Privacy and Personal Data Protection Policy

ZEVO JOINT STOCK COMPANY

Effective Date: September 9, 2026 · Last Updated: September 9, 2026 · Version 1.0

Published at: https://zevohq.ai/legal/privacy (Vietnamese version: https://zevohq.ai/vi/legal/privacy)

This English version governs for Customers outside Vietnam. For Customers in Vietnam, the Vietnamese version at https://zevohq.ai/vi/legal/privacy prevails in case of any discrepancy. This translation is provided for reference.

This Personal Data Protection Policy (the "Policy") explains how ZEVO JOINT STOCK COMPANY ("Zevo AI", "we", "us" or "our") collects, uses, discloses, retains and protects personal data when you access or use Zevo's AI employee platform (the "Service") — an AI system that receives and replies to customer messages, advises, assists with closing orders, books appointments and delivers daily KPI reports across channels such as Facebook, Zalo, TikTok and websites.

By using the Service, you confirm that you have read and understood this Policy. If you do not agree, please do not use the Service.

1. Who we are (Data Controller and Data Processor)

• Legal name: ZEVO JOINT STOCK COMPANY (CÔNG TY CỔ PHẦN ZEVO)
• Product name: Zevo AI - AI Staffing Platform
• Registered address: No. 32, Lane 100 Doi Can, Ngoc Ha Ward, Hanoi City, Vietnam
• Privacy contact: privacy@zevohq.ai
• General support: support@zevohq.ai

Zevo AI's role in data processing

• Zevo AI is the Data Controller for the account data of business Customers (name, email, login credentials, billing information, etc.).
• Zevo AI is the Data Processor for end-customer data (message content, name, phone number, address, orders, appointments, etc.).
• The business Customer is responsible for establishing the legal basis for that processing and for publishing its own privacy policy to its end customers.

Zevo AI operates principally in Vietnam. This Policy is designed to comply with Vietnamese law, in particular the Law on Personal Data Protection No. 91/2025/QH15 (effective 1 January 2026) (the "PDPL") and Decree No. 356/2025/ND-CP implementing it ("Decree 356").

2. Scope of this Policy

This Policy applies to personal data we process when you:

• Visit the Zevo AI website or marketing pages;
• Create or use a Zevo AI account for staffing purposes;
• Use the 24/7 online chat features to interact with our AI staffing team;
• Receive advisory and order-closing support from the platform;
• Receive daily KPI reports from the Service;
• Communicate with us (support, sales, feedback);
• Receive marketing communications from us.

This Policy does not apply to personal data processed by the third-party platforms you may connect to the Service (such as Facebook, Zalo, TikTok) — those platforms are governed by their own privacy policies.

3. Information we collect

3.1 Information you provide directly

• Account information: full name, email, password (stored only as a one-way hash and not recoverable to the original password), company name, job title, contact phone number.
• End-customer data: when you use the Service to receive and reply to customer messages, to advise or to close orders, we collect conversation content, names, platform IDs (Facebook ID, Zalo ID, etc.), phone numbers, emails, delivery addresses, order information, appointments and other information customers provide during the interaction.
• Google Calendar appointment data: if you connect a Google account, we access your calendars and events to check free slots and to create, modify or cancel appointments at your request (permission scopes are limited to what is necessary).
• Payment information: our payment service provider acts as merchant of record and collects payment information, billing address, tax/VAT identification and card details directly from you at its payment gateway. We never receive or store your card number.
• Communication content: the content of messages you send to support, survey responses and feedback.

3.2 Information collected automatically

• Server logs: IP address, browser user-agent string, requested address and request time, recorded by our web and application servers.
• Service traces: records of AI model calls made to answer requests, including the message content sent, the response returned, which model processed it and the cost.
• Cookies: see Section 11.

We do not use advertising services or session replay. We may use third-party usage-measurement and technical error-reporting tools (acting as Data Processors) to improve the Service. Those tools collect only aggregated or anonymised data and are bound by data protection agreements. The current list of such tools is available on request at privacy@zevohq.ai.

3.3 Information from third parties

• We receive subscription and payment status, invoices and stored-card summary information from our payment provider.
• If you choose to sign in with Google or Facebook, we receive the email address, name and avatar URL from that account and store them on your account profile. We use them only to create and identify your account.

Beyond the information above and the platform data described, we do not collect personal data from anyone else: we do not buy personal data and we do not receive data from data brokers, analytics vendors or identity-verification providers.

