Onebox Express Joint Stock Company and relevant companies (hereinafter referred to as “Onebox Express” or “We”) provide users with service of smart locker.

We are well aware of the importance of personal information to the user. For this reason, we are always committed to taking technical security measures and other necessary measures to ensure the safety of the user’s information. Therefore, we will comply with relevant laws and regulations to collect, use, store, provide and protect the personal information, and develop the following “Privacy and Security Policy” (hereinafter referred to as “Policy”).  

This document will support you to understand the following contents:

Before using the service of the Onebox Express’s website, application, smart lockbox or service platform, please read and understand this policy carefully, especially the bolded terms. You should start using it after confirming that you fully understand and agree to the terms. When you use the service or continue to use the service after this policy has been updated, it is deemed that you have read, understood and accepted this policy and its updated version from time to time. You agree that we collect and use your information in accordance with the terms of this policy. If you do not agree with the contents of this policy, you should stop using the service.

1. Definition and interpretation

In this Privacy and Security Policy, the following terms are construed as follows:

1.1. “Personal information” means all types of information recorded electronically or in other ways to identify an individual separately or in combination with other information, including but not limited to the individual’s name, address, date of birth, ID/Citizen ID Card number, biometric information (including but not limited to fingerprints, facial features, voice, etc.), phone number and detailed delivery bill of lading, invoice number, time, item and other information.

1.2. “Private information of the individual” means personal information including ID/Citizen ID Card/passport number, biometric information, bank account number, property information, address, transaction information and information about children over the age of 14 (we will disclose this in the privacy policy). Private information of specific individual is highlighted in bold).

1.3. “Affiliate Company” means Infinity Valley Joint Stock Company.  

2. Method of personal information collection

2.1. The personal information we need/may need to collect includes:

(1) In order to provide you with basic functions of the Onebox Express’s service, you must allow us to collect and use the necessary information. If you refuse to provide this information, you will not be able to fully use our services.

(2) In order to provide you with additional functions of the service, you may authorize us to collect and use the information. If you refuse to provide it, you will not be able to use the relevant additional functions or achieve the efficiency in using as we expect. However, this will not affect your use of Onebox Express for the basic functions of our service.

2.2 Types of personal information collected by Onebox Express include:

(1) Your name, profile picture, mobile phone number, ID/Citizen ID Card number, passport number, etc. to assist you in completing the service registration, to secure your Onebox Express account and meet the laws and regulations related to the requirements of Onebox Express system.

During your use of Onebox Express’s service, we may automatically collect your usage log and store it as an access log. This action is to identify unusual activity of your account, product suitability for you, and select to provide you with display and search results for your needs. We will collect the following data:

Device information: We will receive and record information related to the device which you use (including device model, operating system version, device settings, unique device identification code, device system, etc.) based on your specific actions during the settings and use of the software. Hardware feature information, device location information (including your authorized GPS, and sensor information such as WLAN, Bluetooth, and base transceiver station). 

Service log information: When you use the products or services offered by our website or app, we automatically collect your detailed usage information about our services and save it as a service log, including actions of browsing, clicking to view, search queries, favorites, adding to cart, transactions, after-sales, tracking to share information, export information, as well as information about IP address, browser type, telecom operator, language, date and time of access.

Please note that device information and service log information are types of information that cannot be used to identify the specific individual. If we combine this type of non-personal information with the personal information or other types of information during the user’s service use for the purpose of identifying the specific individual, this type of information will be treated as personal information. Without your permission or permission from law and regulations, we will anonymize and de-identify this type of information.

In order to provide information search and display services that are more convenient and suitable with your needs, we will extract characteristics on favorites based on device information and service log information of your service. At the same time, we will create lookalike audiences based on the unique characteristics used to display, push information and related commercial ads.

If you do not accept the commercial ads which we send you, you may unsubscribe via SMS or other methods provided by us.

(2) When you use Onebox Express’s sending and receiving services, we may collect necessary shipping information to provide the service, including the sender’s real name, Citizen ID/ID Card information, profile picture, mobile phone number, address, email address, etc. to ensure that you make full use of our service functions and meet relevant law and regulations requirements regarding real name information collection and identity verification.

