Personal Data Protection Policy

Through this Personal Data Protection Policy for Job Candidates (the "Policy"), we want Candidates to understand clearly how we collect, use, store, share and protect the Personal Data of Candidates throughout the application, interview, assessment and hiring-decision process, so as to safeguard the lawful rights and interests of Candidates in accordance with the law on personal data protection.

We recommend that Candidates read this Policy carefully before submitting an application.

In this Policy, "Messer", "we", "us" or "our" means one of the companies within the system of Messer companies in Vietnam. Please see the section "How to contact us" in this Policy for details of the Messer company in Vietnam that issues this Policy.

"Messer Group" means Messer together with its parent companies, subsidiaries, affiliates, branches and representative offices within the Messer group of companies.

We will update this Policy from time to time to inform Candidates of any changes to the way we use the personal data of Candidates. Candidates can see the date of the version currently in force at the end of this Policy.

If you have any questions or concerns about your personal data, please contact us using the information in the section "How to contact us" below.

Personal data means data in the form of symbols, letters, numbers, images, sounds or similar forms that is associated with, or helps to identify, a specific individual, and includes basic personal data and sensitive personal data. Personal data that has been de-identified is no longer personal data.

We may collect the following categories of data:

1. Identification data: full name; date of birth; sex; nationality; Citizen Identity Card/passport number; portrait photograph.

2. Contact data: telephone number; email address; permanent/temporary/contact address.

3. Education and professional data: educational attainment, field of study, degrees, certificates; employment history, work experience, skills; position applied for, expected salary; referee information (name, job title and contact details of referees voluntarily provided by the Candidate).

4. Sensitive personal data: collected and processed only to the extent necessary and appropriate for the position applied for, and on the basis of the Candidate's separate and explicit consent, including: health status stated in the Health Certificate (for positions requiring a pre-employment medical examination); sensitive personal data as defined by law contained in the Criminal Record Certificate (for positions where this is required by sector-specific legislation).

5. Other personal data processed as appropriate to each vacancy and to each specific stage of the recruitment process.

6. Technical data when the Candidate visits the careers site: IP address, time of access, pages visited, browser type and version, operating system and referring page, processed to operate and secure the careers site. Non-essential cookies are used only with the Candidate's consent, in accordance with the Cookie Policy on our homepage.

The personal data described above may be processed for the following purposes:

1. Receiving, screening and assessing the suitability of the Candidate's application for the vacancy.

2. Contacting and communicating with the Candidate about the progress of the recruitment process; scheduling interviews, tests and competency assessments.

3. Verifying and cross-checking information provided by the Candidate to the extent necessary, including contacting referees provided by the Candidate where necessary.

4. Making hiring decisions; preparing and sending offers of employment to successful Candidates and notifying recruitment results.

5. Completing the procedures necessary to enter into an employment/probation contract and transferring the information of successful Candidates into their official employee records.

6. Retaining the Candidate's application (including that of unsuccessful Candidates) for consideration for more suitable future vacancies, only with the Candidate's consent.

We process the personal data of Candidates primarily on the basis of the Candidate's consent. For transferring the records of successful Candidates into employee records and for retention required by law, we process data on the basis of performing the employment relationship and complying with the legal obligations of the employer. Retention of applications for future opportunities is based on the Candidate's separate consent.

Providing personal data is not a statutory or contractual obligation. However, if the Candidate does not provide the data necessary for the selection process, we will be unable to consider the Candidate's application.

We do not use fully automated decision-making systems or artificial intelligence to analyse, score, rank or make hiring decisions about Candidates. If we plan to introduce such mechanisms, we will notify Candidates in advance in accordance with the law.

We collect personal data directly from the Candidate when the Candidate submits an application, registers interest, provides information or takes part in interviews, tests or assessments, through the following channels:

a) Our recruitment website at www.messer.com.vn;

b) Our recruitment pages on LinkedIn ("Messer in Vietnam", "Messer Careers");

c) Online recruitment platforms;

d) The Messer Career Vietnam careers site (Teamtailor platform);

dd) Recruitment service providers on which the Candidate has posted a profile and agreed to share it with employers;

e) Recruitment groups and communities on Zalo and Facebook; and by email, application forms or in person at interviews.

In addition to the information provided directly by the Candidate, we may also receive the Candidate's personal data from other sources for recruitment purposes, including: recruitment agencies (headhunters); recruitment platforms and professional networks on which the Candidate has posted a profile and agreed to share it with employers; persons who refer the Candidate; and referees voluntarily provided by the Candidate.

