Personal Data Processing Policy

XSCORE collects personal data to: • Operate and provide Tele-HRMS software services • Process payments and financial transactions • Communicate, support, and provide customer care • Improve products and develop new features • Send marketing information (with consent) • Comply with legal requirements and report to authorities • Analyze user behavior to personalize experience

Basic personal data: • Full name, date of birth, gender • Email, phone number, contact address • Account information (encrypted) • IP address, device, browser Transaction data: • Payment history, invoices • Bank account information (tokenized) Automatically collected data: • Cookies, clear gifs, web beacons • Activity history on the system • Data from integrated services (Google, Apple ID) XSCORE does NOT collect data on religion or political views.

Data is used to: • Authenticate and secure user accounts • Process secure payment transactions • Send service notifications and updates • Provide technical support and customer care • Analyze with Google Analytics (anonymized data) • Personalize content and advertising • Comply with legal obligations You can opt out of marketing communications at any time.

XSCORE does NOT sell your personal data. We only share with: • Payment providers: SePay, Polar (PCI DSS compliant) • Analytics services: Google Analytics (anonymized data) • Hosting providers: Google Cloud Platform, FPT Smart Cloud • Government authorities: When legally required All partners must sign confidentiality agreements and comply with equivalent standards. In case of corporate reorganization, data may be transferred provided the recipient meets security standards no lower than ours.

Protection measures: • AES-256-GCM encryption at rest • TLS 1.3/HTTPS transmission (encrypt-in-transit) • End-to-end encrypted passwords • Optional two-factor authentication (2FA) Storage locations: • GCP Singapore (primary) • FPT Smart Cloud Vietnam (data per VN regulations) Retention periods: • Account data: Until account deletion + 30 days • Transaction data: 7 years (per accounting law) • Analytics data: 2 years • Cookies: Per Cookie Policy

Under the 2025 Personal Data Protection Law, you have the right to: • Be informed about data processing activities • Consent or withhold consent • Access and view your data • Correct inaccurate information • Delete your personal data • Restrict data processing • Withdraw consent at any time • Object to data processing • File complaints, denunciations, or lawsuits • Request compensation for damages Response time: 30 business days from receipt of a valid request.

Data Protection Officer (DPO): Email: [email protected] Hotline: +84 88 9615586 Address: XSCORE LIMITED COMPANY Tax ID: 0318073634 Vietnam This policy is effective from 28/01/2026 and governed by Vietnamese law.