Security and Privacy Notice

MSIG Insurance (Vietnam) Company Limited ("MSIG Vietnam", "we", "us", or “our”) concern and recognize of the importance of protecting personal data. We have issued this Security and Privacy Notice ("Notice") to further clarify the purposes, the scope to which we process personal data, the measures we take to protect data, and the rights and responsibilities of our customers and partners (collectively "you", or “your”) to these activities.

This notice is an integral part of the terms and conditions governing the relationship between you and us if referred to in any relevant agreement. However, regardless the validity of such agreements or any other documents entered between you and us, this Notice shall remain in effect to you until we cease the processing of your personal data.

Interpretation of terms

  • MSIG Vietnam refers to MSIG Insurance (Vietnam) Company Limited (including legal heirs), and its branches, representative offices.
  • Customer refers to an organization or individual who (i) is interested in MSIG Vietnam's services and products through our direct marketing channels, website visitors, online sales applications/platforms, communication channels, social networks, etc.; or (ii) has entered into an insurance contract, use products and services of MSIG Vietnam, such as Policyholder, Insured, Beneficiary, etc.
  • Partners refers to existing or potential organizations and individuals providing services and products to MSIG Vietnam.
  • Personal data ("PD") refers to digital data or information in other forms that identifies or helps identify a specific person, including basic personal data and sensitive personal data. Personal data after being de-identified is no longer personal data.
  • Personal data processing refers to any activity performed on personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities that impact personal data.
  • Within the scope of this Notice, "Personal Data Controller", "Personal Data Processor", "Personal Data Controller cum Processor", "Data Subject", "Basic Personal Data", "Sensitive Personal Data", "Personal Data Processing", "Third Party" and other terms shall have the meanings as set out in the Government's Law on Personal Data Protection number 91/2025/QH15 and Decree 356/2025/NĐ-CP and their amended, supplemented and replaced documents from time to time.

Legal basis for Personal Data processing and consent mechanism

We collect and process your Personal Data strictly within the scope and purposes that have been disclosed, ensuring compliance with the principles of personal data protection in accordance with applicable laws. Except where otherwise provided by law allowing the processing of Personal Data without the data subject’s consent, the processing of your Personal Data is carried out based on your consent.

We may obtain consent in writing, through recorded phone calls, via consent syntax in text messages, by email, or on websites, platforms, or applications that have technical features for collecting consent, or by other methods that can be printed or copied in writing, including electronic forms or verifiable formats; and we store evidence of such consent as required by law.

Purpose of processing Personal Data

MSIG Vietnam will only process your Personal Data for the following purposes ("Purposes") through specific processing activities as follows:

 

PurposesProcessing activities for fulfilling Purposes
Provide services and products (to you or to us)
  • Introduce, offer, market, provide information about services or products to you or receive introductions, offers about services or products from you1;
  • Verify your identity and/or legal status;
  • Conduct due diligence checks and risk assessment/analysis, e.g. assessment of your documents, financial capability... if you are our customer;
  • Process, manage or verify your eligibility for the provision of services or products;
  • Enter, maintain and manage contracts for the provision of services and products with you;
  • Provide or receive services, products and/or services arising out of or in connection with a contract entered with you;
  • Contact and exchange information with you about services and products;
  • Make or receive payment for services or products under the contract entered with you;
  • Perform internal activities necessary to provide or receive services or products under contracts entered with you;
  • Change, supplement, cancel or extend your contract to provide services or products with us, for example renewing insurance if you are our customer;
  • Validate, investigate, analyze insurance events related to you; settle credits, guarantees, guarantee letter checks and insurance benefit claims for you if you are our customer;
  • Carry out the training process and serve insurance agents, insurance brokers activity if you are our partners involved in this activity.
Safety and Security
  • Prevent, detect and investigate (if necessary) fraud, deceitful, violation of law or crime acts such as money laundering, terrorism, etc. related to your or our activities;
  • Protection of personnel and assets, legitimate interests of the Company and related parties (if any);
  • Manage compliance with our terms and conditions, notices and regulations;
  • Contact us to resolve security issues related to you;
  • Manage access to offices and other workplaces.
Support the provision/use of services and products
  • Send or receive, investigate and resolve issues related to services and products;
  • Send or receive and respond to questions, comments, feedback about services and products;
  • Manage and improve our feedback system;
  • Guide you to carry out necessary activities to solve problems related to services and products;
  • Consent to our other partners to access, support and manage the provision/use of services and products;
  • For inward or outward reinsurance activities (if any).
  • Exercise any rights to reimburse MSIG Vietnam from any third parties related to you.
Business Administration and operation
  • Prepare financial statements, carry out consolidation, business activities reports or other related types of reports in accordance with MSIG Vietnam's internal regulations and legal regulations;
  • Manage MSIG Vietnam's activities related to the provision/use of services, products under the contract entered with you, our notices, internal regulations and legal regulations;
  • To carry out activities of organizing, arranging and restructuring enterprises such as selling, dividing, separating all or part of enterprise, consolidating, merging, transforming enterprise or expanding business operations, establishing new subsidiaries, branches, representative offices, business locations of MSIG Vietnam, etc.
Research and development
  • Conduct market research, survey and analyze data related to services and products;
  • Analyze and improve existing insurance services and products;
  • Research and development to improve insurance services and products.
Legal and litigation
  • Comply with requests to provide information in accordance with laws or competent authority agencies;
  • Process your personal data on the basis of legal obligations that MSIG Vietnam is undertaking;
  • Initiate, comply, exercise or protect the rights and interests of MSIG Vietnam in legal disputes;
  • Other purposes as prescribed by Vietnamese law.
Other purposes specified in the agreement/contract between you and us