For personal data received from sources other than the Candidate, we act as the Personal Data Controller and Processor for our own recruitment purposes. Upon receipt, we will inform the Candidate of the processing under this Policy and request the Candidate's confirmation of consent.

As regards referees, where the Candidate provides us with the personal data of another person, the Candidate must ensure that he or she has obtained that person's permission as required by law and has explained to that person how we will use their personal data.

This activity takes place only on our recruitment website, which operates on the Teamtailor platform. When a Candidate submits an application or actively connects with us through the recruitment website, the Candidate is invited to read and accept this Policy; such acceptance constitutes the Candidate's clear and voluntary consent allowing us to store and process their Personal Data. Only where the Candidate has consented will we use the Candidate's contact details to send information about suitable job opportunities, invitations to seminars, events or other career opportunities of ours.

This consent has a validity period set by us on the Teamtailor platform (currently six (6) months) and is subject to periodic re-confirmation. Before the period expires, the Teamtailor platform automatically sends an email inviting the Candidate to actively confirm their continued consent to our storing of, and sending of information to, the Candidate. If the Candidate confirms, the validity period is renewed for a further cycle. If the Candidate does not re-confirm, the consent will lapse; we will cease using the data for the above purpose and will handle the data in accordance with our data retention and deletion policy.

The Candidate has the right to withdraw consent, to opt out of receiving information, and to access, request a copy of, or request the deletion of their Personal Data at any time; the exercise of these rights is made as easy as giving consent. The Candidate may do so directly via the "Data & Privacy" section at the bottom of the recruitment website or within their connected profile on the Teamtailor platform, or by contacting us using the "How to contact us" section below.

We take the necessary steps to ensure that the personal data of Candidates is kept confidential and protected in accordance with the law when it is shared. Depending on the circumstances and where permitted by law, we may share the personal data of Candidates with the following parties:

• Within Messer and other members of the Messer Group: authorised individuals, on a need-to-know basis, for recruitment and human resources management purposes, including the manager of the department with the hiring need (Hiring Manager), the Administration and Human Resources Director, and the Recruitment Manager/Lead/Specialist/Intern; as well as other member companies, legal entities or individuals and functional departments within the Messer Group.

• Personal Data Processors (service providers) acting on our behalf: entities that process and store the personal data of Candidates on our behalf and under our instructions, and other service providers authorised by us (for example: information technology services, competency assessment/testing services, recruitment consultancy).

• Competent state authorities: where required by law or at the lawful request of a competent authority.

• Third parties in the event of restructuring, merger, acquisition or transfer: where we transfer (or propose to transfer) part of our business or assets, the parties to the transaction may receive the personal data of Candidates subject to a commitment to process it in a manner similar to this Policy.

We take the privacy and confidentiality of Candidates' personal data seriously.

Staff authorised to access the personal data of Candidates are trained and are obliged to comply with our data confidentiality and privacy standards.

However, no system can be completely secure. We therefore cannot guarantee the absolute security of the Candidate's Personal Data in certain cases, such as:

(i) Hardware or software failures during data processing that cause the loss of the Candidate's data;

(ii) Security vulnerabilities beyond our control, or attacks on our systems by hackers resulting in data leaks.

Candidates should be aware that whenever they disclose or make public their Personal Data, that data may be collected and used by others for purposes beyond the control of the Candidate and of us. We advise Candidates to safeguard their personal devices (mobile phones, tablets, personal computers, etc.) while using them, and to log out of their accounts when not in use.

If a data storage server is attacked, resulting in the loss, disclosure or leakage of the Candidate's Personal Data, We will notify the specialised personal data protection authority under the Ministry of Public Security within the time limit prescribed by law and will inform the Candidate in accordance with the law.

Cyberspace is not a secure environment and we cannot absolutely guarantee that the Candidate's Personal Data shared over cyberspace will always remain secure. When transmitting Personal Data over cyberspace, the Candidate should only use secure systems to access websites, applications or devices. The Candidate is responsible for keeping his or her access credentials for each website, application or device safe and confidential.

Personal data is processed from the time we receive the data provided by the Candidate and have an appropriate legal basis for processing in accordance with the law.

Successful Candidates: data on the Teamtailor platform is deleted within 02 weeks from the date the Candidate accepts the offer; the information is thereafter managed under the policy applicable to employees.

