PRIVACY NOTICE - TWOH EVENT PLATFORM
This Personal Data Protection Notice explains how HVN collects, stores, uses and shares consumers’ personal data on the TWOH Platform, in strict compliance with applicable personal data protection laws (“Personal Data Protection Law”).
GENERAL INFORMATION
1.1. Scope of application: This Notice applies to the processing of Users’ personal data in connection with Connection Point accumulation, gift redemption, interaction and ticket registration activities on the TWOH Platform.
1.2. Personal Data Controller: HEINEKEN VIETNAM BREWERY COMPANY LIMITED (“HVN”). Address: 18th and 19th Floors, Vietcombank Tower, No. 5 Me Linh Square, Ben Nghe Ward, District 1, Ho Chi Minh City, Vietnam, for all Personal Data collected through the TWOH Platform and related digital touchpoints (web application, QR codes, etc.).
1.3. Data Processors: To operate the TWOH Platform, HVN appoints the following partners as Data Processors, who process data only according to HVN’s instructions and authorization:
(i) Development & Hosting Provider: ALTA TECHNOLOGY AND MEDIA APPLICATIONS COMPANY LIMITED (Alta). Responsible for software development, operation and server hosting for the TWOH Platform.
(ii) OTP Messaging Platform: VIETGUY JOINT STOCK COMPANY (Vietguy). Responsible for sending SMS containing OTP account verification codes.
(iii) Program Operations Partners: Including, but not limited to, technology companies, software developers, data hosting providers, messaging providers, customer care providers, logistics providers, event organizers, subcontractors and other service partners appointed by HVN from time to time to operate the TWOH Platform. These entities may process data only according to HVN’s instructions and to the extent necessary to provide their services.
1.4. HEINEKEN International B.V.: Where data is used for aggregated global strategic analysis, HEINEKEN International B.V. will act as an Independent Data Controller.
WHAT INFORMATION DO WE COLLECT?
We classify the personal data collected according to the limited functionality of the TWOH Platform and in compliance with the Personal Data Protection Law:
2.1. Basic personal data:
Mandatory information (at registration): Full name and registered mobile phone number. These are the minimum information required to establish an account and issue a customer ticket.
Optional additional information (after registration): Date of birth, gender, email address and phone number. Customers may optionally provide additional information after logging in to complete their profile and receive additional reward points; this is not required at the initial registration stage. If a User does not provide this optional information, the User may still use all core Platform features (ticket registration, basic Connection Point accumulation/redemption), but will not receive the additional bonus points for profile completion.
System activity data: User ID, login logs, Connection Point accumulation history, gift redemption history, verification times and actions performed on the Platform.
Technical data: IP address, browser type, timestamps and activity logs for system security.
Image data: Images captured at the event or evidence of prize handover, and verification of participation requirements at the event experience areas.
2.2. Sensitive personal data:
The TWOH Platform undertakes NOT to intentionally collect or process Users’ sensitive personal data (such as racial origin, political opinions, health status, biometric data, criminal records, etc.).
2.3. Fraud prevention data:
Device trust scores and technical risk signals used to prevent fraudulent accumulation of points/rewards. These are technical indicators automatically calculated based on device usage behavior—for example, operation frequency and the number of accounts on the same device—and are not biometric data or used to identify an individual.
2.4. Automatically collected information and Cookies:
To simplify the system and enhance security, the TWOH Platform only uses strictly necessary technical cookies (Session Cookies) to maintain login sessions and protect the Platform. We do not use complex advertising cookies or third-party behavioral tracking cookies.
2.5. Commencement of data processing:
Personal data processing begins when the User enters account registration information, scans an event QR code, or performs any technical interaction with the TWOH Platform.
PURPOSES OF PERSONAL DATA PROCESSING
We process your personal data for the following specific purposes:
3.1. Platform operation & event program management: To support account creation, verify that Users are over 18, issue event tickets, record Connection Point accumulation at live experience activities, and carry out souvenir redemption.
3.2. Fraud prevention & system protection: To implement technical measures to detect, investigate and prevent unauthorized technical interference, point hacking, reward fraud or abuse of the gift redemption program.
3.3. Internal analysis & service improvement: To compile anonymized statistical reports on demographics (age, gender and actual attendance) to evaluate program effectiveness and improve the User experience.
3.4. Legal compliance: To fulfill obligations relating to reporting promotional programs, government audits and lawful requests for information from competent state authorities under Vietnamese law.
3.5. Future targeted marketing activities: If you consent by selecting the optional checkbox during registration, we will use your phone number or email address to introduce HEINEKEN products, services or targeted marketing programs at a reasonable frequency and in compliance with applicable laws governing marketing communications.
