PRIVACY POLICY

Personal Data Protection Policy — at Ha's / at Ha’s Saigon (HAANDTHA Trading and Services Company Limited)

Effective Date: [01/10/2025] • Last Updated: [20/07/2026]

Welcome to HAANDTHA Trading and Services Company Limited (Tax Code: 0319163979), with its head office located at Mezzanine Floor - 1st Floor, 187/14–15 Dien Bien Phu Street, Tan Dinh Ward, Ho Chi Minh City, Vietnam, operating under the brands “at Ha's” / “Athas Saigon”/”Turmeric Boutique” (“HAANDTHA”, “we”, “us”), the owner and operator of the website athassaigon.com / turmericafteryoga.com  and the at Ha's Studio (the “Application”).

We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains what personal data we collect, why we collect it, how we use, store, and protect such data, with whom we may share it, and the rights you have regarding your personal data, in accordance with the Law on Protection of Consumers’ Rights No. 19/2023/QH15, Decree No. 13/2023/ND-CP on Personal Data Protection, and other applicable laws of Vietnam.

“You” or “Data Subject” means any individual who registers, contacts, or interacts with HAANDTHA in any form.

“Personal Data” means information in the form of symbols, text, numbers, images, sounds, or similar formats in an electronic environment that is associated with or helps identify a specific individual, such as full name, date of birth, and contact information.

By using our Services, registering for classes, or accessing the Application, you acknowledge that you have read and understood this Privacy Policy.

Where we rely on your consent as the legal basis for processing your data (as described in Section 9), we will obtain such consent separately and specifically. Your consent to marketing activities or purposes that are not necessary for providing the Services you request will never be a mandatory condition for using our Services.

However, certain Personal Data is necessary for us to perform our contractual obligations with you (for example, to record bookings or process payments). If you do not provide such required data, we may be unable to provide the corresponding Services to you. We will inform you which information fields are mandatory for this reason.

1. TYPES OF PERSONAL DATA WE COLLECT

We collect Personal Data when you access or contact us through the Application; participate in promotions or marketing activities; use our Services; register for membership; submit forms or applications; enter into agreements with us; use our electronic services; link your account with a social media account; or otherwise provide Personal Data to us.

Depending on the circumstances, the Personal Data we collect may include:

• Full name; date of birth; phone number; email address;

• Billing address and delivery address (if applicable);

• Bank account and payment information (processed by our payment partners; HAANDTHA does not store full card details);

• Device information transmitted when you access the Application;

• Network information, including contact lists where you have permitted access on your device, and accounts you interact with;

• Images, audio, or video recordings were collected with your knowledge (for example, at Studio events) or otherwise notified to you;

• Communication preferences and records of communications with us;

• Usage and transaction information, including booking history and browsing activity on the Application;

• Location data, where you have enabled permission on your device; and

• Aggregated usage statistics.

Some of the data listed above may constitute sensitive personal data under Vietnamese law.

We will only process sensitive personal data where we have obtained your separate and specific consent, unless such processing is necessary to protect your life or health, or falls within another exception permitted under Decree No. 13/2023/ND-CP.

At present, we do not intentionally collect biometric identification data. Where your device uses biometric authentication to access the Application, such authentication is performed locally on your device, and HAANDTHA does not receive or store such biometric data.

2. AUTOMATICALLY COLLECTED DATA AND COOKIES

2.1 As with most websites, our servers automatically record certain technical information when you use the Application, which may include your IP address, device operating system, browser type, device identifier, referring page (if applicable), pages you visit, and the time of access.

If you are logged in, this information may be associated with your account. Such information may also be used in aggregated and anonymized form to help us understand how the Application is used and improve our Services.

2.2 The Application uses cookies, including analytics cookies described in Section 7 below, to remember your preferences and understand how the Application is used.

You may disable cookies at any time through your browser settings. Please note that some features of the Application may not function properly if you choose to disable cookies.

