PRIVACY POLICY

OPERATING REGULATIONS

1. Provisions on the operating terms applicable on the e-commerce platform

1.1. Description of the provisions on the content to be published on the e-commerce platform under Chapter II of this Decree

1.2. Information on the e-commerce platform owner

EVENTISTA COMPANY LIMITED

Legal representative: NGUYEN MANH TOAN

Address Floor 12, Vinafor Building, 127 Lo Duc, Hai Ba Trung Ward, Hanoi City, Vietnam

Business registration No. 0110372057, first issued on 31/05/2023 at the Business Registration Office – Hanoi Department of Planning and Investment.

Hotline: 0832338688

Email: support@eventista.vn

1.3. Privacy Policy

LEGAL BASIS AND OBJECTIVES

This Policy is developed on the basis of Vietnamese legal regulations on e-commerce, consumer protection, and personal data protection, including Decree No. 248/2026/ND-CP detailing a number of articles of the Law on E-commerce, the Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and other related legal documents.

The objective of this Policy is to help Users understand the types of information Eventista collects, where the collection occurs, the purpose and scope of use, the retention period, the parties that may access the data, how to self-check or request data correction, and the complaint mechanism available when information is used for improper purposes or beyond the scope previously notified.

1. SCOPE OF APPLICATION AND GENERAL PRINCIPLES

1.1. This Policy applies to every individual who accesses or uses 1Zone, including account creators, ticket purchasers, event attendees, buyers of merchandise or goods, voting participants, individuals submitting support requests, and individuals representing Event Organizers or business partners.

1.2. Eventista only collects and processes data that is necessary and consistent with the specific purposes previously notified; Eventista does not unilaterally expand the purpose of use without a legal basis or, where required by law, without the additional consent of the Data Subject.

1.3. Certain events, voting programs, or booths may require specific data based on the legitimate needs of the Event Organizer or seller. In such cases, a supplementary notice will be displayed on the relevant event page, form, checkout step, or collection point. Such supplementary notice forms part of this Policy and applies only to the activity described therein.

1.4. Depending on the specific operation and the agreement with the Event Organizer, seller, payment provider, or service provider, Eventista may act simultaneously as a Data Controller, a Data Controller-cum-Processor, or a Data Processor. Regardless of its role, Eventista performs its data-protection obligations within the scope of its responsibility under the law and the relevant agreements.

2. DEFINITIONS

"1Zone" means the e-commerce trading platform and event ticket, merchandise, souvenir, voting, and interactive-utility distribution platform developed or operated by Eventista.

"User" means an individual who accesses, registers for, or uses any function of 1Zone; depending on the context, this may include Buyers, Event Participants, Voting Participants, or partner representatives.

"Event Organizer" means a trader, organization, or individual using 1Zone to publish, organize, distribute tickets for, or operate an event or voting program, or to provide products or services.

"Personal Data" means data in the form of symbols, letters, numbers, images, sounds, or similar forms in the electronic environment that is associated with, or helps identify, a specific individual.

"Processing of Personal Data" means one or more activities affecting data, such as collection, recording, analysis, confirmation, storage, correction, access, use, sharing, transmission, provision, transfer, deletion, or destruction of data.

"Data Subject" means the individual reflected by the data.

3. DATA COLLECTED, COLLECTION POINTS, AND CORRESPONDING PURPOSES

Eventista may collect the following groups of data. The specific scope depends on the function selected by the User and is displayed on the relevant form or interface where the collection occurs.

3.1. Sensitive Personal Data

Eventista does not proactively request Users to provide sensitive personal data unless truly necessary. Where an event, transaction, or legal requirement calls for identification documents, financial data, precise location data, biometric data, or other sensitive data groups, Eventista or the Event Organizer will provide a separate notice on the type of data, purpose, recipients, processing period, and protective measures, and will carry out the procedure to obtain consent or rely on another lawful basis as required by law.

Users should not voluntarily submit sensitive data unrelated to the matter being addressed within complaint content, support chat boxes, or open-ended forms.