(3) When you use functions such as shipping, consignment, delivery, receipt, etc., we will record your geographical location information after receiving the voluntary consent of the account holder for the purpose of service provision. This information is private, the refusal to provide will only prevent you from using the above functions, but will not affect the normal use of other functions of Onebox Express. In addition, you can turn off relevant functions at any time through the settings of your mobile device.

(4) When you use Onebox Express to set your profile picture and upload photos, we will only collect your album information after obtaining your consent and voluntary selection to provide you with this service. This information is private, the refusal to provide will only prevent you from using the above functions, but will not affect the normal use of other functions of Onebox Express. In addition, you can turn off relevant functions at any time.

(5) When you use Onebox Express Search, we will collect your search history, your visit information and visit duration, the purpose of which is to provide you with personalized and accurate content and services.

(6) When you use Onebox Express’s voice search, we will collect voice content, voice information, converted text or translated text information to provide you with the service for your correct request. After we process in real time, we will return the processing results to you and will not save your data.

(7) When you use the Onebox Express service through a mobile device, we may collect information related to your mobile device location and information, including but not limited to device model, device identification code, operating system, telecom operator and login IP address, Onebox Express software version, network access method, type and status, network quality data, device accelerator (such as gravity sensors), activity log, service log information (such as what you are looking for, viewing), service error information, referrer URLs, and other information. Such information is collected to keep our services running, improve and optimize our service experience, and protect your account.

(8) When you use the service through a web browser, we may collect information on your browser and computer, including but not limited to your IP address, type of browser, language, date and time of access, software and hardware feature information, etc.

(9) When you use the service through the Onebox Express’s smart lockbox or service platform, we will effectively monitor the delivery process, the user’s delivery operation process, the operation process of the relevant parties and surrounding environment (telecommunications, internet, etc.) according to the requirements of relevant parties and the regulations of the law.

(10) The collection of other information from you is for reasonable needs such as providing the service, improving quality of the service. The information collected includes relevant information provided when you contact Onebox Express’s customer service, data from survey responses. However, we cannot obtain the information provided from you when using a third party service.  

Please understand that our functions and services provided to you are constantly being updated and developed. If a certain function or service is not described above but your information is still collected, we will use other methods such as reminders, text messages, notifications on website, etc. to explain to you the content, scope and purposes of the information collection and to obtain your consent.

Please note that Onebox Express will not actively obtain your personal information from third parties. If you need to obtain your personal information indirectly from a third party, we will provide you with the source, type and use scope of your personal information. In addition, we will strictly comply with relevant laws and regulations, request the third parties to protect the legality of the information provided by them. We will use your personal information in accordance with agreements with third parties and in accordance with relevant laws and regulations.

3. Use of user’s information

3.1. Onebox Express may use your personal information in the following services:

(1) Fill in your real name as required by the system, it is necessary to verify your identity to ensure that unauthorized people cannot log in;

(2) Provide logistics-related freight information and services;

(3) Process and collect payments;

(4) Provide you with customer support service for your requests, questions, comments and claims;

(5) Notify you of information which Onebox Express thinks may be of interest to you by phone, email, SMS, public account, etc.;

(6) Conduct data analysis, including analysis of trend, finance, market, etc. and perform accounting, auditing, bookkeeping and reconciliation.

3.2. To ensure the security of the service and to help us better understand the operation of our applications, we may record relevant information, for example, how often you use the application, data error, overall usage, performance data and app source. We will not combine the information stored by us in the analytic software with any personal identification information provided by you in the application.

3.3. If we use your personal information for other than the purposes stated at the time of collection, we will notify you again and must obtain your express consent before collecting your personal information.

4. You fully understand and agree that we do not need your permission or consent to collect and use your personal information in the following cases. We may not respond to your requests for corrections/modifications, deletions, cancellations, withdrawals of information consent and requests:

(1) Regarding national security, national defense security;

(2) Regarding public safety, community health and public interest

(3) Regarding judicial or administrative enforcement such as criminal investigation, prosecution, trial and enforcement;

(4) To protect the life, property and other major legitimate rights and interests of an individual without that individual’s consent;

(5) The personal information that you self-disclose publicly

(6) Collect the personal information from legally publicly disclosed information, such as legal news reports, government disclosures and other channels.

