PRIVACY POLICY

Last updated: August 19, 2026

ESGreen Joint Stock Company (“ESGreen”, the “Company”, “we”, “us”, or “our”) respects your privacy and is committed to protecting the personal data of customers, users, and individuals who visit our website or use ESGreen’s products, platforms, and services.

This Privacy Policy explains how ESGreen collects, uses, stores, shares, and protects personal data, and provides information about the rights of data subjects under Vietnamese law.

This Policy has been developed in accordance with applicable personal data protection laws, including Law No. 91/2025/QH15 on Personal Data Protection, Decree No. 356/2025/ND-CP, and other relevant regulations.

By accessing the website, providing information, or using ESGreen’s services, you acknowledge that you have been informed of the personal data processing activities described in this Policy.

1. Scope of Application

This Policy applies to personal data processed by ESGreen when you:

Visit the ESGreen website;
Submit a contact form or consultation request;
Subscribe to newsletters;
Register for or use an account on ESGreen platforms;
Request a product demo;
Communicate with ESGreen by email, telephone, or other support channels;
Enter into or perform a contract with ESGreen; or
Use ESGreen’s products and services.

For data uploaded to ESGreen platforms by corporate customers, ESGreen’s role and responsibilities regarding data processing may be further specified in the relevant contract, service agreement, or data processing agreement between ESGreen and the customer.

This Policy primarily applies to personal data. Corporate data that does not constitute personal data—including operational data, greenhouse gas emissions data, energy data, material data, production data, and other business information—may be protected under contracts, confidentiality agreements, and other applicable arrangements between ESGreen and its customers.

2. Personal Data ESGreen May Collect

Depending on how you interact with ESGreen, we may collect and process different categories of personal data.

2.1. Contact Information

When you submit a consultation request, register for a demo, subscribe to updates, or otherwise contact ESGreen, we may collect:

Full name;
Email address;
Telephone number;
Company or organization name;
Job title or department; and
The content of the request or information you provide.

2.2. Account Information

When you use ESGreen’s platforms or software, we may process information necessary to create and manage your account, such as:

Username;
Business email address;
Organization or company;
User role;
Access permissions; and
Related authentication information.

ESGreen recommends that users do not share passwords or account authentication information with others.

2.3. Transaction and Service-Related Information

When an enterprise uses ESGreen services, we may process information concerning:

Products or services registered for;
Support history;
Contract-related information;
Business or technical requirements; and
Communications necessary for the provision of services.

2.4. Technical Data

When you access the website or use an ESGreen platform, the system may automatically record certain technical information necessary for operation and security, including:

IP address;
Device type;
Browser type;
Access time;
System logs;
Login sessions; and
Information related to platform usage.

2.5. Data Uploaded by Customers to ESGreen Platforms

ESGreen’s GHG inventory, ESG, and Net-Zero solutions may allow customers to enter, upload, or manage data for calculation, analysis, and reporting purposes.

Where such data contains personal data, the customer is responsible for ensuring that the collection and provision of such data to ESGreen has an appropriate lawful basis.

ESGreen processes such data only to the extent necessary to provide the relevant services and in accordance with its agreements with the customer.

2.6. Sensitive Personal Data

ESGreen does not actively request users to provide sensitive personal data through ordinary website contact forms.

Where a specific service requires the processing of sensitive personal data, ESGreen will implement appropriate measures in accordance with applicable law and, where appropriate, provide a separate notice or agreement before such processing takes place.

3. How Does ESGreen Use Personal Data?

ESGreen processes personal data only for purposes that are appropriate and necessary for the Company’s operations.

Personal data may be used to:

Receive and respond to consultation requests;
Organize product demonstrations and introductions;
Create and manage user accounts;
Provide software and services;
Perform contractual obligations;
Provide customer support;
Authenticate users and manage access permissions;
Operate, maintain, and improve the website or ESGreen platforms;
Maintain system security;
Detect and resolve incidents;
Analyze website performance and usage;
Send newsletters or professional information where the user has subscribed or another appropriate lawful basis applies; and
Fulfill ESGreen’s legal obligations.

ESGreen does not use personal data for purposes that are incompatible with those previously communicated, unless another lawful basis for processing applies.