Types of Personal Data Processed

We may process your Personal Data including the following categories of Basic Personal Data and Sensitive Personal Data:

 

Basic personal data

Other information associated with a specific individual or that helps identify a specific individual:

  • Full name, middle and birth name, other names (if any);
  • Date of birth; date of deceased or declared missing;
  • Gender;
  • Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current residence, hometown, contact address;
  • Nationality;
  • Personal image;
  • Photo, images and movements captured by video cameras installed at our premises and other entitled places;
  • Phone number, personal identification number, passport number, driver's license number, license plate number;
  • Marital status;
  • Information about family relationships (parents, children, spouse);
  • Information on digital account of individual;
Sensitive personal data
  • Health status;
  • Biometric and genetic characteristics;
  • Images of identity cards, citizen ID cards, or national identification documents.
  • Information on customer accounts of credit institutions, foreign bank branches, intermediary payment service providers and other permitted organizations;
  • Personal location data identified via positioning services;
  • Data related to behavioral tracking and activities during the use of and interaction with telecommunications services, social networks, online media services, and other services in cyberspace that are managed, owned, or operated by MSIG Vietnam.
  • History of insurance participation and claims for insurance benefits settlement at MSIG Vietnam and other insurance companies;
  • Information about your financial situation (such as salary and details of other income, etc.);
  • Data relating to crimes and legal violations collected and retained by law enforcement agencies;
  • Other personal data prescribed by law to be kept confidential and requires strict security measures.
Other related data
  • Signatures (including electronic signatures, digital signatures) and writing;
  • Email address;
  • Contacts address; billing address;
  • History and content of communications and exchanges between you and us;
  • Information about your employment status (if relevant to the provision of services, products);
  • Flight information, travel schedule and other information related to travel activities of travel insurance customers;
  • Information arising from insurance events (such as traffic accidents, travel accidents, etc.);
  • Information about the insured properties (such as type of motor vehicle, specifications of the motor vehicle, proof of home ownership, etc.);
  • Work experience and qualifications;
  • Information about degrees, qualifications, certifications related to the provision of services and products to us;
  • Other data related to the conclusion, performance and termination of the contract between you and us.

Locations and methods of Personal Data Processing

1. Personal Data processing locations

We may process your Personal Data in Vietnam or in a location outside the territory of Vietnam. In particular, we may make the cross-border transfer of your Personal Data to a location outside of Vietnam territory by transferring or using storage or process  systems located outside of Vietnam to process your Personal Data. Our cross-border data transfer based on your consent and solely for the Purposes for which you gave consent, or as provided by law.

When transferring your Personal Data to another country, we will comply with this Notice and applicable laws and will require the recipients to process and protect your Personal Data appropriately and adequately in accordance with applicable laws via binding documents.

