1. This Policy regulates the collection, processing, storage, use, protection, and sharing of personal data of customers using the services of Sun PhuQuoc Airways Limited Liability Company (“the Company”, “Sun PhuQuoc Airways”).

2. This Policy applies to all passengers, customers, partners, members of frequent flyer programs, and any individual whose personal data is processed by the Company in the course of its airline operations.

3. This Policy applies across all Company systems, including websites, mobile applications, ticket offices, sales agents, and other electronic transaction channels.

For the purpose of this Policy, the following terms shall have the meanings ascribed below:

1. Personal Data: information in the form of symbols, letters, numbers, images, sounds, or similar forms in electronic environments capable of identifying a specific individual.

2. Basic Personal Data: identification information, contact details, booking data, and payment information.

3. Sensitive Personal Data: data relating to health, biometrics, financial information, religious beliefs, political opinions, geographic location, and data relating to minors.

4. Data Subject: the individual to whom the personal data relates.

5. Data Controller: Sun PhuQuoc Airways, which determines the purposes and means of processing personal data.

6. Data Processor: any organization or individual authorized by the Company to process personal data on its behalf pursuant to contract.

1. Processing of personal data shall comply with the principles of lawfulness, fairness, transparency, accuracy, purpose limitation, confidentiality, and storage limitation.

2. The Company shall only collect and process personal data for legitimate and specified purposes, notified in advance to customers.

3. The Company shall implement technical, administrative, and organizational measures to ensure the safety of personal data and prevent unauthorized access, disclosure, alteration, or destruction.

The Company may process personal data of customers on the following legal grounds:

1. With the consent of the data subject.

2. For the performance of contracts for air transportation and related services.

3. To comply with legal obligations, including aviation security, customs, immigration, accounting, and taxation.

4. To protect the life or health of passengers in emergency circumstances.

5. To safeguard the legitimate interests of the Company or third parties, provided such interests do not override the rights and freedoms of customers.

1. Managing bookings, ticket issuance, check-in, flight operations, and special services (special meals, medical support, unaccompanied minors, passengers with reduced mobility).

2. Providing, managing, and improving customer service quality.

3. Complying with legal obligations to competent state authorities (security, customs, immigration, counter-terrorism).

4. Managing frequent flyer programs, promotional campaigns, and customer benefits.

5. Conducting direct marketing, market research, and customer surveys (only with prior consent).

Customers shall enjoy the following rights:

1. The right to be informed about processing of their personal data.

2. The right to access and obtain copies of their personal data.

3. The right to rectify or update inaccurate data.

4. The right to request deletion or restriction of processing.

5. The right to object to processing for direct marketing purposes.

6. The right to withdraw consent previously given.

7. The right to lodge complaints with competent state authorities.

1. The Company shall only process personal data of children under 16 years old with the lawful consent of the parents or legal guardians accompanying the child in the same booking (PNR).

2. In cases where the accompanying adult is not the parent or legal guardian, the Company shall require that adult to provide a declaration confirming they have the proper authority or authorization from the parent or guardian to consent on behalf of the child.

3. The Company reserves the right to refuse service or require supporting documents evidencing lawful consent for processing of children’s personal data, in order to comply with legal requirements and ensure aviation safety.

4. Mechanisms to verify parental or guardian consent shall be applied during booking, ticket purchase, check-in at airports, or through other methods as required by law.

1. The Company may share personal data with the following parties, within the necessary scope and for the purposes notified to customers:

o Partner airlines under code-share, interline, or alliance agreements.

o Airports, aviation security, customs, immigration, police, and competent state authorities as required by law.

o Sales agents, ticket offices, travel agencies, and distribution partners for booking, ticketing, and customer service support.

o Service providers and commercial partners, including catering providers, hotels, insurance companies, car rental companies, electronic payment processors, and lounge operators.

o Member companies of Sun Group for system administration, product development, and service quality enhancement.

2. Sharing of personal data shall be governed by contracts or legal obligations, and recipients shall be required to implement security and protection measures equivalent to or higher than those mandated under Vietnamese law, GDPR, and PIPL.

3. Transfer of personal data outside Vietnam shall comply with Article 25 of Decree 13/2023/ND-CP, including obligations to notify customers, report to competent state authorities, and adopt technical and organizational safeguards to ensure data security throughout transmission and storage abroad.

1. Personal data of customers shall be retained only for as long as necessary to achieve the purposes for which it was collected, and not kept longer than required.

2. The retention period for each type of data shall be determined in compliance with Vietnamese law and international standards, including but not limited to Decree 13/2023/ND-CP, the Law on Accounting, the Civil Aviation Law of Vietnam, as well as storage limitation principles under GDPR and PIPL.

3. Upon expiry of the retention period or upon lawful request of the customer for deletion, the Company shall delete, destroy, or anonymize the personal data, unless otherwise required by law.

1. The Company applies encryption, anonymization, access control, firewalls, and logging mechanisms.

2. Regular security assessments, system audits, and staff training on data protection are conducted.

3. A Data Protection Officer (DPO) is appointed to supervise compliance.

4. Data Protection Impact Assessments (DPIA) are carried out for high-risk processing activities (e.g., personalized marketing, cross-border data transfers).

1. In the event of a personal data breach, the Company shall notify data subjects and competent state authorities within 72 hours.

2. The notification shall include: the nature of the breach, categories of data affected, potential consequences, and remedial measures.

3. The Company may be exempt from notifying data subjects if the data has been encrypted or other effective risk mitigation measures have been applied.

Customers may exercise their rights and contact the Company through the following channels:

• Email: privacy@sunphuquocairways.com

• Address: Sun Grand City Ancora Residence, 03 Luong Yen Str, W Hai Ba Trung, Hanoi, Vietnam

• Hotline: 1900 xxxx

1. This Policy takes effect from DD/MM/YYYY.

2. Any amendment or supplementation shall be publicly announced on the Company’s website at least 15 days prior to its effective date.

3. Historical versions of this Policy shall be archived and made available to ensure transparency.