1. General Introduction

This Personal Data Protection Policy (“Policy”) is issued by Canis Group (“We” or the “Company”) for the purpose of setting out the principles, scope, and methods by which Canis Group collects, processes, stores, protects, and uses personal data of clients, partners, website visitors, and other relevant individuals (collectively referred to as “Data Subjects” or “You”).

Canis Group is committed to respecting privacy rights and protecting Your personal data in compliance with the applicable laws and regulations of Vietnam on personal data protection and other relevant legal provisions.

This Policy applies to:

• Visitors accessing the Canis Group website;
• Individuals submitting requests for legal consultation;
• Clients using legal services provided by Canis Group;
• Candidates applying for employment at Canis Group;
• Partners and individuals representing organizations engaging in transactions or cooperation with Canis Group.

2. Consent of Data Subjects

By:

• Accessing and using the Canis Group website;
• Completing and submitting information through electronic forms (“Contact Form”, “Email Us”, “Request Consultation” or similar online forms);
• Sending emails, documents, or information to Canis Group;
• Continuing to use the website after this Policy has been published;

You acknowledge that You have read, understood, and agreed to permit Canis Group to collect, process, and use Your personal data in accordance with the terms and conditions set out in this Policy.

The provision of personal data by You is entirely voluntary. However, in the event that You refuse to provide necessary information, Canis Group may not have sufficient grounds to receive, assess, respond to Your requests, or provide appropriate legal services.

3. Types of Personal Data Collected

Canis Group only collects personal data that is necessary and relevant to the specific purposes of processing.

3.1. Identification Data

Including but not limited to:

• Full name;
• Date of birth (where necessary);
• Title and position;
• Employer/organization;
• Other identification information voluntarily provided by You.

3.2. Contact Information

Including:

• Telephone number;
• Email address;
• Contact address;
• Other relevant contact details.

3.3. Data Relating to Legal Requests

Including:

• Contents of legal consultation requests;
• Description of legal matters;
• Legal documents and records provided by You;
• Information relating to transactions, disputes, or legal issues requiring assistance.

3.4. Recruitment Data

In cases where You apply for employment with Canis Group, collected data may include:

• Application documents;
• Curriculum vitae (CV);
• Qualifications and certificates;
• Professional experience;
• Other information necessary for recruitment purposes.

3.5. Technical Data

The Canis Group website may use necessary technical technologies, including Session Cookies, for the purposes of:

• Maintaining stable website operation;
• Supporting language display functions;
• Improving user experience.

Such technical data is primarily anonymous and will be automatically deleted upon termination of the browsing session.

4. Purposes of Personal Data Processing

Canis Group processes Your personal data for the following purposes:

4.1. Provision of Legal Services

Including:

• Receiving and responding to legal consultation requests;
• Conducting preliminary assessments of legal matters;
• Carrying out conflict-of-interest checks;
• Providing legal services in accordance with agreements entered into with clients.

4.2. Client Relationship Management

Including:

• Communicating and exchanging information regarding legal matters;
• Managing client records;
• Updating the status of legal matters.

4.3. Legal Updates and Communication Activities

Canis Group may use Your contact information for:

• Sending legal newsletters;
• Providing updates on new laws and regulations;
• Introducing legal services that may be relevant to Your needs.

You have the right to request the cessation of receiving such communications at any time.

4.4. Recruitment Activities

Including:

• Reviewing and evaluating applications;
• Contacting candidates;
• Retaining application records for future recruitment needs.

4.5. Compliance with Legal Obligations

Including:

• Performing reporting obligations;
• Providing information upon lawful requests from competent state authorities;
• Protecting the legitimate rights and interests of Canis Group.

5. Storage and Protection of Personal Data

Canis Group applies appropriate administrative, technical, and organizational measures to protect personal data against:

• Unauthorized access;
• Improper use;
• Unintentional disclosure;
• Unauthorized loss or destruction.

Personal data is stored within Canis Group’s internal management systems or on technical platforms operated by lawful service providers.