Unsuccessful Candidates: applications are retained on the Teamtailor platform for a maximum of 06 months from the date of the result, unless the Candidate consents to retention for future opportunities.

Applications retained for future opportunities: before the end of the 06-month period from the date of the recruitment result, the Teamtailor system automatically sends an email asking the Candidate whether he or she continues to consent to retention. If the Candidate selects "No", the data is deleted no later than 01 week from the date the request is received; if the Candidate selects "Yes", the data continues to be retained. If the Candidate does not respond before the period expires, the consent lapses and the data is deleted no later than 01 week from the expiry date.

In addition to the periods above, we may continue to retain the personal data of Candidates to the extent and for the period necessary to perform our legal obligations or at the request of a competent state authority.

We respect the personal data of Candidates. Candidates have the following rights in relation to our processing of their personal data, unless otherwise provided by law:

1. The Candidate has the right to be informed about the Processing of his or her Personal Data, unless otherwise provided by law.

2. The Candidate has the right to decide whether to give consent to the Processing of his or her Personal Data, unless otherwise provided by law.

3. The Candidate has the right to access, view and rectify, or request rectification of, his or her Personal Data, unless otherwise provided by law. We will rectify Personal Data at the Candidate's request or as required by sector-specific legislation. Where this is not possible, we will inform the Candidate in accordance with the agreement between us and the Candidate and with the law.

4. The Candidate has the right to erase, or request erasure of, his or her Personal Data in accordance with the law.

5. The Candidate has the right to request restriction of the Processing of his or her Personal Data in accordance with the law. We will restrict processing upon the Candidate's request, to the extent technically feasible, unless otherwise provided by law or agreed by the parties.

6. The Candidate has the right to request that we provide him or her with his or her Personal Data, unless otherwise provided by law. We will provide the Candidate's Personal Data upon the Candidate's request, unless otherwise provided by law.

7.  The Candidate has the right to withdraw consent for the processing purposes to which he or she has consented, unless otherwise provided by law. Upon receiving the request, We will inform the Candidate of the consequences and damage that may arise from the withdrawal of consent. Where the withdrawal of consent affects the performance of a contract between Us and the Candidate, Our legal obligations, the life, property and lawful rights and interests of the Candidate or of other organisations or individuals, or tasks of protecting national security, social order and safety, we have the right to restrict, suspend, terminate or cancel part or all of the contract for the provision of products, goods or services between Us and the Candidate. We bear no legal liability or obligation to compensate for any loss suffered by the Candidate in such a case. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. If the Candidate withdraws consent to the processing of his or her application for recruitment purposes, we will be unable to continue considering the Candidate's application.

8. Right to object to data processing: to object to the processing of his or her personal data in order to prevent or restrict the disclosure of personal data, or on other grounds as provided by law.

9. Right to lodge complaints, denunciations and lawsuits: to lodge complaints or denunciations or to initiate legal proceedings in accordance with the law.

10. Right to claim compensation for damage: to claim compensation for damage in accordance with the law where there is a violation of the regulations on the protection of his or her personal data, unless otherwise agreed by the parties or provided by law.

11.  Right to self-protection: to protect himself or herself in accordance with the Civil Code and related laws, or to request competent agencies or organisations to take measures to protect civil rights in accordance with the law.

Candidates may exercise the above rights by contacting us as set out in the section "How to contact us". Where the exercise of a Candidate's rights affects our legal obligations or the lawful rights and interests of others, we will handle the matter in accordance with the law and inform the Candidate.

How to exercise your rights

To exercise the rights above, Candidates should access the Personal Data Protection Policy on the website and navigate to the section “Guidance on submitting requests to exercise data subject rights” for detailed instructions. The guidance explains how to submit a request, what information to provide and the time limits for handling it. Requests should be sent to the personal data protection function of the Company that advertised the position for which the Candidate applied, using the contact details in the section “How to contact us”. To protect the Candidate's personal data, we may ask the Candidate to verify his or her identity before handling the request. We will acknowledge receipt of the request within 02 working days and handle it within the time limits prescribed by law.

Candidate's obligations regarding personal data

1. To provide complete, truthful and accurate personal data and other necessary information during the application process, and to notify us promptly of any changes. We process and protect personal data based on the information provided by the Candidate; the Candidate is therefore responsible for the accuracy of the information provided.

