BUZZMETRICS DATA PROCESSING POLICY FOR SOCIAL MEDIA RESEARCH AND SOCIAL LISTENING SERVICES

1. Introduction

Buzzmetrics, a member of YouNet Group, provides market research, data analytics, and strategic consulting solutions powered by digital data. Buzzmetrics delivers its Social Media Research and Social Listening services through the SocialHeat platform.

This Policy explains how Buzzmetrics ("we", "us", or "our"), through the SocialHeat platform, collects, uses, stores, and protects personal data in the course of providing its services. It also outlines the rights of data subjects in accordance with applicable laws.

SocialHeat is designed to support market research and aggregated data analysis. The platform is not designed or intended to identify, monitor, track, or build profiles of individuals.

2. Scope and Definitions

This Policy applies to:

• Customers and business partners using SocialHeat services.
• Individuals whose publicly available content appears in data sources accessed by SocialHeat during the provision of its services, including social media users, forum contributors, e-commerce reviewers, and authors of publicly available online content.
• Creators, Key Opinion Leaders (KOLs), Key Opinion Consumers (KOCs), influencers, public figures, and individuals conducting commercial activities through digital platforms.
• Visitors to SocialHeat websites and systems.

For the purposes of this Policy:

Personal Data means any data defined as personal data under the Personal Data Protection Law.

Publicly Available Data Sources mean information sources whose content is publicly accessible under the settings of the relevant platform or website and may be lawfully accessed.

Aggregated Data means data that has been combined, summarized, or analyzed by topic, trend, or audience segment and is not intended to identify any specific individual.

Data Processing includes the collection, recording, storage, organization, analysis, use, sharing, disclosure, deletion, or other processing activities as defined under applicable laws.

3. Legal Basis

We process personal data in accordance with the laws of Vietnam, including but not limited to:

• Personal Data Protection Law No. 91/2025/QH15, effective from 1 January 2026.
• Decree No. 356/2025/ND-CP guiding the implementation of the Personal Data Protection Law.
• Data Law No. 60/2024/QH15.
• The Cybersecurity Law and its implementing regulations.
• The Law on Cyber Information Security (2015).
• The Law on Electronic Transactions (2023).
• Other applicable laws relating to consumer protection, intellectual property, and electronic commerce.

In addition, we respect the terms of service, usage policies, and applicable requirements of the platforms and data sources used in the provision of our services.

4. Data Processing Principles

Buzzmetrics processes data in accordance with the following core principles:

Topic-Centric, Not Individual-Centric

We collect and analyze data based on topics, brands, industries, campaigns, and market trends rather than individual persons. Our objective is to understand public conversations, not to identify or monitor the individuals participating in them.

Data Minimization

We process only the minimum amount of personal data necessary to achieve legitimate market research purposes. Personally identifiable information is removed, masked, or aggregated whenever it is not required for research or analytical purposes.

Aggregation by Default

The default output of our services consists of aggregated insights and analytics rather than individual records, user profiles, or person-level datasets.

No Commercialization of Personal Data

We do not sell, trade, or otherwise commercialize personal data as a standalone product.

No Individual Profiling

We do not create behavioral profiles of individuals, link data across multiple platforms to identify the same individual, or collect, enrich, or expand individuals' contact information using data obtained from other sources.

Publicly Available Does Not Mean Freely Usable

The fact that information is publicly available does not mean it may be collected, stored, analyzed, or reused for any purpose without limitation. Before using any data source, Buzzmetrics evaluates its accessibility, the applicable platform terms, and relevant legal obligations.

Purpose Limitation

Personal data is collected and processed only for specific, legitimate, and predefined purposes. Buzzmetrics does not collect data first and determine its intended use afterward.

5. Categories of Data Processed

In the course of providing our services, Buzzmetrics may process the following categories of data:

5.1 Publicly Available Data

This includes content that has been made publicly available on social media platforms, online forums, websites, online news publications, e-commerce platforms, and other publicly accessible sources for the purpose of market research and media analysis.

Such content may include text, images, publication timestamps, topics, engagement metrics, and other publicly available information, depending on the relevant platform.

5.2 Licensed Data

Buzzmetrics may process data obtained through official platform APIs, licensed data providers, or contractual data-sharing arrangements with partners, subject to the scope and conditions permitted by the relevant platform or data provider.

5.3 Data Collected Through Research Activities

In certain circumstances, Buzzmetrics may collect information from lawfully accessible sources for the purpose of conducting market research and topic-based analysis.

Such activities are carried out solely for legitimate market research purposes, in compliance with applicable laws and the terms governing each data source. Buzzmetrics applies the principle of data minimization and does not collect information for the purpose of identifying or tracking individuals.

5.4 Data Provided by Customers or Business Partners

This includes data provided by customers or business partners where necessary for the delivery of contracted services or as otherwise requested by the customer.

5.5 Data Provided Directly by Users

This includes contact information, registration details, communications, and other information voluntarily provided by customers or users when registering for our services, requesting consultations, or contacting Buzzmetrics.

5.6 Source References

Buzzmetrics may retain references to original sources, including articles, comments, news publications, or other publicly available content, for the purpose of verifying information and maintaining the accuracy and transparency of analytical results.

Such source references are not used to identify, monitor, or profile individuals. Where a reference links to a personal profile, Buzzmetrics does not extract or process personally identifiable information from that profile beyond the scope of the legitimate processing purpose described in this Policy.

5.7 News Media, Online Content, and Copyrighted Materials

Buzzmetrics may process content from news publications, online media, and other publicly available sources to support media intelligence and market research activities.

Such processing is conducted in accordance with applicable intellectual property laws and other legal requirements. Buzzmetrics does not operate as a repository of copyrighted content or as a substitute for the original source, and does not redistribute copyrighted materials in violation of applicable laws.