Where third-party data storage services are used, Canis Group requires such service providers to implement appropriate security measures in accordance with applicable laws and regulations.

6. Data Retention Period

Personal data shall be retained for the period necessary to:

• Fulfill the purposes of processing;
• Comply with legal obligations;
• Manage client relationships;
• Resolve disputes or complaints.

Canis Group may retain personal data for a longer period where necessary for:

• Compliance with accounting and tax regulations;
• Protection of legitimate rights and interests;
• Legal proceedings or dispute resolution.

When personal data is no longer necessary, Canis Group shall delete, destroy, or anonymize such data through appropriate methods.

7. Rights of Data Subjects

In accordance with applicable laws, You have the following rights:

• The right to be informed about personal data processing activities;
• The right to provide or withdraw consent for personal data processing;
• The right to request access to and correction of personal data;
• The right to request deletion of personal data where legally applicable;
• The right to lodge complaints, denunciations, or request competent authorities to protect Your lawful rights and interests.

8. Procedures for Exercising Data Subject Rights

All requests relating to personal data must be submitted in writing or through official email channels to Canis Group.

To ensure information security and accuracy, Canis Group reserves the right to:

• Request identity verification;
• Request documents proving the requester’s lawful authority;
• Refuse requests where sufficient grounds for verification are not provided.

The withdrawal of consent or request for deletion of personal data may affect Canis Group’s ability to continue providing legal services or responding to Your requests.

9. Disclosure and Sharing of Personal Data

Canis Group does not sell, exchange, or transfer Your personal data to third parties for commercial purposes.

Personal data may be disclosed or shared in the following circumstances:

9.1. Coordination for Provision of Legal Services

Including:

• Lawyers;
• Legal experts;
• Affiliated entities;
• Professional partners.

9.2. Operational Support

Including:

• Server providers;
• Data storage providers;
• Technology solution providers.

9.3. Compliance with Legal Requirements

Where:

• There is a lawful request from a competent state authority;
• Disclosure is necessary to protect Canis Group’s legitimate rights and interests.

9.4. Corporate Restructuring

Including cases of:

• Merger;
• Consolidation;
• Division;
• Transfer of business operations.

10. Disclaimer Regarding Data Security and Internet Risks

You acknowledge and understand that the Internet environment inherently contains security risks beyond the absolute control of any organization.

Accordingly:

10.1. Confidential Information Voluntarily Submitted by Clients

Canis Group recommends that You do not submit:

• Trade secrets;
• Confidential files;
• Sensitive documents;

through online forms before an attorney–client relationship has been formally established.

If You voluntarily provide such information, You acknowledge that You understand and accept the relevant risks.

10.2. Data Transmission Risks

Canis Group shall not be responsible for:

• Unauthorized interception of data;
• Transmission errors;
• Incidents arising from Internet infrastructure service providers.

10.3. Security of Personal Devices

Canis Group shall not be liable for any data loss arising from:

• Malware infection on Your devices;
• Spyware attacks;
• Security failures caused by users.

10.4. Force Majeure Events

Canis Group shall be exempt from liability where data incidents arise from:

• Deliberate and sophisticated cyber-attacks;
• Large-scale technical failures;
• Force majeure events beyond Canis Group’s reasonable control.

11. Third-Party Website Links

The Canis Group website may contain links to third-party websites.

Canis Group does not control and shall not be responsible for:

• Content;
• Privacy policies;
• Data processing activities;

of such third-party websites.

You are advised to carefully review the privacy policies of third-party websites before providing any personal information.

12. Amendments and Effectiveness of the Policy

This Policy shall become effective from the date of publication on the Canis Group website.

Canis Group reserves the right to amend, supplement, or update this Policy at any time to ensure compliance with:

• Applicable laws and regulations;
• Actual business operations;
• Internal governance requirements.

Your continued use of the website after any updates to this Policy shall be deemed as Your acceptance of such amendments.