2. To respect and protect the personal data of others; to provide the personal data of another person only with that person's consent.

3. To cooperate with us and the competent state authorities where an issue affecting the security of personal data arises; to notify us promptly upon discovering errors or mistakes or suspecting that personal data has been compromised.

4. To comply with the law on personal data protection and other obligations under the law.

For each application, the Personal Data Controller and Processor is the Company that advertised the position for which the Candidate applied, as named in the job advertisement. That Company is responsible for all processing of the Candidate's personal data during the recruitment process under this Policy.

Where the Candidate applies for positions with several different Companies, each Company is the Personal Data Controller and Processor for the applications sent to that Company.

Where the Candidate is successful and enters into an employment contract, from the effective date of the employment contract the Candidate's personal data is processed under the Personal Data Protection Policy for Employees.

All requests, questions or complaints relating to personal data should be sent by the Candidate to the personal data protection function of the Company that advertised the position for which he or she applied, using the details below:

Legal entity: CÔNG TY TNHH KHÍ CÔNG NGHIỆP MESSER HẢI PHÒNG

Address: Tổ dân phố 2, Phường An Dương, Thành phố Hải Phòng, Việt Nam

Email: pdp.support@messer.com.vn

Or by post to the mailing address: Văn phòng đại diện Công ty TNHH Khí Công Nghiệp Messer Hải Phòng tại Hà Nội, Tòa nhà HEAC Hàm Long, số 14–16 Phố Hàm Long, Phường Cửa Nam, Thành phố Hà Nội, Việt Nam

Or

Legal entity: CÔNG TY TNHH KHÍ CÔNG NGHIỆP MESSER VIỆT NAM

Address: Số 21, Đường số 3, Khu công nghiệp Việt Nam - Singapore (VSIP), Phường Thuận Giao, Thành phố Hồ Chí Minh, Việt Nam.

Email: pdp.support@messer.com.vn

Or by post to the mailing address: Số 21, Đường số 3, Khu công nghiệp Việt Nam - Singapore (VSIP), Phường Thuận Giao, Thành phố Hồ Chí Minh, Việt Nam.

Or

Legal entity: CÔNG TY TNHH KHÍ CÔNG NGHIỆP MESSER QUẢNG NGÃI

Address: Khu công nghiệp phía Đông khu kinh tế Dung Quất, thôn Tân Hy, Xã Vạn Tường, Tỉnh Quảng Ngãi, Việt Nam

Email: pdp.support@messer.com.vn

Or by post to the mailing address: Khu công nghiệp phía Đông khu kinh tế Dung Quất, thôn Tân Hy, Xã Vạn Tường, Tỉnh Quảng Ngãi, Việt Nam

This Policy was last updated on 30 October 2026.

Through this Personal Data Protection Policy for Other Data Subjects (the "Policy"), we wish you to understand clearly how we collect, use, store, share and protect your personal data when you contact us, transact or cooperate with us, or visit our premises, so as to safeguard your lawful rights and interests in accordance with the law on personal data protection.

In this Policy, "Messer", "we", "us" or "our" means one of the companies forming part of the Messer group of companies in Vietnam. Please see the section "How to contact us" in this Policy for details of the Messer company in Vietnam issuing this Policy.

"Messer Group" means Messer together with its parent companies, subsidiaries, affiliates, branches and representative offices within the Messer group of companies, the ultimate parent company being Messer SE & Co. KGaA (Federal Republic of Germany).

"You" means an individual whose personal data is processed by us and who falls within one of the following groups:

a) customers who are individuals or household businesses purchasing or renting industrial gases, medical gases, specialty gases, cylinders, equipment and services from Messer, including individuals who contact us to learn about products or services or to request a quotation;

b) representatives, contact persons, authorised persons and staff of corporate customers, such as persons placing or receiving orders and accounting or technical staff;

c) suppliers who are individuals or household businesses supplying goods or services to Messer, such as experts, independent consultants and freelancers;

d) representatives, contact persons and staff of corporate suppliers and contractors, including contractor personnel working at Messer premises and drivers and escorts of carriers delivering or collecting goods;

đ) visitors on business, guests on site tours and walk-in visitors at Messer offices, plants and filling stations, including representatives of state authorities carrying out work or inspections;

e) participants in seminars, training programmes and events organised or attended by Messer;

g) persons contacting Messer by email, telephone or hotline, including persons submitting feedback or complaints, persons reporting misconduct through the Messer Group whistleblowing channel, and residents in the vicinity of Messer premises.