(7) Have to enter into and perform the relevant agreements or other written documents with you;

(8) Have to maintain the safe and stable operation of the services provided, such as detection and handling of service errors;

(9) Other cases as prescribed by law;

5. How we use cookies and similar technologies

(1) Cookie

To ensure the normal operation of the website, to provide you with a more comfortable browsing experience and to present you with content that may be of interest to you, we will store cookies, cookies of Flash or browser, linked application on your computer and mobile device. Such data typically includes identification code, website names and some local storage of numbers and characters (collectively, “Cookies”). With the support of cookies, websites can store data such as your favorites or items in your shopping cart.

If your browser or additional browser services allow it, you can modify our cookie acceptance or cookie refusal. For details, see AboutCookies.org. But if you do this, it may in some cases affect your secure access to our website and you may need to change the users settings when you visit our website.

(2) Technology similar to cookies

In addition to cookies, we also use web beacons, pixel tags, ETags and other similar technologies on our website. For example, the email we send you may contain an address link to the content of our website. If you click on a link, we’ll track the click to help us understand how interested you are in product or service, help us proactively improve the customer experience. Web beacons are typically a transparent image embedded in a web page or email. With the help of pixel tags in the email, we can know if the email has been opened or not. If you do not want your activities to be tracked in this way, you can unsubscribe from our mailing list at any time.

ETag (Entity Tag) is an HTTP protocol header transmitted between an Internet browser and an Internet server that can replace Cookies. ETag can help us avoid unnecessary server load, improve service efficiency, save resources and energy. At the same time, we may use ETag to record your identity, so that we can better understand and improve our products and services. Most browsers provide the users with a function to clear the browser cache data, you can perform the corresponding data deletion in the browser settings function. However, please note that if you disable ETag, you may not be able to fully experience the service.

6. Methods of sharing, transferring and publicly disclosing personal information  

6.1. We will not share your personal information with any company, organization or individual other than Onebox Express, except in the following cases:

(1) Obtain your consent or authorization in advance;

(2) Provide compliance with applicable laws and regulations, legal procedures, administrative or judicial requirements;

(3) To enable us to provide you with services, recommend information that may be of interest to you, identify unusual member accounts and protect the personal safety and property of our Onebox Express locker locations or other users from being compromised. Personal information concerning us is shared at our locker locations and/or from our designated service providers. We will only share necessary personal information and bound by the purposes outlined in this privacy policy. If we have a need to share your personal information, or the affiliated companies have a need to change the purpose of using your personal information, we will ask you for your permission and consent once again;

(4) By sharing your information, we can improve the customer service experience and provide the services for your needs;

(5) Resolve the disputes or disputes between you and others according to your needs.

6.2. We may share your order information, account information, device information and location information with partners and other third parties to ensure the smooth completion of the services provided for you. However, we will only share your personal information for the lawful, legitimate, necessary, specific and clear purposes, and will only share the necessary personal information to provide the service. Our partners do not have the right to use the personal information and share it for any other purpose.

Our partners include the following types:

(1) Suppliers of engineering goods or services

We may share your personal information with third parties, partners supporting our services. These supports include the provision of infrastructure engineering services, logistics and distribution services, mapping service, payment service, data processing service, etc. for us. Our purpose of sharing this information is to improve the basic and additional functions of our products and services.  

For example, we must share your order information with freight companies to provide freight-related services; we need to share the order number and order amount with the payment partners to confirm your payment instructions and complete the payment; we need to share your location information with mapping companies, so that you can use the most suitable locker points as required, etc.;

(2) Third party seller.  

We must share your order information and necessary information related to the transaction with our partners in order to meet your needs to purchase goods or services from them, request them to complete the next after-sales services;

(3) Partners entrusting us to promote.  

From time to time, we will provide promotional services on behalf of other companies to the customers using our services. We may use your personal information and a similar audience file formed from the collection of your non-personal information to share with the partners that entrust us to promote (“Entrustor”), but we will only provide these entrustors with the gender, coverage and effectiveness of advertising, without providing your personally identifiable information. For instance, we may allow the entrustor to collect the number of viewers of their promotional information, or the number of buyers of entrustor’s goods after viewing this information; or provide them with non-identifiable statistical information of each individual to help them understand their audience or customers.  