2. Collection sources of Personal Data

We may collect your Personal Data from the following sources:

  • Directly from you when you (i) contact, communicate, interact with us or our Personal Data Processor (through face-to-face, mail, telephone, online communications, social media, surveys and other means); (ii) provide us or our Personal Data Processor with documents containing your Personal Data, such as your legal identification documents, certificates, professional qualifications, etc.; or (iii) through the provision of services or products under a contract with you;
  • From parties related to you (such as your employer, guardian, beneficiary; intermediaries insurance brokers, financial providers or subsidiaries of MS&AD Group if you have dealt with these companies, etc.);
  • From government authorities, authorized organizations or individuals (e.g. judgments, court decisions) or when collection depends on legal grounds (e.g. collected from state agencies to fulfil our statutory obligations) or when personal data is collected from public sources (e.g. public databases, advertising information, data publicly on information websites) (if any);
  • From hospitals and healthcare service providers.
  • Through audio and video recording devices at our offices or other entitled locations.

In cases we do not collect Personal Data from you, we guarantee to only collect it legally from subjects who have the right to disclose to us based on your consent or other legal basis.

In case you are an organization, to the extent that you has provided or will provide the Personal Data of any data subjects to MSIG Vietnam (e.g. directors, shareholders, employees, authorized representatives,  agents, etc.), you need to ensures that (i) the data subjects have been informed about our processing of their Personal Data in accordance with this Notice; (ii) you has obtained legal consent and has demonstrated this consent to provide it to MSIG Vietnam upon request; or have other legal grounds for us to process their personal data under this Notice; and (iii) fully comply with relevant laws on the protection of Personal Data. 

3. Methods of Personal Data processing

During our processing of your Personal Data, we may use various methods, such as manual, mechanical or automated processing. The aforementioned methods may be used individually or simultaneously to process Personal Data.

Automated Processing of Personal Data (if applicable)

In certain cases, we may use technical measures and/or automated personal data processing tools (including models, algorithms, or similar technologies) to support analysis, scoring, pricing, risk classification, or the processing of claims requests.

Automated processing algorithms operate in accordance with the principles and provisions stipulated in the contract/terms of service and do not prejudice your lawful rights and interests. You have the right to opt out of the above-mentioned automated processing of personal data by following the methods announced by MSIG Vietnam from time to time or by contacting us through our official support channels.

We may perform the processing of your Personal Data directly or via appropriate Personal Data Processors pursuant to applicable laws. When we use Personal Data Processors, we will establish binding contractual relationships and select Personal Data Processors with appropriate safeguards.

Organizations and individuals allow to process Personal Data

The follows organizations and individuals may have Personal Data shared by us to fulfill the Purposes set out in this Notice:

  • Subsidiaries and/or affiliates within the MS&AD Insurance Group, and our parent company;
  • Personal data processors that we hire to fulfil the Specific Purpose (if any);
  • For inward or outward reinsurance activities (if any).
  • Partners, suppliers of products and services for MSIG Vietnam (e.g. postal,  telecommunications, computers, payment,  professional consultants,  credit institutions, e-commerce platforms, parties involved in the provision of healthcare services and/or the processing of your insurance claims, including but not limited to Third Party Administrators (TPAs) and/or medical facilities, hospitals, clinics, doctors, pharmacies, etc.);
  • Customers to whom MSIG Vietnam provides products or services that may be relevant to you;
  • Our legal successors when we perform a sale, full or partial separation / division, consolidation, merger and transformation of the business;
  • The subject, as notified by you, authorized to interact with us on your behalf;
  • The subject involved in exercising or maintaining any rights of MSIG Vietnam under the agreement between you and us;
  • Competent state agencies or other units to whom Personal Data is required to be disclosed in accordance with applicable laws.

Your personal data will only be shared with the aforementioned relevant parties with your consent or where permitted by law; and is guaranteed to be processed and protected to a level not lower than that set out in this Notice.

Potential unwanted consequences, damage

MSIG Vietnam adopts a variety of safeguards that are necessary and appropriate to protect your Personal Data from violations, unwanted consequences or damages, including managerial, organizational, technical and legal measures.

However, due to internal and external influences reasons, no data can be guaranteed to be 100% secure. The potential and unwanted consequences and damages may include:

  • Loss of Personal Data;
  • Illegally sharing of Personal data;
  • Inaccurate data which leads to inappropriate provision of the respective products or services or requirements of the data subjects not being met;
  • Data subject can become victims of phishing attacks, identity theft, etc.

We always do our best to protect your Personal Data and the above incidents are not what we want. In the event of such incidents, we will handle them in accordance with the applicable laws.