5.8 Creators, KOLs, KOCs, and Public Commercial Accounts

For creators, Key Opinion Leaders (KOLs), Key Opinion Consumers (KOCs), influencers, public figures, and publicly accessible commercial accounts, Buzzmetrics may process publicly available information for the purposes of market research, media analysis, and evaluating campaign effectiveness.

Buzzmetrics processes such information only to the extent necessary for providing its services and in accordance with applicable laws. We do not use publicly available contact information to create, sell, or distribute contact databases for commercial purposes.

6. Purposes of Data Processing

Buzzmetrics processes data for the following purposes:

• To analyze market trends, topics, and public discussions.
• To measure the effectiveness of media, branding, and marketing campaigns.
• To support customers in market research and business decision-making.
• To provide, operate, maintain, and improve our services.
• To comply with applicable legal obligations and contractual commitments.

Buzzmetrics does not process data for the following purposes:

• Monitoring, tracking, or profiling individuals.
• Creating lead lists or prospect databases from social media data.
• Selling or otherwise commercializing personal data.
• Conducting activities that infringe privacy rights or violate applicable laws.

7. Legal Basis for Processing

Buzzmetrics processes personal data based on one or more lawful grounds, as applicable, including:

• Performance of a contract with customers.
• Compliance with legal obligations.
• The consent of the data subject, where required.
• Any other lawful basis permitted under applicable laws.

8. Sensitive Personal Data and Children's Data

Sensitive Personal Data

Buzzmetrics does not intentionally collect, analyze, or generate outputs relating to the sensitive personal data of identifiable individuals, including information concerning health, personal finances, political opinions, religious beliefs, sexual life, biometric data, or criminal records.

Where discussions involve such topics, they are analyzed only at an aggregated level for market research purposes and are not used to identify or assess any individual.

Children's Data

Buzzmetrics does not knowingly collect or process the personal data of individuals under the age of 18.

Where we become aware, or have reasonable grounds to believe, that data relates to a person under 18 years of age, Buzzmetrics will apply appropriate safeguards, including excluding, masking, restricting access to, or otherwise limiting the processing of such data, unless another lawful basis exists under applicable laws.

Where required by law, additional legal grounds, parental or guardian consent, and appropriate safeguards will be implemented before any processing takes place.

9. Data Sharing

Buzzmetrics shares personal data only where necessary and only for legitimate purposes, including:

• With other companies within YouNet Group for the purpose of providing our services.
• With customers, within the scope of the applicable service agreement.
• With technical service providers supporting the operation of our systems.
• Where required by competent governmental authorities or applicable laws.

Buzzmetrics does not sell, lease, or disclose personal data for commercial purposes outside the scope of our services.

10. Cross-border Data Transfers

In certain circumstances, personal data may be processed or stored on systems operated by technical service providers located outside Vietnam, such as international cloud service providers or artificial intelligence service providers.

Where cross-border transfers of personal data occur, Buzzmetrics conducts appropriate assessments and implements safeguards in accordance with the Personal Data Protection Law of Vietnam and other applicable legal requirements before such transfers take place.

11. Use of Artificial Intelligence (AI)

Buzzmetrics uses artificial intelligence technologies to support topic classification, sentiment analysis, trend detection, and content summarization.

We apply AI in accordance with the following principles:

• AI is used to analyze topics, trends, and aggregated public discussions, not to identify, classify, or evaluate individuals.
• AI-generated outputs consist of aggregated insights rather than assessments or rankings of specific individuals.
• Buzzmetrics does not use AI to make automated decisions that produce legal effects or similarly significant impacts on individuals.
• Customer data will not be used to train publicly available AI models without the customer's consent.
• Where third-party AI services are used, Buzzmetrics evaluates applicable legal, security, and data protection requirements before integrating such services into our operations.

12. Data Retention

Buzzmetrics retains personal data only for as long as necessary to fulfill the purposes described in this Policy, perform contractual obligations, or comply with applicable legal requirements.

When personal data is no longer required, it will be deleted, anonymized, or otherwise handled in accordance with applicable laws and our data retention policies.

13. Data Security

Buzzmetrics implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, disclosure, alteration, or destruction.

These measures include, where appropriate, access controls, encryption, internal authorization mechanisms, and security monitoring procedures designed to safeguard personal data throughout its lifecycle.

In the event of a personal data incident, Buzzmetrics will respond in accordance with applicable laws and, where required, notify the relevant authorities and affected parties.

14. Rights of Data Subjects

Subject to applicable laws, data subjects may exercise the following rights:

• To be informed about the processing of their personal data.
• To request access to their personal data.
• To request the correction or updating of inaccurate personal data.
• To request the deletion of, or restriction on the processing of, personal data where permitted by law.
• To withdraw consent where processing is based on consent.
• To submit complaints or inquiries regarding the processing of their personal data.

Buzzmetrics will consider and respond to such requests in accordance with applicable legal requirements.

15. Contact Information

To exercise your rights under this Policy, submit questions regarding our data processing practices, or request that your information no longer be displayed through SocialHeat services, please contact us:

Email: info@buzzmetrics.com

Telephone: +84 28 3535 7356

Buzzmetrics will respond to valid requests within 30 business days from the date of receipt. Where additional time is reasonably required due to the complexity of the request, we will notify the requester and provide an estimated response timeframe.

16. Updates to This Policy

Buzzmetrics may update this Policy from time to time to reflect changes in applicable laws, our services, or our data processing practices.

The latest version of this Policy will always be published on our official website and will become effective from the date specified therein.

Where required by applicable laws, or where material changes significantly affect the rights of data subjects, Buzzmetrics will provide appropriate notice before such changes become effective.