3. CCTV SURVEILLANCE SYSTEM AT THE STUDIO

HAANDTHA installs a CCTV security system in the common areas of the Studio for the purposes of maintaining general safety and order, protecting the legitimate rights and interests of HAANDTHA, its employees, and Customers, as well as preventing, detecting, and investigating violations of Studio rules or applicable laws.

CCTV footage will only be retained for as long as necessary to fulfill the purposes stated above (or longer where required for a specific investigation, dispute, or legal request) and may only be accessed by authorized personnel.

4. PURPOSES OF PERSONAL DATA PROCESSING

We collect, use, disclose, and process your Personal Data for the following purposes:

• Identifying, authenticating, and verifying your information;

• Providing customer service, fulfilling your requests, maintaining communication, and responding to your inquiries regarding the Application and Services;

• Managing, operating, and providing Services and managing your account with us;

• Processing and completing transactions, and notifying you of service-related matters or unusual account activities;

• Where you have provided separate consent, sending you marketing communications, promotions, and advertising relating to HAANDTHA’s products and services, as well as those of carefully selected partners, which you may opt out of at any time as described in Section 9;

• Resolving issues arising from your use of the Application;

• Preparing statistics and conducting research for internal reporting purposes or as required by law;

• Data storage, system administration, disaster recovery, and ensuring business continuity;

• Investigating incidents and resolving disputes or complaints;

• Responding to actual claims or complaints made against HAANDTHA, or complaints relating to third-party content;

• Detecting, preventing, investigating, and handling violations of our policies or Vietnamese law; and

• Complying with applicable laws and requirements of competent state authorities, including obligations relating to information disclosure, reporting, record retention, and auditing.

If any new purpose of processing arises that is not described above, we will notify you of such purpose when obtaining your consent (where consent is the applicable legal basis), unless the processing is permitted by law to be carried out without your consent.

5. PROTECTION AND STORAGE OF PERSONAL DATA

5.1 We implement reasonable technical and organizational measures to protect your Personal Data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5.2 We retain your Personal Data only for as long as necessary to fulfill the purposes described in this Policy, or for a longer period where necessary to:

• resolve actual complaints or requests;

• investigate fraud or internal misconduct;

• detect, prevent, or investigate violations of our policies or applicable laws;

• comply with legal requirements (such as tax and anti-money laundering regulations); or

• resolve disputes.

When none of the grounds set out in this Section 5.2 continue to apply, we will delete or anonymize your Personal Data, or process your data in accordance with any valid request made by you under Section 8.

5.3 If you stop using the Application, or your access rights are suspended or terminated, we may continue to retain, use, and/or disclose your Personal Data in accordance with this Policy and applicable laws, provided that one of the grounds set out in Section 5.2 remains applicable.

6. SENSITIVE PERSONAL DATA

We understand that sensitive personal data is closely associated with privacy rights and that improper use of such data may directly affect your legitimate rights and interests.

Therefore, we do not collect or process your sensitive personal data without obtaining your separate consent for each specific purpose where such processing arises.

Where your device uses biometric data to authenticate access to the Application, such authentication is performed on your device, and HAANDTHA does not collect or process such biometric data.

7. INFORMATION COLLECTED BY THIRD PARTIES

7.1 Google Analytics. The Application uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”), which uses cookies to help us understand how visitors use the Application.

The information generated by cookies regarding your use of the Application (including your IP address) may be transmitted to and stored by Google on servers located in the United States. This information is used to evaluate the use of the Application, prepare activity reports, and provide other services relating to Application activity and Internet usage.

Google may transfer this information to third parties where required by law or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google.

You may prevent Google Analytics from recognizing you during future visits by disabling cookies in your browser settings.

7.2 Other Third-Party Applications. From time to time, HAANDTHA or third parties may provide downloadable applications or integrations available for use through the Application.

These applications may independently access, or allow third parties to access, certain identifying information such as your name, user ID, device IP address, and other information, and may use their own cookies or similar technologies.

Products and services provided by third parties through these applications are not owned or controlled by HAANDTHA. Please review the relevant third party’s own terms and privacy policies for information regarding their data practices.