4. METHODS OF DATA COLLECTION AND PROCESSING

Data may be collected through one or more of the following methods:

• Directly entered or uploaded by the User on the registration page, ticket-booking page, shopping cart, checkout step, event form, voting page, support page, or other 1Zone functions.
• Through communication with Eventista or the Event Organizer via email, hotline, messages, social media, written correspondence, at support counters, or at the event venue.
• Automatically generated when the User accesses or interacts with 1Zone, through system logs, cookies, SDKs, pixels, analytics technologies, or security tools.
• From Event Organizers, sellers, payment providers, delivery partners, login partners, or service providers, when sharing is necessary to perform a transaction, at the User's choice, or as required by law.
• From lawful public sources or competent authorities, to the extent necessary for verification, fraud prevention, or fulfilling legal obligations.

Processing may be carried out through automated, semi-automated, or manual methods. Eventista applies the principle of access limitation, permitting only personnel and related parties to process data within the scope of their assigned duties.

5. SCOPE OF INFORMATION USE

To the extent appropriate for the function the User uses, Eventista may process data for the following purposes:

• Providing, operating, and maintaining accounts, the 1Zone platform, ticket-distribution services, merchandise sales, voting, payment, delivery, and related utilities.
• Confirming identity or access rights; sending verification codes, transaction notifications, e-tickets, event schedule changes, security alerts, and information necessary to perform the contract.
• Sharing necessary transaction data with the Event Organizer, seller, event operator, payment intermediary, or delivery partner to properly complete the transaction requested by the User.
• Receiving and resolving support requests, ticket exchanges, refunds, complaints, disputes, declined transactions, chargebacks, or technical incidents.
• Detecting, preventing, and investigating impersonation, account abuse, payment fraud, voting fraud, counterfeit tickets, unauthorized access, or violations of the law and 1Zone's rules.
• Performing accounting, tax, reconciliation, audit, risk management, reporting, and other legal obligations; responding to lawful requests from competent authorities.
• Analyzing data, compiling statistics, and conducting research to improve 1Zone's interface, performance, products, functions, support quality, and safety. Where appropriate, Eventista uses aggregated or anonymized data.
• Sending promotional information, offers, surveys, or event announcements when the User has opted in or as permitted by law; Users always have a mechanism to opt out of further communications.
• Protecting the lawful rights, property, and interests of Users, Eventista, Event Organizers, partners, or the community; establishing, exercising, or defending legal claims.

Eventista does not sell Users' personal data. Eventista does not provide data to third parties for them to freely use for purposes unrelated to the transaction or not previously notified, unless the User consents or the law provides otherwise.

6. ORGANIZATIONS AND INDIVIDUALS THAT MAY ACCESS THE DATA

Data is accessed, only to the extent necessary, by the following groups:

Eventista: personnel, including the technical, customer care, operations, finance-accounting, legal, and information-security departments, and other individuals duly authorized by Eventista.

Event Organizers, sellers, and operators: granted access to information necessary to issue tickets, organize and control the event, deliver goods, fulfill benefits, take care of attendees, and resolve issues related to a specific transaction.

Service providers: including cloud-storage, technology-infrastructure, security, email/SMS-sending, authentication, payment, banking, delivery, customer-care, data-analytics, audit, accounting, and legal-advisory providers, or other contractors serving 1Zone's operations.

Affiliated companies or transaction partners: only when necessary to provide the service requested by the User, with appropriate notice and a binding confidentiality mechanism in place.

State authorities, proceeding-conducting agencies, or competent authorities: when Eventista is obligated to provide data pursuant to a lawful request or needs to protect its lawful rights and interests as prescribed by law.

Business transferees: in the case of restructuring, merger, consolidation, project transfer, or other corporate transaction, provided that the transferee continues to bear data-protection obligations and the transfer complies with the law.

The Data Subject or their duly authorized representative: when exercising the right of access, obtaining a copy, or other rights under the law and this Policy.

Eventista requires providers and partners receiving data to apply appropriate security measures, process data only for lawful purposes and instructions, and return, delete, or cease using the data once the processing need has ended, unless retention is required by law.

7. DATA RETENTION AND DESTRUCTION PERIOD

Eventista retains data for the period necessary to fulfill the notified purposes, perform contracts, resolve disputes, and comply with legal obligations. The following reference periods apply, unless the law requires a longer period or another lawful basis exists:

When the retention period ends, Eventista deletes, destroys, anonymizes, or otherwise renders the data no longer identifiable, except for data that must continue to be retained by law. Data in backup copies may be deleted on a technical cycle and is isolated with restricted access while awaiting overwrite.