4. How we use your information (purposes and legal bases)

We process your personal data for the purposes below. The principal legal basis for our processing is your consent under Article 9 of the PDPL, given when you create an account, accept this Policy or interact with the Service.

Where processing is based on your consent, you may withdraw that consent at any time as described in Section 9. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We do not use the data we receive to train general-purpose AI models, sell it to data brokers, or for any purpose unrelated to providing the Service to you.

5. How we share your information

We share personal data only as described below. We do not sell personal data.

• Service providers (processors) acting on our instructions and bound by data protection terms: cloud hosting, databases, customer support tools, email delivery and payment processing.
• AI model providers that generate the responses, recommendations and analyses you ask the Service to produce. Content sent to the model provider is used solely for inference — generating the response text returned to you. We do not permit that content to be used to train third-party AI models.
• Other integrations you connect (where supported), only when you authorise the connection.
• Professional advisers (lawyers, auditors, accountants) under duties of confidentiality.
• Legal and safety disclosures: where required by law or court order, or to protect the rights, property or safety of us, our users or others.
• Corporate transactions: in connection with a merger, acquisition, restructuring or sale of assets, subject to standard confidentiality terms.

The current list of sub-processors is available on request at privacy@zevohq.ai.

5.1 Compliance with the Google API Services User Data Policy (Limited Use)

Zevo AI's access to and use of data from Google APIs (including Google Calendar and Google Login) strictly complies with the Google API Services User Data Policy, including the following Limited Use restrictions:

• Calendar data and user information received from Google are used only to provide and improve the appointment-booking and sign-in features for Customers.
• Google data is not used for advertising, marketing or user profiling.
• Google data is not transferred to third parties beyond what is necessary to operate the Service.
• Google data is not used to train or develop general-purpose AI models.

6. Cross-border transfer of personal data

We are headquartered in Vietnam. To provide the Service, some of our service providers (for example email delivery, payment processing and AI model providers) process personal data outside Vietnamese territory, including in the United States, Singapore, the European Union and other countries.

In accordance with Article 20 of the PDPL and Decree 356, we will:

• (a) obtain your consent for cross-border transfers where required;
• (b) prepare a Cross-Border Personal Data Transfer Impact Assessment Dossier and submit an original to the specialised personal data protection authority — the Department of Cyber Security and High-Tech Crime Prevention (A05), Ministry of Public Security — within 60 days of the first cross-border transfer;
• (c) update that dossier as required by Article 22 of the PDPL and keep it available for inspection.

We also apply technical and organisational safeguards to protect transferred data, including encryption in transit and at rest, access controls and contractual data protection commitments from our service providers.

You can obtain a summary of our current cross-border transfer arrangements by contacting privacy@zevohq.ai.

7. Data retention

We retain personal data only for as long as necessary to provide the Service and for the purposes described in this Policy. Indicative retention periods:

• Account data: for the life of the account and up to 30 days after deletion (technical backups may persist for up to 12 months, used solely for disaster recovery and for no other purpose).
• Interaction data (chat, advisory, order closing): retained while your account is active and deleted within 30 days after you disconnect an integration or delete your account — except where retention is required by law or to prevent fraud. Technical backups may persist for up to 12 months for the same disaster-recovery purpose.
• KPI report data: aggregated and anonymised data may be retained longer for analysis and service improvement; personal data is deleted on the schedule above.
• Payment records: retained for the period required by applicable tax and accounting law (typically 5–10 years).
• Support communications: up to 3 years after the request is closed.
• Log and security data: typically 90–365 days.
• Employee data: under Article 25 of the PDPL, employees' personal data must be deleted upon termination of the employment contract, unless otherwise agreed or required by law.

8. How we protect your information

We implement appropriate technical and organisational measures designed to protect personal data, including: TLS encryption in transit, AES-256 encryption at rest for sensitive fields, role-based access control, least-privilege access control, audit logging, vulnerability scanning, dependency monitoring and regular backups. We require sub-processors to implement equivalent safeguards.

No system is completely secure. If we become aware of a personal data breach affecting your data, we will notify you and the competent supervisory authority where the law requires.

9. Your rights under the PDPL

As a data subject in Vietnam, you have the following rights under Article 4 of the PDPL, together with the right to withdraw consent or request restriction of processing under Article 10. You may exercise these rights at any time, free of charge, by following the process in Section 9.12 below.

