Privacy Policy

This Privacy Policy is issued by: Data Controller: CÔNG TY TNHH VINABOT (VINABOT COMPANY LIMITED) Tax Code: 3200750573 Address: HG05-17 Vincom Royal, Phường Nam Đông Hà, Tỉnh Quảng Trị, Việt Nam Phone: 0328 887 989 Data privacy contact: info@makeea.com This Policy explains how we collect, use, store, disclose and protect your Personal Data, in compliance with: • Vietnam's Decree 13/2023/ND-CP on Personal Data Protection (effective 01 July 2023) • Vietnam's Cybersecurity Law 2018 (No. 24/2018/QH14) • Vietnam's Law on Electronic Transactions 2023 (No. 20/2023/QH15) • EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) where applicable By using our services, you acknowledge you have read and understood this Policy.

A. Data you provide directly: • Identity data: full name, username • Contact data: email address, phone number • Account credentials: hashed password (never stored in plain text) • Payment data: billing address, transaction history (card details processed by third-party gateways — we do not store them) • Communications: messages, support requests, feedback B. Automatically collected data: • Technical data: IP address, browser type, OS, device identifiers • Usage data: pages visited, features used, access time • Session data: login timestamps, session duration • Consent records (click-wrap): when you tick the box accepting our Terms of Service and Disclaimer at sign-up, we log the timestamp, document version, IP address and browser (user-agent) as evidence of your consent C. Data from third parties: • Google OAuth: name, email, Google Account ID (with your consent) • MetaAPI: account performance data if you connect MT (no trading authority granted to VinaBot) We do NOT collect sensitive personal data (as defined in Article 2 of Decree 13/2023) such as health information, religion, biometrics, or ethnic origin. We do not knowingly collect data from anyone under 18.

Under Decree 13/2023/ND-CP (Vietnam) and the GDPR (EU), we process personal data on the following legal bases: • Consent: For marketing communications, non-essential cookies and optional data sharing. You may withdraw consent at any time. • Contract performance: To provide our services, process payments, deliver bot files and manage your account. • Legitimate interests: For fraud prevention, security, service improvement and analytics — where these interests are not overridden by your rights. • Legal obligation: To comply with applicable laws, court orders or regulatory requirements. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of prior processing.

We use your personal data to: Service provision: • Create and manage your account • Process orders, payments and deliver bot files and services • Provide technical support and respond to inquiries • Verify identity and prevent unauthorised access Service improvement: • Analyse usage patterns to improve platform features • Debug technical issues and monitor service performance • Improve AI-generated output quality Communications: • Send transactional emails (account confirmation, password resets, order receipts) • Notify you of service updates, changes to Terms or this Policy • Send marketing communications (only with your explicit consent; you may opt out at any time) Security & compliance: • Detect, prevent and investigate fraud, abuse and security incidents • Comply with legal obligations and respond to lawful authority requests We do NOT use automated decision-making or profiling that produces legal or similarly significant effects on you, per Article 6 of Decree 13/2023/ND-CP.

We do not sell, rent or trade your personal data to third parties for marketing. We may share data with: A. Service providers (acting as data processors): • Cloud hosting and server providers • Payment processors (PCI-DSS compliant) • Email service providers • Analytics providers (aggregated, anonymised data) All third-party processors are contractually bound to process data only for specified purposes. B. Legal requirements: We may disclose data when required by Vietnamese law, court order or competent authority (including the Ministry of Public Security — Bộ Công an, or the Ministry of Information and Communications). C. Business transfers: In the event of a merger, acquisition or asset sale, your data may be transferred with equivalent privacy protections.

Some of our service providers are located outside Vietnam. When we transfer personal data internationally, we ensure appropriate safeguards per Article 25 of Decree 13/2023/ND-CP: • Standard Contractual Clauses (SCCs) for transfers to EU/EEA • Data Processing Agreements with all third-party processors • Transfers only to countries or organisations providing adequate data protection You may request information about safeguards applied to any international transfer by contacting info@makeea.com.

Under Decree 13/2023/ND-CP (Vietnam) and the GDPR (EU/EEA), you have the following rights: • Right to be informed: Know what data we collect and how we use it • Right of access: Request a copy of personal data we hold about you • Right to rectification: Request correction of inaccurate or incomplete data • Right to erasure ("Right to be Forgotten"): Request deletion of your data, subject to legal retention obligations • Right to restrict processing: Request that we limit how we use your data • Right to data portability: Receive your data in a commonly used, machine-readable format • Right to object: Object to processing based on legitimate interests or for direct marketing • Right to withdraw consent: Withdraw consent at any time for consent-based processing • Right not to be discriminated against: We will not discriminate against you for exercising privacy rights To exercise any right, contact info@makeea.com. We will: • Acknowledge your request within 72 hours • Respond substantively within 30 days (extendable by 30 days for complex requests, with notification) • Verify your identity before acting on sensitive requests

We retain personal data only as long as necessary: • Account data: retained for the account's lifetime and 3 years after deletion (legal and audit purposes) • Transaction records: 10 years as required by Vietnamese Accounting Law and Tax Administration Law • Server logs: 12 months for security and debugging • Marketing consent records: until consent is withdrawn plus 2 years • Terms-acceptance (click-wrap) consent records: for the account's lifetime and 3 years after closure, as legal evidence • Support communications: 3 years When data is no longer needed, we securely delete or anonymise it. You may request earlier deletion by contacting info@makeea.com.

We implement appropriate technical and organisational measures to protect personal data: Technical measures: • HTTPS encryption for all data transmission • Passwords hashed using bcrypt (never stored in plain text) • JWT access tokens with time-limited expiry • Regular security audits • Access controls and principle of least privilege Organisational measures: • Staff data protection training • Data Processing Agreements with all third-party processors • Incident response procedures In the event of a personal data breach posing risk to your rights, we will notify the relevant Vietnamese authority (Department of Personal Data Protection — Ministry of Public Security) and affected users within the timeframes required by Decree 13/2023/ND-CP (within 72 hours).

We use cookies and similar technologies. For full details, see our Cookies Policy at vinabot.vn/cookies. In summary: • Essential cookies: required for the website to function (login sessions, security). Cannot be disabled. • Functional cookies: remember your preferences (language, theme). Manageable in your browser. • Analytics cookies: help us understand user interactions (anonymised/aggregated). You may opt out. • Marketing cookies: only placed with your explicit consent. You may manage or withdraw cookie consent at any time through your browser settings.

Our services are not directed at and we do not knowingly collect personal data from individuals under 18. If we discover we have inadvertently collected data from a minor, we will promptly delete it. If you believe we may have collected data from a minor, contact info@makeea.com. This complies with Article 9 of Decree 13/2023/ND-CP, which provides additional protection for children's personal data.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will: • Update the "Last updated" date • Notify you via email to your account address • Display a prominent notice on our website Continued use of our services after the effective date constitutes acceptance of the changes.

CÔNG TY TNHH VINABOT (VINABOT COMPANY LIMITED) Tax Code: 3200750573 Address: HG05-17 Vincom Royal, Phường Nam Đông Hà, Tỉnh Quảng Trị, Việt Nam Phone: 0328 887 989 Privacy email: info@makeea.com Support: info@makeea.com Website: vinabot.vn | makeea.com Response time: within 72 hours for acknowledgement; 30 days for substantive response. Vietnamese users: if you believe your data protection rights have been violated, you may file a complaint with the Department of Personal Data Protection (Ministry of Public Security — Bộ Công an). EU/EEA users: you may lodge a complaint with your national Data Protection Authority (DPA).