8. RIGHTS OF THE DATA SUBJECT AND HOW TO EXERCISE THEM

To the extent permitted by law, Data Subjects may exercise rights such as being informed about processing activities; giving or withdrawing consent; accessing and obtaining data; requesting correction, deletion, or restriction of processing; objecting to processing; filing complaints, denunciations, lawsuits, and claims for compensation; and other rights under applicable law.

8.1. Self-service access and correction on the system

• Log in to 1Zone and access the "Account," "Personal Profile," "Settings," or equivalent function to check and update the information fields the system allows.
• For order, ticket, attendee, or invoice information already issued, the ability to self-edit may be limited to preserve the integrity of the transaction. Users should submit a support request as described in Section 8.2.
• Users may use the "Forgot Password" function or another verification method provided by 1Zone to regain access to their account.

8.2. Submitting a request to Eventista

Users may submit a request via email to support@eventista.vn, by calling the Hotline 0832338688, or by sending a written request to the address in Section 16. The request should include: full name; registered email/phone number; account ID or order/ticket code (if any); the right to be exercised; the relevant data; the content to be corrected/deleted/restricted; and any necessary verification documents.

To prevent unauthorized disclosure or alteration of data, Eventista may require identity verification, proof of representative authority, or additional information. Eventista confirms receipt of the request within a reasonable time and processes it within the statutory period. Where a request is complex, affects the rights of other parties, or requires coordination with an Event Organizer/provider, Eventista will notify the progress and reason for any extension.

Eventista may refuse or limit the fulfillment of a request if it cannot verify the requester, if the request infringes the lawful rights and interests of others, if the data must be retained by law, if the request shows signs of abuse, or in other cases where the law permits refusal. Eventista will explain the grounds to the extent possible.

Withdrawing consent or requesting the deletion/restriction of data does not affect the lawfulness of processing carried out before that time. If the data is a necessary condition for providing the service, Eventista may discontinue part or all of the service after notifying the User.

9. MECHANISM FOR RECEIVING AND HANDLING COMPLAINTS ABOUT MISUSE OF INFORMATION

When personal information is discovered or suspected to have been collected, used, shared, accessed, or stored for improper purposes, beyond the notified scope, or without adequate safety, Users may file a complaint following the process below:

Step 1 - File a complaint: Send an email to support@eventista.vn, call the Hotline at 0832338688, or send a written request to the address in Section 16. The content should clearly state contact information, the related account/transaction, a description of the incident, when it was discovered, the party suspected of accessing the data, the consequences, and any supporting evidence.

Step 2 - Receipt and verification: Eventista's responsible department records the complaint, verifies the complainant, classifies its severity, preserves logs and evidence, and may temporarily restrict related access rights or processing activities if necessary to prevent further harm.

Step 3 - Coordinated handling: Eventista works with internal departments, the Event Organizer, the seller, the payment provider, technology providers, or other relevant parties to determine the cause, the scope of data involved, and each party's responsibility.

Step 4 - Response and remediation: Eventista aims to respond with results within 7 working days from receipt of all necessary information. Complex cases may take longer; Eventista will notify the reason and the expected timeframe. Remedial measures may include stopping the improper processing, locking or revoking access rights, correcting/deleting data, notifying parties that received the data, restoring the account, strengthening security, issuing an apology, providing compensation, or other measures as agreed and permitted by law.

Step 5 - Referral to the competent authority: If the parties cannot reach a resolution, or the matter shows signs of a legal violation, Users have the right to file a complaint, denunciation, or lawsuit, or to request handling by a competent authority. Eventista will cooperate and provide information as lawfully required.

Principle of responsibility: The fact that an incident is directly caused by an Event Organizer or a provider does not exclude Eventista's responsibility within the scope of its role and obligations. Eventista will proactively coordinate and will not require Users to individually contact multiple parties where Eventista can help coordinate the handling of the matter.