We share your personal information with partners and third parties as follows (suppliers are subject to change, we will require partners to comply with relevant laws and regulations and to protect closely follow personal data information):

(3.1) Statistical and data analysis providers: Infinity Valley Technology Joint Stock Company provides statistics and data analysis services. We may share mac address, device information, IMEI, IMSI, Operator, Android information provided to Infinity Valley Technology Joint Stock Company to provide you with statistical services and data analysis.

(3.2.) Payment function providers: Financial Services Corporation - Vietcombank, Infinity Valley Technology Joint Stock Company provide payment function services. We may share your mac address, device information, IMEI, IMSI information, Android ID provided to Financial Services Corporation - Vietcombank, Infinity Valley Technology Joint Stock Company to provide for you services with payment situations.

(3.3). Push Service Provider: a push technology service that provides a push technology service. We may provide IMSI, geographic location, MAC address, device information, IMEI, Android ID and operator information to Network Technology Company for day-to-day interaction. Infinity Valley Technology Corporation is available to provide you with news push services.

For details, please visit “Privacy Policy for Users Posting Personal Information”.

(3.4). Sharing function providers: Infinity Valley Technology Joint Stock Company provides sharing functionality services. We may share ICCID, Android Id, mac address, device information, IMEI, IMSI, from geolocation information provided to Network Technology Co., Ltd (Not available) and Computer System Co., Ltd.  (Not available) to provide you with sharing functions (e.g. share merchandise in a mall, invite friends to share).

(3.5). Map service providers: The map service is provided by Google Co., Ltd. (“Google”) and AutoNavi Software Co., Ltd. (“AutoNavi”). We may provide mac address, device information, IMEI, Android ID and geolocation information to Google and Technology Ltd., Co and AutoNavi that may be available to show you the location of locker and to search for nearby service stations.

(3.6). Investigation Service Provider: The investigation service is provided by Limited Company (Not Available). We may provide your device information, Android ID and voice information to the Company (Not Available) for your use of empty box and parcel requests, leasing of direct oral voice input search function.

(3.7). Browser service providers: Google provides browser services. We may provide your IMEI, IMSI and device information to Google to provide you with better HTML page browsing.

7. We will not provide your personal information to any company, organization or individual, except in the following cases:

(1) Obtain your prior consent or authorization;

(2) When you and the delivery unit have a dispute, you need to use images and videos provided by Onebox Express to resolve the dispute;

(3) Provide information pursuant to applicable laws and regulations, legal proceedings, administrative or judicial requirements;

(4) Be provided in accordance with relevant agreements signed with you (including electronic agreements entered over the internet and corresponding platform rules) or other legal documents;

(5) When it comes to mergers, acquisitions, asset transfers or similar transactions, if it involves the transfer of personal information, we will require new companies and organizations to keep your personal information and continue to be bound by this security policy. Otherwise, we will ask the merged, acquired or transferred Company or organization to request your permission and consent once again.

8. We will only publicly disclose your personal information in the following cases:

(1) Upon your request, disclose your designated personal information in a manner of disclosure to which you expressly consent;

(2) In the event that your personal information is required to be made available by regulatory and legal requirements, administrative enforcement authorities or judicial requirements, we may disclose your personal information based on the type of personal information requested and the method of disclosure. In compliance with laws and regulations, when we receive requests of above information disclosure, we will request the issuance of corresponding legal documents, such as subpoenas or investigation letters. We have carefully reviewed all requests to ensure that they have a legal basis and are limited to the collection of data obtained by law enforcement authorities for specific investigative purposes as well as have legal rights.

9. In the following cases, the sharing, transfer and public disclosure of your personal information does not require your prior permission and consent:

(1) Relating to national security and national defense;

(2) Relating to public safety, public health and public interest;

(3) Relating to judicial or executive enforcement such as criminal investigation, prosecution, trial and enforcement;

(4) Protect the life, property and other major legitimate rights and interests of oneself and another individual without the consent of that person;

(5) Your personal information self-discloses to the public;

(6) Collect personal information from lawfully publicly disclosed information, such as legal news reports, government disclosures, and other channels.