8. YOUR RIGHTS AND OBLIGATIONS

8.1 Your Rights

You have the following rights regarding your Personal Data, unless otherwise provided by applicable law:

• The right to be informed about the processing of your Personal Data, except where otherwise provided by law;

• The right to provide or refuse consent for the processing of your Personal Data, except where otherwise provided by law;

• The right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal;

• The right to access and/or request correction of the Personal Data we store or control. If you have registered an account, you may access and update most of your Personal Data through your Account Settings. If you do not have an account, you may submit a written request to athas.saigon@gmail.com. We may need to verify your identity and the nature of your request, and we may charge a reasonable fee (which will be notified to you in writing in advance) for processing an access or correction request. We are not required to proceed with such request until you have agreed to the applicable fee;

• The right to request deletion of your Personal Data, except where otherwise provided by law;

• The right to request restriction of the processing of your Personal Data, except where otherwise provided by law;

• The right to request provision of your Personal Data, except where otherwise provided by law (a reasonable fee may apply and will be notified to you in writing in advance);

• The right to object to the processing of your Personal Data, except where otherwise provided by law;

• The right to lodge complaints, reports, or initiate legal proceedings in accordance with applicable laws;

• The right to request compensation for damages in accordance with applicable laws where a violation of regulations on the protection of your Personal Data occurs, unless otherwise agreed by the parties or otherwise provided by law; and

• The right to protect your own rights in accordance with applicable laws, or to request competent authorities to take measures to protect your civil rights on your behalf.

8.2 Your Obligations

You have the following obligations regarding Personal Data:

• To protect your own Personal Data and request relevant organizations or individuals to protect your Personal Data;

• To respect and protect the Personal Data of others;

• To provide complete and accurate Personal Data when you consent to its processing;

• To participate in promoting and sharing knowledge and skills relating to Personal Data protection; and

• To comply with applicable laws on Personal Data protection and participate in preventing and combating violations.

8.3 Circumstances Where We May Not Be Able to Fully Fulfill Your Request

We will handle your requests under Section 8.1 promptly and in accordance with applicable laws.

In certain limited circumstances permitted by law, we may not be able to fully fulfill your request. For example, where we have a legal obligation to retain records relating to you, a contract, or a transaction (such as tax records), or where processing is necessary to perform an existing contract with you, or to protect your life, health, or the life and health of another person.

In such cases, we will inform you which part of your request cannot be fulfilled and the reason for such limitation, while continuing to fulfill the remaining parts of your request where possible.

9. MARKETING COMMUNICATIONS, PRODUCT INTRODUCTIONS AND ADVERTISING

Where required by law, we will obtain your consent before processing your Personal Data for the purpose of sending you marketing communications, product introductions, or advertisements, including personalized product recommendations that we believe may be of interest to you.

Such processing will be conducted on the basis that you are clearly informed of the content, communication channels, methods, and frequency applicable to each relevant product or program, in accordance with applicable laws.

HAANDTHA, its business partners, and marketing partners may use the information you have provided to promote HAANDTHA’s products and services, as well as those of carefully selected third parties, through various electronic and non-electronic channels.

You may unsubscribe from marketing communications at any time by using the unsubscribe link provided in marketing emails or by contacting us using the information set out in Section 13.

10. WITHDRAWAL OF CONSENT, REQUESTS FOR RESTRICTION OR OBJECTION TO DATA PROCESSING

You may withdraw your consent, request restriction of, or object to the collection, processing, use, and/or disclosure of your Personal Data that we hold or control by sending an email to athas.saigon@gmail.com.

We will process your request in accordance with this Policy and applicable laws. If we are unable to fulfill any part of your request due to one of the limited circumstances set out in Section 8.3, we will explain the reason to you.

11. CROSS-BORDER TRANSFER OF PERSONAL DATA

Your Personal Data may be transferred, stored, or processed outside the territory of Vietnam for one or more of the purposes described in Section 4 (for example, where our service providers, such as Google, operate servers located overseas).