9.1 Right to be informed

You have the right to be informed about the processing of your personal data, except as otherwise provided by law.

9.2 Right to consent

You have the right to consent to, refuse or object to the processing of your personal data, except where processing is permitted without consent under Article 19 of the PDPL.

9.3 Right of access

You have the right to access your personal data to view it, correct it or request its correction.

9.4 Right to withdraw consent

You have the right to withdraw consent at any time, except as otherwise provided by law. You may withdraw consent through your account settings or by emailing privacy@zevohq.ai.

9.5 Right to erasure

You have the right to request deletion of your personal data, except as otherwise provided by law. See Section 10 for the deletion process.

9.6 Right to request restriction of processing

You have the right to ask us to restrict the processing of your personal data. We will acknowledge and act on a valid request within the timeframes set by the PDPL and Decree 356, unless an exception applies.

9.7 Right to data provision

You have the right to ask us to provide your personal data to you, except as otherwise provided by law.

9.8 Right to object

You have the right to object to the processing of your personal data in order to prevent or restrict disclosure or use for advertising or marketing purposes, except as otherwise provided by law.

9.9 Right to complain, denounce and initiate legal proceedings

You have the right to complain, denounce or bring legal proceedings under Vietnamese law if you believe your personal data has been processed in breach of the PDPL. The competent authority is the Department of Cyber Security and High-Tech Crime Prevention (A05), Ministry of Public Security.

9.10 Right to claim damages

You have the right to claim damages for breaches of the personal data protection rules applicable to your data, in accordance with the law.

9.11 Right to self-protection

You have the right to apply self-protection measures or to request competent agencies or organisations to apply protective measures, in accordance with the Civil Code and related laws.

9.12 How to exercise your rights

Send a request to privacy@zevohq.ai or use the in-product "Privacy Requests" form. We will acknowledge your request promptly and complete it within the timeframes set by the PDPL and Decree 356. We may need to verify your identity before acting on a request.

Users outside Vietnam: if you access the Service from a country that grants you additional rights (for example the EU/UK under the GDPR, or California under the CCPA/CPRA), you may also exercise those rights to the extent they apply. Please contact us using the details above.

10. Data deletion instructions

You can delete the data we hold about you as follows:

• Email request: send a deletion request to privacy@zevohq.ai with the subject line "Data deletion request" and the email address linked to your account. Tell us whether you want everything deleted or only the data from a specific platform.

We do not operate a data-deletion status page. To check the status of a request or to obtain a confirmation reference code, please email privacy@zevohq.ai.

11. Cookies and similar technologies

We use cookies and similar technologies to:

• Keep you signed in (strictly necessary);
• Remember your preferences, such as language (functional).

We do not set advertising or analytics cookies.

12. Children's privacy

The Service is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. Under Article 24 of the PDPL, the rights of a child under 16 as a data subject are exercised by the child's legal representative. If you believe we have collected personal data from a child without the necessary consent, please contact us at privacy@zevohq.ai and we will delete that data.

13. Automated decision-making and AI features

Zevo AI provides AI-assisted responses and recommendations for your staffing interactions (24/7 online chat, advisory, order-closing support, appointment booking and KPI reports). These are decision-support tools — they do not produce legal or similarly significant effects for you without human review. Where automated decision-making with such effects does occur, you have the right to request human intervention, express your point of view and contest the decision.

14. Marketing communications

We may send service-related notices (which you cannot opt out of while you hold an account) and marketing communications about Zevo AI. You can opt out of marketing emails via the unsubscribe link in any marketing email or by contacting us. Where the law requires it, we will obtain prior consent.

15. Changes to this Policy

We may update this Policy from time to time. We will post the new version on this page with an updated "Last updated" date. For material changes, we will provide additional notice (for example by email or an in-product banner) at least 14 days before the changes take effect, where practicable.

16. Contact us

If you have any question, request or complaint about this Policy or about how we process your personal data, please contact:

• Privacy / personal data: privacy@zevohq.ai
• General support: support@zevohq.ai
• Post: ZEVO JOINT STOCK COMPANY, No. 32, Lane 100 Doi Can, Ngoc Ha Ward, Hanoi City, Vietnam.

The procedure for receiving and resolving feedback, requests and complaints is set out in Article 23 of the Terms and Conditions of Service (https://zevohq.ai/legal/terms).