Please see the section "How to contact us" in this Policy for details of the Messer Group member issuing this Policy.

We will update this Policy from time to time to inform you of any changes to the way we use your personal data. The date of the version currently in force is shown at the end of this Policy.

If you have any questions or concerns about your personal data, please contact us using the details in the section "How to contact us" below.

Personal data means digital data or information in any other form that identifies or helps identify a specific individual, including basic personal data and sensitive personal data. Personal data that has been de-identified is no longer personal data.

Depending on your relationship with Messer, we may collect the following categories of data:

Sensitive personal data is collected and processed only to the minimum extent necessary. You will be clearly informed where the data being collected is sensitive personal data, including:

a) health status: information on injuries and first aid in the event of an accident or incident at Messer premises;

b) images of identity documents, only where required by law or where necessary to enter into a contract with you as an individual;

c) information on breaches of law, only where it arises in the course of compliance screening or the handling of whistleblowing reports, and only to the extent necessary.

We do not intentionally collect data concerning your racial or ethnic origin, political opinions, religion or beliefs, sex life or sexual orientation. Where such information already appears on documents you provide, we retain it only to the extent necessary as required by law and do not use it for any other purpose.

Where children visit Messer premises (for example, accompanying their parents or relatives), we record only the information necessary for site access and safety, through the child's legal representative, guardian or relative.

The personal data described above may be processed for the following purposes:

1. Receiving and responding to your enquiries; providing advice and quotations; assessing technical requirements at the site of use.

2. Entering into and performing contracts with customers: receiving orders, delivery and collection, installation and maintenance of equipment, management of cylinders and rented assets, monitoring of receivables, payment and invoicing.

3. Selecting, evaluating, entering into and performing contracts with suppliers and contractors; making payments to suppliers.

4. Compliance screening of customers and suppliers in accordance with the Messer Group Code of Conduct and compliance policies (anti-corruption, export control, sanctions and conflicts of interest).

5. Access control and ensuring security, safety and fire prevention and fighting at Messer premises: visitor registration, issuing visitor badges, safety inductions and CCTV.

6. Ensuring safety in the delivery and collection of gases and dangerous goods at Messer premises: checking the qualifications of drivers and escorts, vehicles and transport documents.

7. Receiving and handling feedback, complaints and incidents relating to products and services; receiving and handling reports made through the Messer Group whistleblowing channel.

8. Emergency response, first aid, and reporting of accidents and incidents occurring at Messer premises.

9. Performing obligations relating to accounting, tax, invoicing, reporting and record retention, and responding to lawful requests of competent state authorities.

10. Resolving disputes, recovering debts, and protecting the lawful rights and interests of Messer before competent authorities.

11. Operating the customer and supplier management systems and the shared information technology systems of the Messer Group.

12. Sending information about products and services, newsletters and event invitations; conducting customer satisfaction surveys.

13. Organising seminars, safety training and events; using your photographs and video on the communication channels of Messer and the Messer Group.

The legal basis for each of the above purposes, including which purposes require your consent and which do not, is explained in the section "When do we ask for your consent?".

We collect personal data directly from you when you contact us, request a quotation, place an order, enter into a contract, register as a supplier, register for site access, attend an event or submit feedback to us.

We may also receive your personal data from the following sources:

a) the organisation you work for, such as a customer, supplier, contractor or carrier, when that organisation provides details of its representatives, contact persons or staff performing the contract;

b) lawful publicly available sources, such as the National Business Registration Portal, company websites and trade directories, solely in respect of information relating to business activities;

c) member companies of the Messer Group, in respect of customers and suppliers that have relationships with several Group members;

d) Messer's introducers, distributors and agents [if any];

đ) providers of compliance screening tools, in respect of the results of screening against sanctions lists.

Personal data received from sources other than you directly is used only for the relevant purposes, and we will inform you of the processing under this Policy at our first contact with you.

At Messer premises, certain data is recorded by the following means:

a) Site access registration: you register your details at the security gate and receive a safety induction before entering production areas.

b) CCTV: cameras are installed at entrances, production areas, warehouses, gas filling areas, car parks and common areas to ensure security, safety and fire prevention and fighting. Areas covered by CCTV may be marked by notices before you enter.

c) Transport eligibility checks: drivers and escorts delivering or collecting gases and dangerous goods are checked for their driving licence, training certificate and vehicle documents in accordance with the law and the plant's safety rules.