In the event that a violation of personal data protection regulations is detected that may cause harm to national defense, national security, social order and safety, or infringe upon your life, health, honor, dignity, or property, we will fulfill our obligation to notify the competent personal data protection authority within no later than 72 hours from the time the violation is discovered.
If a personal data breach occurs involving your location data or biometric data, we will notify you within no more than 72 hours from the time the breach is detected.

Retention of Personal Data

MSIG Vietnam shall only retain your personal data for a necessary period to fulfill the Purposes for which you have consented in advance, unless a longer period is mandatory or permitted by laws.

The commencement of data processing is when we collect your Personal Data and the end depends on your agreement with us and the Purposes of processing or applicable law.

When (i) the processing Purposes have been completed or (ii) your Personal Data is no longer necessary for the processing Purposes or (iii) there is a lawful request from you; and we do not have any other lawful basis for storing your Personal Data, we will delete or destroy your Personal Data in a secure manner.

In addition, we may delete, irrecoverably delete or destroy your Personal Data in accordance with the requirements of applicable laws or the request of the competent authorities.

Your rights, obligations, and our commitments

1. Your rights in relation to Personal Data

Unless otherwise provided by law, as a data subject, you are entitled to:

  • Know about the processing of your personal data,
  • Consent, withdraw your consent of personal data processing,
  • Request for access, provision, rectification and deletion of your Personal Data.
  • Have the right to restrict or object to our processing of your personal data
  • and other statutory rights such as complaints, denunciations, initiative lawsuits, to claim damages and request the implementation of measures and solutions to protect personal data.

Exercising Data Subject Rights

  • We have established procedures, workflows, and forms to enable you to exercise your rights as a data subject.
  • Please access the following link: Data Subject Rights Request, or visit the homepage of MSIG Vietnam.
  • Upon receiving a valid request, we will provide a response within 02 working days.

Processing timelines (from the date we receive a complete and valid request):

  • (i) Withdrawal of consent / restriction of processing / objection to processing: 15 days (or 20 days if we need to request the processor or a third party to cease processing). If an extension is required due to the nature or complexity of the request, we may extend the timeline once, for no more than 15 days, and we will notify you of the reason for the extension.
  • (ii) Access / rectification / provision of data: 10 days (or 15 days if we need to request the processor or a third party to make corrections).
    If an extension is required due to the nature or complexity of the request, we may extend the timeline once, for no more than 10 days, and we will notify you of the reason for the extension.
  • (iii) Deletion of data: 20 days (or 30 days if we need to request the processor or a third party to delete data).
    If an extension is required due to the nature or complexity of the request, we may extend the timeline once, for no more than 20 days, and we will notify you of the reason for the extension.
    (iv) Implementation of measures and solutions to protect personal data: We will provide full information regarding the procedure and complete the request within 15 days.
    If an extension is required due to the nature or complexity of the request, we may extend the timeline once, for no more than 15 days, and we will notify you of the reason for the extension.

Please note that:

  • Your rights may be restricted by laws. We will then rely on the provisions of applicable laws to enforce the processing of your Personal Data.
  • We will take measures to verify requests coming from you or your legally authorized person. Unreasonable or unlawful requests will be denied, in which case we will provide you with the reason for denying the request to you within a reasonable time, unless a response time period is required by applicable laws.
  • Depending on circumstances, we may act as a data controller, a data controller and processor, or a data processor. In each case, we will carry out appropriate activities to ensure the fulfillment of obligations corresponding to your rights
  • Risks and negative effects that may arise from the act of not providing your Personal Data, or the exercise of your rights, such as withdrawing consent, requesting deletion of Personal Data or restricting/objecting to our processing of your Personal Data (such as our inability to provide you necessary notices related to services and products under the contract with you; or unable to carry out transactions with you, etc.).

2. Your obligations to Personal Data

As a data subjects, you are obliged to:

  • Provide complete and accurate your personal data as required by law, by contract or by your consent of Personal Data processing and by MSIG Vietnam.
  • Ensure the legal rights to process Personal Data of other data subjects that you provided to us;
  • To protect your own personal data;
  • Timely notify us of changes or errors in the Personal Data provided to us (if any) and any signs, incidents, events, situations or breaches relating to the Personal Data;
  • Comply with the provisions of the law on Personal Data and respect and protect the personal data of other data subjects;
  • Ensure indemnification, hold us harmless from and protect us against any losses, damages, legal liabilities, claims and similar matters arising in any form from the processing of your Personal Data that relates to us and arising due to your actions or omissions.