10. SECURITY MEASURES AND DATA INCIDENT HANDLING

Eventista applies organizational and technical measures appropriate to the nature, scale, and risk level of its processing activities, which may include:

• Role-based access control; management of privileged accounts; authentication and login control; periodic access review.
• Encryption or appropriate protective measures during transmission and storage; backups; system monitoring; access logs; anomaly-detection mechanisms.
• Testing, updating, and patching vulnerabilities; environment segregation; change control; business-continuity and disaster-recovery planning.
• Internal regulations, confidentiality commitments, staff training; vendor assessment; data-processing clauses and incident-notification obligations in contracts.
• Procedures for receiving, classifying, containing, investigating, remediating, and reporting incidents; coordinating with competent authorities and notifying Data Subjects when required by law.

No system is completely secure. Users should set strong passwords, not share OTP codes or ticket/QR codes, log out of shared devices, check the domain name before entering information, and notify Eventista immediately if they suspect unauthorized access to their account.

11. COOKIES AND TRACKING TECHNOLOGIES

1Zone may use cookies, local storage, SDKs, pixels, and similar technologies to operate the system. The main categories include:

Essential cookies: maintain the login session, shopping cart, language preference, security, and core functions; disabling them may cause certain services to stop working.

Performance and analytics cookies: measure visits, errors, speed, usage journeys, and feature effectiveness in order to improve 1Zone.

Personalization cookies: remember preferences and suggest more relevant content.

Advertising/campaign-measurement cookies: used, where an appropriate basis exists, to measure advertising, limit frequency, and support the delivery of relevant content.

Users can manage cookies through the tool on 1Zone (if provided) or through browser/device settings. Refusing non-essential cookies does not affect the right to use core functions, but may reduce personalization or measurement capability.

12. MARKETING COMMUNICATIONS AND THE RIGHT TO OPT OUT

Eventista only sends marketing emails, SMS, calls, or notifications based on the User's choice or an appropriate legal basis. Consent to receive marketing communications is separate from the consent necessary to create an account or complete a transaction, except where the law permits otherwise.

Users can opt out via the "Unsubscribe" link in the email, the instructions provided in the message, notification settings in their account, or by contacting support@eventista.vn. Eventista may continue to send non-promotional service notifications, such as tickets, receipts, schedule changes, security alerts, or support responses.

13. DATA OF CHILDREN AND DATA PROVIDED BY A USER ON BEHALF OF ANOTHER PERSON

13.1. When a service or event is intended for children or involves a person below the age prescribed by law, Eventista and the Event Organizer will apply appropriate mechanisms to notify and obtain input from the parent or guardian when necessary. Eventista limits the collection of children's data to what is necessary for the transaction, safety, and attendance rights.

13.2. If a User books tickets, makes a purchase, registers to attend, or provides data on behalf of another person, the User undertakes that they have informed that person of the necessary content and have the lawful right to provide the data. Users must not provide another person's data for unlawful purposes or purposes unrelated to the transaction.

13.3. Where Eventista discovers that data was provided without authorization or is otherwise inappropriate, Eventista may request verification, restrict processing, or delete the data as prescribed.

14. CROSS-BORDER TRANSFER OF PERSONAL DATA

To operate infrastructure, send notifications, ensure security, process international payments, conduct analytics, or provide services for events with a foreign element, data may be stored, accessed, or processed in a country/territory outside Vietnam by Eventista or its providers. Eventista fulfills the requirements on impact assessment, records, contracts, protective measures, and other procedures under the Law on Personal Data Protection, Decree No. 356/2025/ND-CP, and related law.

Eventista requires the recipient to process data only for the agreed purposes, maintain an appropriate level of protection, control onward transfers, and support Eventista in fulfilling the rights of the Data Subject.

15. PUBLICATION OF THE POLICY, RECORDING OF CONSENT, AND POLICY UPDATES

15.1. Display before or at the time of collection

This Policy is placed in an easily accessible location on 1Zone and is linked at every point where data collection occurs, including at minimum: the registration/login page; the ticket-booking or purchase page; the voting page; event forms; the checkout step; the support-request page; and the interfaces designated for Event Organizers/sellers.

Before the User clicks the button to create an account, place an order, make a payment, submit a form, or perform an equivalent action, 1Zone displays a brief notice about the purpose, type of data, key recipients, and a link to the Policy. For activities requiring consent, 1Zone records a clear act of consent and keeps a record of the Policy version, time, and method of consent.