Where you provide personal data of other persons (for example, your staff, consignees, drivers or authorised persons), you must ensure that you have informed those persons, obtained their permission where required by law, and explained to them how we use their personal data.

Under the law on personal data protection, the consent of the data subject is one of the lawful bases for processing personal data, but not the only one. Article 19 of the Law on Personal Data Protection permits personal data to be processed without the data subject's consent in certain cases, such as: to perform an agreement between the data subject and the relevant organisation in accordance with the law (for example, a sale and purchase or service contract between you and Messer); to perform obligations under the law; to protect the life or health of the data subject or others in an emergency; or to protect legitimate rights and interests against infringement.

The legal basis for each purpose listed in the section "Why do we collect your personal data?" is determined as follows:

Where you are a representative, contact person or staff member of a corporate customer, supplier or contractor (groups b and d): your personal data is processed to enter into and perform the contract between Messer and the organisation you work for. That organisation is responsible for informing you that your data is provided to Messer and for obtaining your consent where required by law, in accordance with its undertakings in its contract with Messer.

For purposes that do not require consent: we process personal data on the legal bases set out in the table above and give you full notice through this Policy. The provision of data for these purposes is necessary to enter into and perform contracts, to ensure safety on site and to comply with the law. If you do not provide the data, or provide it incompletely, we may be unable to carry out the transaction, to admit you to production areas or to complete the related procedures.

For purposes that require consent: we process personal data only with your consent, given by a clear means.

Withdrawal of consent and its consequences

You have the right to withdraw your consent for purposes that require consent at any time, by written notice (including in electronic form) sent to us as described in the section "How to contact us". Before doing so, please note the following:

a) Scope of withdrawal: the right to withdraw consent applies only to processing based on consent. It does not apply to processing that does not require consent under Article 19 of the Law on Personal Data Protection, including data that we must process to perform contracts and legal obligations (Clause 1, Article 10 of the Law on Personal Data Protection). In respect of such data, you may still exercise your other rights, such as accessing, rectifying or requesting the provision of your data.

b) No retroactive effect: withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal (Clause 4, Article 10 of the Law on Personal Data Protection).

c) Consequences for you: we will cease processing your data for the relevant purpose. Depending on the purpose, you will no longer receive marketing information or event invitations; your images will not be used in new publications or communications content, although printed materials already issued before the withdrawal cannot be recalled but will not be reprinted; in respect of health information used for the supply of medical gases, we may be unable to continue supplying products for that use.

d) Notice of consequences: upon receiving your request, we will inform you of any specific consequences that may arise and will carry out your request within the time limit prescribed by law.

We take the necessary steps to ensure that your personal data is kept confidential and protected in accordance with the law when it is shared. Depending on the circumstances and where permitted by law, we may share your personal data with the following recipients:

• Within Messer and other members of the Messer Group: authorised individuals, on a need-to-know basis, in the sales, customer service, purchasing, accounting, health, safety and environment, security, information technology and legal departments and other departments assigned relevant tasks, within the scope of their duties. Data may also be shared with Messer SE & Co. KGaA and member companies to operate the customer and supplier management systems and shared information technology systems, prepare consolidated reports, serve customers operating in several countries, carry out compliance screening and receive reports through the Group whistleblowing channel.

• Personal Data Processors and partners providing services to Messer: entities that process or store your personal data on our behalf and on our instructions, or that provide services to Messer, for example: providers of IT infrastructure and software, customer management systems and e-invoicing; transport, freight forwarding and logistics providers; on-site security service providers; equipment maintenance and inspection providers; banks; event organisers; providers of compliance screening tools; consultants, auditors and lawyers; and other entities and organisations serving the purposes set out in the section "Why do we collect your personal data?".

• Insurance companies: where an incident or loss arises that requires the settlement of an insurance claim.

• Competent state authorities: tax, customs and police authorities, authorities responsible for fire prevention and fighting, industrial safety and health, courts and other authorities, where required by law or upon a lawful request of a competent authority.

• Third parties in the event of restructuring, merger, acquisition or transfer: where we transfer (or propose to transfer) part of our business or assets, the parties to the transaction may receive your personal data subject to an undertaking to process it in a manner similar to this Policy.

Yes. As the information technology systems, customer and supplier management systems and certain other management systems of the Messer Group are located outside Vietnam, your personal data may be transferred abroad to the recipients listed in the section "With whom may we share your personal data?".