We will only transfer your Personal Data overseas in compliance with Vietnamese laws on personal data protection, including conducting impact assessments and submitting cross-border data transfer notifications where required.

12. WHO YOUR DATA MAY BE SHARED WITH

HAANDTHA does not sell your Personal Data and does not disclose your Personal Data (or combined personal and demographic information, or information about your use of the Application) to third parties, except in the following circumstances:

• Where you have provided your consent;

• To companies or individuals engaged by us to perform functions on our behalf, such as web hosting, data analysis, marketing support, payment processing, and customer service. These parties may only access your Personal Data to the extent necessary to perform their functions, are contractually required to protect such data to a standard equivalent to ours, and are not permitted to share your Personal Data with any other third party;

• Where required by law, requested by a competent state authority, or where we reasonably believe disclosure is necessary to: comply with legal proceedings; protect the rights or property of HAANDTHA or its partners; prevent crime or protect national security; or protect the personal safety of Users or the public; and

• To a recipient that acquires all or a substantial part of HAANDTHA’s business through a merger, acquisition, asset purchase, or, in the event of bankruptcy proceedings, pursuant to an order of a competent court. In all cases, the recipient must undertake to maintain confidentiality and protect your data to a standard equivalent to this Policy.

13. CHILDREN’S PERSONAL DATA

Online transactions through the Application are not designed for or directed at children under 16 years of age.

The use of online Services by individuals under 16 must be carried out under the close supervision of, and through, their parent or legal guardian.

We do not knowingly collect or retain Personal Data of individuals under 16 years of age without verified consent from their parent or legal guardian.

Where a parent or legal guardian provides us with Personal Data of a child under 16 under their guardianship, such parent or legal guardian is deemed to have provided consent for the processing of such data on behalf of the child and shall be subject to this Policy on the child’s behalf.

If we discover that we are holding Personal Data of a child under 16 without valid parental or guardian consent, we will suspend the relevant account and delete such data.

For contract purposes and liability waiver requirements, a parent or legal guardian must sign on behalf of any Customer under 18 years of age, as specified in the Membership, Booking & Studio Rules.

14. POTENTIAL CONSEQUENCES OF EXERCISING YOUR RIGHTS

As described in this Policy, you have certain legal rights that you may exercise in relation to our processing of your Personal Data.

Depending on the nature and scope of your request, as well as its impact on the relationship between you and HAANDTHA, we may require a reasonable period of time to process your request and/or notify you of any potential consequences.

Specifically:

• Depending on the nature and scope of your request, we may no longer be able to continue providing certain Services to you. Where required by law, we will inform you before completing the processing of your request; and

• In certain circumstances, we may not be able to fully accept or fulfill your request, for example, in the circumstances described in Section 8.3, or where you request deletion of Personal Data that we are legally required to retain as part of records relating to you, a contract, or a transaction.

15. START AND END OF PERSONAL DATA PROCESSING

We begin processing your Personal Data as soon as we receive it and continue processing such data until it is deleted or destroyed in accordance with applicable laws and/or our internal policies and decisions from time to time.

16. CONTACT REGARDING PERSONAL DATA PROTECTION

HAANDTHA Trading and Services Company Limited

Operating under the brands at Ha's / at Ha's Saigon / Turmeric Boutique

M & 1st Floor , 187/14–15 Dien Bien Phu Street, Tan Dinh Ward, Ho Chi Minh City, Vietnam

Email: athas.saigon@gmail.com  |  Phone: 090 669 0401 / 090 397 0921  |  Website: athassaigon.com

17. CONTACT US

You may contact us by email at athas.saigon@gmail.com, or visit us directly at Level M, 187/14–15 Dien Bien Phu Street, Tan Dinh Ward, Ho Chi Minh City, Vietnam.

If you no longer wish to receive marketing communications from HAANDTHA, please click the Unsubscribe link provided at the bottom of each marketing email.

Acting under the authorization and appointment of the Director of HAANDTHA Trading and Services Company Limited.