15.2. Separate consent for optional purposes

Purposes not necessary to perform a transaction - such as receiving advertising, sharing data with the Event Organizer for independent marketing, or processing sensitive data - must have their own appropriate opt-in choice. Declining an optional purpose must not prevent the User from purchasing tickets or using core services, unless that data is genuinely necessary for the requested service.

15.3. Amendments to the Policy

Eventista may update this Policy to reflect changes in law, technology, or service models. The new version is posted on 1Zone together with the update date. Material changes that significantly affect Users' rights will be notified through an appropriate method; Eventista will seek renewed consent if required by law or if the new processing purpose is incompatible with prior consent.

16. INFORMATION OF THE DATA-COLLECTING AND MANAGING ENTITY

Users may use the above channels to ask about the collection and processing of data relating to them; to request access, correction, deletion, restriction, or objection to processing; to withdraw consent; or to file a complaint about information being used for improper purposes or beyond scope.

APPENDIX 1. SAMPLE NOTICES AND CONSENT CHECKBOXES AT COLLECTION POINTS

The content below is a sample implementation for the interface. Eventista may adjust it concisely for each function, provided that the nature of the purpose, type of data, and Users' rights are not changed.

1. Sample for the account registration page

Notice: Eventista collects your full name, email, phone number, and authentication information to create, protect, and maintain your 1Zone account; to send service notifications; and to support Users. Data is processed in accordance with 1Zone's Policy on Protection of Personal Information and Personal Data Processing.

• Mandatory checkbox: "I confirm that I have read and agree to 1Zone's Terms of Use and Policy on Protection of Personal Information."
• Optional checkbox, not pre-checked: "I agree to receive information about events, offers, and products from Eventista via email/SMS/notification."

2. Sample for the ticket-booking or purchase step

Notice: Information about the buyer/recipient, contact details, order, and transaction is used to process the order, issue tickets or arrange delivery, process payment, reconcile, provide support, and resolve complaints. Necessary information will be shared with the relevant Event Organizer, seller, payment provider, or delivery partner.

• Mandatory checkbox: "I have checked my order information and agree for Eventista to process the necessary data to complete the transaction in accordance with 1Zone's Policy."
• If the Event Organizer wants to use the data for independent marketing, a separate checkbox is required: "I agree for [Organizer Name] to use my [email/phone number] to send marketing information in accordance with [Organizer Name]'s policy."

3. Sample for the voting page

Notice: Eventista processes account information, transaction data, votes, device/IP data, and authentication logs to accurately record results, reconcile payments, provide support, and prevent fraud. Data is shared only with the Organizing Committee and the providers necessary within the scope of the program.

4. Sample data-processing consent confirmation

Confirmation content: I confirm that I have been provided with, and have read, 1Zone's Policy on Protection of Personal Information and Personal Data Processing. I understand the types of data that may be collected, the purposes and methods of processing, the parties that may access it, the retention period, the risks that may arise, my rights, and the channels to contact Eventista. By confirming this on the interface, I agree for Eventista to process my data to the extent necessary for the function/transaction I have chosen. I understand that I may withdraw my consent for purposes based on consent, but that withdrawal does not affect the lawfulness of processing carried out before that time and may interrupt the service if the data is a necessary condition for providing it.

5. Technical requirements when recording consent

• Do not use pre-checked boxes for purposes requiring active consent.
• Separate the consent necessary to perform a transaction from consent to marketing, sharing for independent purposes, or processing of sensitive data.
• Record the Policy version, the time, the account/device, the notice content, and the act demonstrating consent.
• Allow Users to review and withdraw consent through a method as easy as the one used to give it.
• For forms designed by the Event Organizer itself, Eventista must require the Organizer to clearly state its role, purpose, recipients, and the channel for exercising data rights.

APPENDIX 2. CONTENT OF A REQUEST TO EXERCISE RIGHTS OVER PERSONAL DATA

Users may copy the template below into an email sent to support@eventista.vn. Eventista may request additional information to verify identity and the scope of the request.

This Policy takes effect from the date it is published by Eventista on 1Zone and replaces any prior content on the protection of personal information on 1Zone to the extent of any conflict.

EVENTISTA COMPANY LIMITED