We comply with Vietnamese law on cross-border transfers of personal data, including preparing a cross-border personal data transfer impact assessment dossier and completing the procedures with the specialised personal data protection authority under the Ministry of Public Security where required by law.

We attach great importance to the privacy and security of your personal data.

We apply appropriate organisational and technical measures. Employees authorised to access your personal data are trained and are obliged to comply with our standards on data security and privacy.

Nevertheless, no system can be completely secure. Risks may still arise in certain circumstances, such as: (i) hardware or software errors during data processing resulting in data loss; or (ii) security vulnerabilities beyond our control, or attacks on systems resulting in data leakage.

We therefore recommend that you use secure communication channels when sending information to us and do not send sensitive personal data unless requested.

Your personal data is retained for the period necessary for the purpose of processing, as required by law or as agreed. At the end of that period, we delete or destroy your personal data, unless otherwise agreed or provided by law.

At the end of the retention period, data is deleted or destroyed by secure means. In addition to the above periods, we may continue to retain your personal data to the extent and for the period necessary to perform legal obligations, resolve disputes or comply with requests of competent state authorities.

We respect your personal data. You have the following rights in relation to our processing of your personal data, unless otherwise provided by law:

Your rights

1. Right to be informed: to be informed about the processing of your personal data.

2. Right to give or refuse consent: in respect of processing purposes that require your consent.

3. Right to withdraw consent: in respect of processing purposes based on consent, within the scope and with the consequences set out in the section "When do we ask for your consent?". Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Right to access and rectify data: to access, rectify or request rectification of your personal data. You may request updates to your contact details and invoicing information at any time.

5. Right to request the provision of data: to request that we provide you with your personal data.

6. Right to request erasure of data: to request erasure of your personal data in accordance with the law.

7. Right to request restriction of processing: to request restriction of the processing of your personal data in accordance with the law.

8. Right to object to processing: to object to the processing of your personal data in accordance with the law, including the use of personal data for marketing purposes.

9. Right to complain, denounce, bring legal action and claim damages: in accordance with the law, including the right to submit a report to the specialised personal data protection authority under the Ministry of Public Security.

10. Right to request protective measures: to request us or competent authorities to implement measures and solutions to protect your personal data in accordance with the law.

How to exercise your rights

To exercise the above rights, please refer to the detailed guidance [here]. The guidance sets out how to submit a request, the information to be provided and the time limit for handling it. Requests should be sent to the personal data protection department of the Company with which you transact, work or are in contact, using the details in the section "How to contact us". To protect your personal data, we may ask you to verify your identity before handling your request. We will acknowledge receipt of your request within 02 working days and handle it within the time limit prescribed by law.

Your obligations in relation to personal data

1. Provide complete, truthful and accurate personal data as required by law and the contract, and inform us promptly of any changes, particularly to payment and invoicing information.

2. Respect and protect the personal data of others: provide us with the personal data of other persons only after informing them and obtaining their consent where required by law; keep confidential, and use solely for the purpose of the cooperation, the personal data of Messer employees to which you have access in the course of the cooperation.

3. Comply with the site access and safety rules of Messer premises, including not taking photographs or video in production areas and not recording Messer employees or other visitors without permission.

4. Inform us promptly upon discovering errors or inaccuracies, or suspecting that personal data has been compromised.

5. Comply with the law on personal data protection.

The Personal Data Controller-Processor of your personal data is determined as follows:

a) For data subjects in the groups referred to in points a, b, c and d of Article 1, the Controller-Processor is the Company that has entered into, or intends to enter into, a contract or purchase order with you or with the organisation you represent or work for. Where no contract has yet been entered into, it is the Company from which you requested a quotation;

b) For data subjects in the group referred to in point đ, the Controller-Processor is the Company that manages and operates the office, plant or filling station you visit;

c) For data subjects in the group referred to in point e, the Controller-Processor is the Company organising the event, or the Company attending the event that directly collects your personal data at that event;

d) For data subjects in the group referred to in point g, the Controller-Processor is the Company you contact, or the Company concerned by your feedback, complaint or misconduct report.

The Company determined under this clause is responsible for all processing of your personal data under this Policy.

Where you have relationships with several Companies at the same time, each Company is the Controller-Processor of the personal data arising from the relationship between you and that Company.