4. Legal Basis for Processing Personal Data

Depending on the circumstances, ESGreen may process personal data:

Based on the consent of the data subject;
For the performance of a contract or steps necessary at the customer’s request;
To comply with legal obligations; or
In other circumstances where the processing of personal data is permitted by law.

Where processing is based on consent, ESGreen will obtain consent in a manner consistent with applicable legal requirements.

A user’s failure to respond or silence will not automatically be treated by ESGreen as consent where the law requires affirmative consent.

5. Emails, Newsletters, and Marketing Communications

When you voluntarily subscribe to receive updates from ESGreen, we may use your email address and related information to send:

Updates on greenhouse gas inventory regulations;
Information on ESG and sustainable development;
Content relating to Net Zero and carbon markets;
Professional and technical materials;
Information about ESGreen products;
Event information; and
Information about ESGreen services.

You may stop receiving these communications at any time by using the Unsubscribe function in the email or by contacting ESGreen.

Unsubscribing from marketing communications does not affect essential notices relating to your account, security, contracts, or services you are currently using.

6. Cookies and Similar Technologies

The ESGreen website may use cookies and similar technologies to:

Maintain website functionality;
Remember user preferences;
Maintain security;
Analyze website usage and performance; and
Improve the user experience.

Necessary cookies may be used to ensure that the website and its core functions operate properly.

For analytics, advertising, or other non-essential cookies, ESGreen will use such technologies and obtain user consent where required by applicable law or by the nature of the technology used.

You may manage cookies through your browser settings or through a cookie management tool provided on the website, where available.

Disabling certain necessary cookies may affect the operation of some website functions.

7. Does ESGreen Share Personal Data?

ESGreen does not unlawfully buy or sell personal data.

To the extent necessary to operate the website and provide services, ESGreen may share or permit access to personal data with:

Technology service providers;
Data hosting providers;
Cloud service providers;
Email service providers;
Technical support providers; and
Other service providers supporting ESGreen’s operations.

ESGreen may also provide information to professional advisers, auditors, legal advisers, or competent government authorities where necessary to:

Perform contractual obligations;
Protect lawful rights and interests; or
Comply with applicable laws and regulations.

When ESGreen uses data processors or service providers, we apply appropriate measures requiring such parties to maintain data confidentiality and to process data only to the extent necessary for the services they provide.

In the event of corporate restructuring, merger, transfer of business operations, or a similar transaction, any transfer of data will be carried out in accordance with applicable law and relevant confidentiality obligations.

8. Cross-Border Transfer of Personal Data

Certain technology services, hosting infrastructure, or service providers used by ESGreen may operate systems or servers located outside Vietnam.

Where ESGreen’s activities involve the transfer of personal data outside Vietnam, ESGreen will implement the requirements, safeguards, and procedures necessary under Vietnamese personal data protection law.

ESGreen makes reasonable efforts to ensure that transferred data is used only for appropriate purposes and is subject to corresponding security measures.

9. Data Retention Period

ESGreen does not retain personal data for longer than is necessary for the relevant processing purpose, except where a longer retention period is required by law, contract, or dispute-resolution requirements.

Retention periods may vary depending on the type of data and the purpose for which it is used.

Contact and Consultation Information

Contact details and consultation requests are retained for the period necessary to process the request and maintain customer relationships.

Account Data

Account information is retained while the account or relevant service remains active and for a reasonable period after termination to address any outstanding obligations.

Contract and Transaction Data

Contract-related and transaction data may be retained for the period required by applicable law.

Newsletter Subscription Data

Newsletter subscription data is processed until the user unsubscribes or ESGreen determines that the data is no longer necessary for the relevant purpose.

When data is no longer required or the applicable retention period has expired, ESGreen will delete, destroy, anonymize, or otherwise appropriately process the data in accordance with applicable law and the Company’s data governance policies.

10. Data Security

ESGreen implements appropriate technical and organizational measures to protect personal data against unauthorized:

Access;
Use;
Modification;
Disclosure;
Loss; or
Destruction.

These measures may include:

Access management and role-based permissions;
Authentication mechanisms;
Account management;
System logging;
Data backups;
Infrastructure protection;
Internal access controls; and
Other technical measures appropriate to the nature of the system and the data being processed.