We would like to note that your failure to comply with the above-mentioned obligations and other obligations as prescribed by law may affect the legitimate rights and interests of you, ours and related parties. In such cases, you will be responsible against the laws, MSIG Vietnam and related parties for non-compliance with your obligations.

3. Our commitments relating to Personal Data

  • MSIG Vietnam will only process Personal Data based on your consent, unless otherwise provided by applicable law.
  • Your personal data is processed and protected in accordance with the regulations, commitments of MSIG Vietnam and the applicable laws.
  • In the course of processing your Personal Data, we will adhere to the following principles: (i) Lawfulness; (ii) Transparency; (iii) Purpose limitation; (iv) Data minimization; (v) Accuracy; (vi) Storage limitation; (vii) Confidentiality and Integrity; and (viii) Accountability.

Protection of Personal Data in certain special activities

1. Protection of Personal Data of children, person who have deceased or have limited legal capacity, and individuals with cognitive or behavioral difficulties.

With respect to Personal Data children, persons who have deceased or have limited legal capacity, and individuals with cognitive or behavioral difficulties, before processing the data, we will collect consent with the legal representative to exercise personal data subject rights on their behalf, except process personal data without consent according to related laws. If you provide MSIG Vietnam with Personal Data of Children, person who have deceased or have limited legal capacity, and individuals with cognitive or behavioral difficulties, you should ensure that you have obtained the above legal consent of the legal representative.

2. Personal data collected by CCTV

MSIG Vietnam may collect your Personal Data via CCTV systems located at our premises (including but not limited to: offices, event venues, etc., except private locations such as changing rooms, toilets, etc.) and other entitled locations to ensure security, safety for MSIG Vietnam and you. Personal data obtained will be processed in accordance with the laws and of MSIG Vietnam.

3. Payment security

The card payment system on MSIG Vietnam's website is provided by payment gateway partners who have been legally licensed to operate in Vietnam ("Payment Gateway Partners"). Accordingly, card payment security standards ensure compliance with the security standards of Payment Gateway Partners. Payment transaction policies by domestic and international cards ensure compliance with the security standards of Payment Gateway Partners including:

  • SSL (Secure Sockets Layer) internet data security standard issued by GlobalSign.
  • Payment Information Security Standard (PCI DSS) certification provided by Trustwave.
  • 128-bit MD5 encryption standard.
  • Principles and regulations on information security in the banking and finance industry in accordance with regulations of the State Bank of Vietnam.

MSIG Vietnam ensures that the data backup and recovery process and system when the information system serving payment activities has problems, your payment information through this website is not changed, deleted, destroyed, copied, moved illegally or misappropriated. MSIG Vietnam stores data on each payment transaction according to the time limit prescribed by law.

Modifications and updates

We reserve the right to amend, supplement and update this Security and Privacy Notice from time to time.

The latest version will be posted on our website (www.msig.com.vn) and take effect seven (07) days from the date of publication.

You are recommended to regularly update the latest version of this Notice and our regulations and notices sent to you or posted on MSIG Vietnam's website.

Contact Us

Please contact us directly if you wish to exercise your rights set out in this Notice or have any questions about this Notice and our processing of Personal Data (e.g. submitting a complaint about our processing of Personal Data).

Contact Information:

  • Data Protection function: Risk Management Division - MSIG Insurance (Vietnam) Company Limited
  • Address: 10th Floor, CornerStone Building, No. 16 Phan Chu Trinh, Cua Nam Ward, Hanoi.
  • Telephone: 84 24 3936 9188;
  • Email: [email protected] 

Effectiveness

This Notice shall take effect after seven (07) days from the date of publication (25/06/2026).

You have carefully read and understood this Notice in its entirety and known and agreed that this Notice is considered as a Notice of Personal Data Processing in accordance with Law on Personal Data Protection number 91/2025/QH15 and Decree 356/2025/NĐ-CP and other relevant guiding documents, as amended, supplemented, or replaced from time to time . To the extent permitted by law, this Notice, when confirmed by you and/or included in agreements and contracts between you and us, is also considered to constitute valid consent and a lawful basis for our processing of your Personal Data.

Issues not specified in this Notice will be resolved in accordance with applicable laws, other notices and documents issued by MSIG Vietnam or as agreed between us and related parties. If any provision of this Notice is unlawful or inconsistent with the laws, the applicable laws shall prevail.

This Notice is made in English and Vietnamese, and has the same legal effect. In case of discrepancy, Vietnamese is the preferred language.