Please send any request, question or complaint concerning personal data to the personal data protection department of the relevant Company using the details below:

Legal entity: CÔNG TY TNHH KHÍ CÔNG NGHIỆP MESSER HẢI PHÒNG (Messer Hai Phong Industrial Gases Co., Ltd.)

Address: Tổ dân phố 2, Phường An Dương, TP Hải Phòng, Việt Nam (Residential Group 2, An Duong Ward, Hai Phong City, Vietnam)

Email: pdp.support@messer.com.vn

Or by post to the correspondence address: Hanoi Representative Office of Messer Hai Phong Industrial Gases Co., Ltd., HEAC Building, 14–16 Ham Long Street, Phan Chu Trinh Ward, Hoan Kiem District, Hanoi, Vietnam.

Or

Legal entity: CÔNG TY TNHH KHÍ CÔNG NGHIỆP MESSER VIỆT NAM (Messer Vietnam Industrial Gases Co., Ltd.)

Address: Số 21, Đường số 3, Khu công nghiệp Việt Nam - Singapore (VSIP), Phường Thuận Giao, Thành phố Hồ Chí Minh, Việt Nam (No. 21, Street No. 3, Vietnam–Singapore Industrial Park (VSIP), Thuan Giao Ward, Ho Chi Minh City, Vietnam)

Email: pdp.support@messer.com.vn

Or by post to the correspondence address: No. 21, Street No. 3, Vietnam–Singapore Industrial Park (VSIP), Thuan Giao Ward, Ho Chi Minh City, Vietnam.

Or

Legal entity: CÔNG TY TNHH KHÍ CÔNG NGHIỆP MESSER QUẢNG NGÃI (Messer Quang Ngai Industrial Gases Co., Ltd.)

Address: Khu công nghiệp phía Đông khu kinh tế Dung Quất, thôn Tân Hy, Xã Vạn Tường, Tỉnh Quảng Ngãi (Eastern Industrial Park, Dung Quat Economic Zone, Tan Hy Hamlet, Van Tuong Commune, Quang Ngai Province, Vietnam)

Email: pdp.support@messer.com.vn

Or by post to the correspondence address: Eastern Industrial Park, Dung Quat Economic Zone, Tan Hy Hamlet, Van Tuong Commune, Quang Ngai Province, Vietnam.

This Policy was last updated on 30 October 2026.

Your rights in respect of your personal data are set out in the Personal Data Protection Notice that we have published on our website. You may exercise those rights by following the instructions below.

To ensure that your request is resolved promptly and accurately, we encourage you to use the Request Form and follow these steps:

Step 1: Download the Request Form. The form is available in five languages: Vietnamese, English, Chinese, Japanese and Korean. Please choose the appropriate language at:

1. https://messer.dev.bizfly.site/storage/media/2026/11/for-public-phieu-yeu-cau-cung-cap-ban-sao-dlcn-5-ngon-ngu-4TL8op.docx

2. https://messer.dev.bizfly.site/storage/media/2026/11/for-public-phieu-yeu-cau-xoa-dlcn-en-QLy5Cr.docx

3. https://messer.dev.bizfly.site/storage/media/2026/11/for-public-phieu-yeu-cau-thuc-hien-quyen-khac-dlcn-en-N4d9kK.docx

Step 2: Complete the form. Enter your full name, contact details and your relationship with us (customer, partner, job applicant, employee…), and tick the right(s) you wish to exercise.

Step 3: Send it to us. Send the signed form through one of the channels listed in Section 3.

Step 4: Receive acknowledgement and the result. We will acknowledge receipt of your request within 02 working days and provide the result within the statutory time limits set out in Section 4.

All requests are forwarded to our Personal Data Protection Department.

Time limits run from the date on which we receive a complete and valid request and supporting documents, in accordance with Article 5 of Decree No. 356/2025/ND-CP.

Where fulfilment requires cooperation with a data processor or a third party, the time limit may be longer as provided by law (15, 20 or 30 days). Where an extension is needed, we will notify you of the reasons before the time limit expires.

• Identity verification. To protect you, we compare the information in the form with the data we hold. We will only ask for additional documents where genuinely necessary.

• Submitting on behalf of another person. If you are submitting a request on behalf of another person, please attach a power of attorney or documents proving your lawful authority to represent them.

• If you are not satisfied. You may give us further feedback through the channels listed in Section 3.

Further details on how we process personal data are set out in our Personal data protection policy