Data Processing Addendum — Vietnam (Decree 13)

This Data Processing Addendum ("Addendum") supplements the BounceZero Data Processing Agreement ("Master DPA") and applies where the customer ("Controller", "you") submits for verification email addresses relating to data subjects in Vietnam. It sets out how BounceZero Ltd ("Processor", "we", "us") complies with Decree No. 13/2023/ND-CP on Personal Data Protection ("Decree 13") when acting as a data processor on your behalf. In the event of any conflict, the more protective obligation prevails.

1. Introduction

This Addendum forms part of the Master DPA. The terms defined in the Master DPA apply to this Addendum unless stated otherwise. Under Decree 13, "data controller" means you and "data processor" means BounceZero (Decree 13 Art. 2).

We process personal data on EU infrastructure (OVH, France). BounceZero does not maintain an establishment in Vietnam; this Addendum governs our processing of personal data of Vietnamese data subjects on your behalf.

2. Governing Law and Regulator

The processing described in this Addendum is governed, so far as the data subjects are in Vietnam, by Decree 13, in force since 1 July 2023, together with related instruments on cybersecurity and administrative sanctions. The authority responsible for personal data protection under Decree 13 is the Ministry of Public Security, through its specialised cyber security and high-tech crime prevention functions. Violations are subject to administrative sanctions under Vietnamese law.

3. Role and Scope

For the email verification services described in the Master DPA, you act as the data controller and we act as the data processor (Decree 13 Art. 2(7)-(8)). The subject matter, nature, and purpose of the processing are the same as set out in Section 2 of the Master DPA: syntactic validation, DNS/MX lookup, SMTP probing, catch-all detection, deliverability scoring, and fraud/abuse checks of the email addresses you submit.

We process personal data only on your documented instructions and never for our own benefit, except where applicable law requires otherwise.

4. Data Subject Rights

We will assist you in responding to requests from data subjects exercising their rights under Decree 13 (Arts. 9-12), including the rights to:

• Be informed of the processing of their personal data.
• Access their personal data and information about the processing.
• Withdraw consent to the processing.
• Request deletion or restriction of the processing of their personal data.
• Object to processing and to automated decision-making and profiling where these are used.
• Provide their data and request portability, on your instruction.

If a data subject contacts us directly, we will forward the request to you without undue delay and comply with your reasonable instructions. You are responsible for the legal basis of the processing, including consent, contractual necessity, or legal obligation as applicable.

5. Breach Notification

We will notify you of any personal data breach affecting the personal data you submitted, without undue delay and in any event within 72 hours of becoming aware of it, consistent with the Master DPA and the notification window under Decree 13 Art. 23. You, as the controller, are responsible for notifying the Ministry of Public Security and affected data subjects as required by Art. 23. We will provide the information needed to support your notification.

6. Cross-Border Transfers

Personal data of Vietnamese data subjects is processed on EU infrastructure. Exporting personal data outside Vietnam is subject to the conditions and procedures set out in Decree 13 Art. 25, including consent of the data subject, an impact assessment dossier, and notification to the Ministry of Public Security. We will co-operate with you in the preparation of any transfer dossier and will confirm in writing any facts about our processing that the dossier requires.

7. Additional Obligations

• DPIA support: where Decree 13 requires a data protection impact assessment (Art. 24), we will provide the information about our processing reasonably needed for you to complete it.
• Automated decisions: where email validation involves automated decision-making, we support the data subject rights associated with such processing under Arts. 9-10.
• Consent records: we retain the evidence of lawful processing instructions you rely on as your legal basis, for accountability purposes.
• Data minimisation: only the email addresses and derived metadata necessary for validation are processed.
• Audit: we will co-operate with reasonable audits conducted by you or your authorised auditor, on reasonable prior written notice.

8. Contact

For enquiries about this Addendum or to exercise rights in respect of the processing described here, contact our Data Protection contact:

You may also refer to the Master DPA and its terms on sub-processors, security measures, retention, and liability at bouncezero.io/dpa.