10. How to save and protect your personal information

10.1. In order to protect the security of your information, we have thoroughly assessed the level of network security protection and applied reasonable physical, electronic and management security measures to prevent information loss, improper use, unauthorized access or disclosure, including:

(1) We will use various security measures with a reasonable degree of security to keep information safe. For example, we will use encryption technology, including but not limited to SSL, anonymity and other means to protect your personal information;

(2) We enhance the security of the software installed on your device by continuously improving the technical means to prevent your personal information from being leaked out. For example, we will partially encrypt information locally on your device for a safe transmission to prevent viruses, Trojan Horse or other malicious programs, websites will learn about the application information installed on your device or running process of the information;

(3) In the unfortunate event of a security incident such as a leak of personal information, we will make an emergency plan to prevent the expansion of the security incident, and take corresponding handling measures, promptly notify and report to relevant competent authorities;

(4) We have established special management systems, procedures and organizations to ensure information security. For example, we severely limit who can access information, require them to comply with confidentiality obligations, and perform audits;

(5) We regularly conduct cybersecurity education, technical training, and skills assessment for departments and staff in charge of monitoring and managing cybersecurity.

10.2. In accordance with relevant laws and regulations, we save users' personal information collected in Vietnam.

10.3. We will save your personal data for as long as necessary to achieve the purposes stated in the policy, unless the retention period is extended or permitted by law under legal or regulatory requirements or permission.

10.4. When you use the service, you will inevitably disclose your personal information to the courier service companies. Please properly protect your personal information and provide it to others only when necessary. If you discover that your personal information has been revealed, especially your account and password, please contact us immediately via the contact information in Article 10 of this policy so that we can take appropriate action.

10.5. If there is an unfortunate incident of personal information security, we will notify you in accordance with the provisions of the law, including: the basic situation and possible impact of the security incident, the measures we have taken or will take, recommendations, remedies for you, etc. and ways you can protect yourself and reduce risks and be timely, etc. We will keep you informed of the relevant status of the case via email, letter, phone, push notification, etc. If it is difficult to inform the subject of the status of an individual's personal information, we will provide a reasonable and effective way to post the notice.

11. How to manage your personal information

If you need to inquire about your personal information, you can request it by: Open App –My -Top Personal Information. If you need to cancel your account, you can log out in the following ways: log into the Onebox Express Manager app and go through “My Settings -Cancel Account”; when the account is canceled, the message “Delivery status is complete, deposit amount is 0 VND and income Can cancel account when account has 0 VND remaining (if there is still balance, you have withdrawal) and the status of the item received is not in transit.

If you need to correct, add, delete personal information or withdraw your authorization, you can send an email to cskh@obx.vn, contact us to request correction, addition or deletion, cancel and provide relevant evidence. We will review related issues as soon as possible and respond within 15 business days after verifying your users identity.

12. How to process minors’ information

In the process of using Onebox Express smart lockers, we assume that you have the corresponding civil capacity. If you are a minor, we require the intervention of your parents or other guardians to help you carefully read and properly understand this security policy in order to use the service and provide information to us. Your use of Onebox Express requires the consent of your parents or other guardians.

If we realize that you are underage for the Onebox Express service, we will notify your guardians and ask your guardians to agree to rules on collecting and using children's personal information. Where it is allowed to collect children’s personal information with the consent of a parent or other guardian for using our products or services, we will only use, share, transfer or disclose when permitted by law and regulation, with the express consent of a parent or other guardian, or when necessary to protect children. If you are the parent or other guardian of a child, please pay attention to whether the child in your custody uses our services, after your permission. If you have any questions about the personal information of the children under your supervision, please contact us using the contact information in Section 10.

13. Change of the security policy

We may revise the content of this policy from time to time, and will remind and notify you simultaneously through reminders, text messages, website notices, etc., prior to changes take effect.

14. Contact us

If you have any questions, comments or suggestions regarding the content of this policy or perceive that your personal information may be leaked out, you can send an email to cskh@obx.vn and them I will respond to your request within 15 business days.