting debts
- for marketing purposes
- to handle disputes and ensure our legal position therein
- to comply with legal obligations
- in the context of a possible business transaction
|
|
Identification information, contact information, information about employment,
education, qualification which we have legally obtained from external databases
and thereafter combined with the data that we have collected from you in order
to obtain a more complete or accurate set of information
|
- for making decisions about selecting you as a vendor/customer
- for recruitment purpose
|
|
Camera images collected at the production sites or offices
|
For compliance with safety and security concerns in the production sites or
offices
|