SHARING OF PERSONAL DATA
HVN undertakes not to sell customers’ personal data. Data will only be shared to the minimum extent necessary with entities authorized by HVN to operate the program, as detailed below:
4.1. IT & Hosting Operations Unit
AU LAC TECHNOLOGY APPLICATIONS AND MEDIA COMPANY LIMITED (Alta / Viettel IDC)
Role: Data Processor
Purpose & Scope of Sharing: Responsible for developing the application software, hosting the database servers, and providing technical operation and maintenance for the TWOH Platform.
Committed to maintaining data confidentiality and not using the data beyond the scope of the project.
4.2. SMS OTP Operations Unit
VIETGUYS JOINT STOCK COMPANY (VietGuys)
Role: Data Processor
Purpose & Scope of Sharing: Provides SMS messaging services containing OTP verification codes for users to verify their phone numbers when registering an account.
4.3. HEINEKEN Group & HEINEKEN International B.V.
Role: Independent Data Controller / Joint Controller
Purpose & Scope of Sharing: Stores data on the HEINEKEN Group's global shared server systems for the purposes of conducting technical security checks of the systems and supporting consolidated strategic business reporting, with appropriate cross-border data protection measures applied in accordance with applicable laws.
4.4. Competent State Authorities
Purpose & Scope of Sharing: Data may be provided upon lawful request to comply with legal obligations, audits, or investigations.
RETENTION AND DELETION OF PERSONAL DATA
5.1. Retention period: Personal data collected on the TWOH Platform will be securely stored and processed throughout the period during which the Platform/event program is actually operating.
5.2. Data deletion period after the event: Once the event program has fully ended, Users’ personal data will be retained in backup storage for legally required promotional audit purposes, after which it will be securely deleted or anonymized after 05 (five) years, unless a different retention period is required by law.
5.3. Right to request early deletion: Users may request deletion of their account and personal data at any time. HVN will delete or anonymize the data within the statutory period after receiving a valid request, except where retention is required by law, for dispute resolution or for ongoing fraud prevention.
PERSONAL DATA PROTECTION
We apply appropriate technical and organizational security measures (data encryption, strict access controls and DPA confidentiality agreements) to protect personal data against loss, unauthorized access, disclosure or alteration. Data access is granted only to personnel directly responsible for operating the Platform.
YOUR RIGHTS AND OBLIGATIONS
7.1. Your rights: In accordance with the Personal Data Protection Law, you have the following legal rights regarding your data: (a) the right to access and request provision of data; (b) the right to correct and supplement information; (c) the right to request deletion of data; (d) the right to withdraw consent; (e) the right to restrict data processing; (f) the right to object to data processing, including objection to direct marketing communications; and (g) the right to complain, report and initiate legal proceedings as provided by law.
7.2. Your obligations: (a) Provide complete and accurate personal information when participating in the TWOH Platform; (b) protect your own personal data and never share your account, password or OTP verification code with others; (c) respect other individuals’ personal data and do not impersonate another person when registering information; and (d) bear full responsibility for risks or losses arising from failure to protect your personal account information.
CHILDREN'S PRIVACY
The TWOH Platform and related programs are strictly not intended for individuals under 18. We do not actively or intentionally collect personal data from anyone under 18. If a User under 18 is found to have intentionally provided information without authorization, HVN reserves the right to immediately refuse service, permanently lock the account and delete all related data from the system without assuming any legal liability.
USER CONSENT AND CONFIRMATION MECHANISM
To ensure maximum voluntariness and transparency under applicable Personal Data Protection Law, the account registration and consent process is clearly divided into the following two separate items:
9.1. Checkbox No. 1 (Mandatory for event participation):
Displayed text: “I have read, understood and agree to HEINEKEN’s Terms of Use and Privacy Policy.”
Legal meaning: By selecting this checkbox, you consent to HVN collecting, processing and sharing your personal data for mandatory purposes necessary to operate the event, verify eligible age and process personal gift redemption. If you do not agree to this checkbox, you may not create an account or register for an event ticket because we will not have sufficient information required for these purposes.
9.2. Checkbox No. 2 (Optional – Marketing & Retargeting):
Displayed text: “I agree to HEINEKEN using my information for marketing purposes.”
Legal meaning: This checkbox is left blank by default (non-pre-ticked). You may choose to consent or decline while still registering for an event ticket and accumulating/redeeming Connection Points normally.
HEINEKEN will only conduct future targeted marketing communications at a reasonable frequency and in accordance with applicable laws after you actively select the consent checkbox.
CONSENT TO USE OF IMAGES AT THE EVENT
Photography and filming (footage, moments) within the TWOH event area are activities independent of personal data processing on the Platform and require separate consent from the User in addition to the two checkboxes in Section 9, through one of the following methods: (i) notices/signage placed at the entrance to the event area clearly informing Users that filming is conducted for communication purposes; or (ii) a separate consent item on the Platform when the User confirms participation in activities involving filming.
Users have the right to refuse to appear in footage by directly informing the staff responsible for the filming area.