Access to personal data is limited to individuals and entities with a reasonable need to access the data in order to perform their work or provide services.

Although ESGreen applies appropriate protective measures, no electronic data transmission or storage system can be guaranteed to be completely secure.

ESGreen therefore regularly reviews and improves its security measures based on applicable risks and available technical capabilities.

11. Personal Data Incidents

If ESGreen identifies an incident that may affect personal data, we will take necessary measures to:

Determine the scope of the incident;
Limit potential damage;
Address the underlying cause; and
Prevent similar incidents from occurring.

Where required by law, ESGreen will notify or report the incident to competent authorities and affected data subjects in accordance with applicable procedures and time limits.

12. Rights of Data Subjects

Under applicable personal data protection laws, you may have rights in relation to your personal data, including the right to:

Be informed about personal data processing activities;
Consent to or refuse processing, where applicable;
Withdraw consent;
Access or request correction of your personal data;
Request the provision of your data;
Request deletion or restriction of processing;
Object to processing where permitted by law; and
Exercise the right to complain, report violations, initiate legal proceedings, or seek compensation in accordance with applicable law.

Certain rights may be restricted in circumstances provided by law or where continued processing is necessary for ESGreen to:

Fulfil a legal obligation;
Protect lawful rights and interests; or
Perform a contract.

13. How to Exercise Your Personal Data Rights

To request access, correction, deletion, restriction of processing, withdrawal of consent, or to exercise other rights relating to your personal data, you may contact ESGreen at:

Email: contact@esgreen.vn
Phone: 0856 357 968

To protect personal data, ESGreen may request information necessary to verify the identity of the person making the request before taking action.

ESGreen will receive and process requests within the time limits prescribed by applicable law.

Where ESGreen cannot fully or partially fulfil a request for legitimate legal or technical reasons, we will provide notice in accordance with applicable requirements.

Where provided by law, withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

14. Data Managed by Corporate Customers

For ESGreen’s GHG inventory, ESG, and Net-Zero software platforms, corporate customers may determine:

What data is entered into the system;
The purpose for which the data is processed; and
Which individuals are granted access.

Where ESGreen processes data on behalf of a customer, ESGreen will process the data in accordance with the customer’s instructions, the scope of services, and the relevant agreement, unless otherwise required by law.

If your request concerns data controlled by one of ESGreen’s corporate customers, ESGreen may direct you to that organization or coordinate with the customer to appropriately address your request.

15. Data Relating to Minors

ESGreen’s primary products and services are designed for businesses, organizations, and users acting in a professional capacity.

ESGreen does not intentionally direct ordinary service registration forms to children or collect children’s personal data without an appropriate purpose and lawful basis.

If ESGreen becomes aware that personal data relating to a minor has been provided inappropriately, we will review the matter and take necessary measures in accordance with applicable law.

16. Links to Third-Party Websites

The ESGreen website may contain links to websites, documents, or platforms operated by third parties.

ESGreen does not control the privacy practices of third-party websites.

When you leave the ESGreen website to access another service, you should review the privacy policy of the relevant third party before providing personal data.

17. Changes to This Privacy Policy

ESGreen may update this Policy to reflect changes to:

The Company’s operations;
Products;
Services;
Technology; or
Applicable laws and regulations.

When this Policy is revised, the updated version will be published on the website together with the Last Updated date.

Where changes materially affect the way ESGreen processes personal data, we may provide additional notice as appropriate before the changes take effect.

18. Relationship with the Terms of Use

This Privacy Policy should be read together with ESGreen’s Terms of Use and any separate contracts or agreements applicable to particular products, platforms, or services.

Where a customer has entered into a separate data processing or confidentiality agreement with ESGreen, that agreement will apply to the relevant scope of services.

19. Contact ESGreen

If you have any questions, requests, or feedback regarding privacy or the processing of personal data, please contact:

ESGREEN JOINT STOCK COMPANY

Address:
8th Floor, Diamond Flower Tower
48 Le Van Luong Street, Yen Hoa Ward
Hanoi, Vietnam

Email: contact@esgreen.vn

Phone: 0856 357 968

Business hours: Monday-Friday, 9:00 AM-6:00 PM