Data Confidentiality Agreement (NDA)
LEGAL BASIS
- The Civil Code 2015 (Bộ luật Dân sự 2015) — Article 387 on information in contract formation, Articles 351–360 on liability for breach of obligations, and Article 419 on recoverable damages;
- Commercial Law 2005;
- Intellectual Property Law (as amended in 2022) — on the protection of trade secrets;
- Law on Personal Data Protection 2025 (Law No. 91/2025/QH15) and Decree 356/2025/ND-CP;
- Cybersecurity Law 2025 (Luật số 116/2025/QH15);
- Law on Electronic Transactions 2023 — on the legal validity of data messages and electronic signatures;
- Decision No. 4567/QD-VBPL dated 01/06/2026 issuing the company's Legal Compliance Framework.
This agreement is an appendix to and an integral part of the Terms of Service, and applies alongside the Personal Data Protection Policy (PDPD).
THE PARTIES
Party A: Công ty Cổ phần Giải pháp Công nghệ và Phần mềm Phổ Tuệ (HiTechCloud)
Head office: 128 Đường Bình Mỹ, xã Bình Mỹ, TP. Hồ Chí Minh | Tax code: 0318222203
Party B: Customer / Partner / Contractor / Participant
Party A and Party B (each a “Party”, together the “Parties”) agree to enter into this Non-Disclosure Agreement on the following terms.
PART I – DEFINITIONS AND SCOPE
Article 1. Definitions
1.1. “Confidential Information” means any information, data, or documentation (in written, electronic, verbal, visual, or other form) that one Party (the “Disclosing Party”) provides to the other Party (the “Receiving Party”) in the course of exchange, cooperation, or the provision or use of the Service, that is marked as confidential or that would reasonably be understood, by its nature, to be confidential.
1.2. “Disclosing Party” is the party providing confidential information; “Receiving Party” is the Receiving Party of the Confidential Information. As this is a mutual agreement, each Party may be both Disclosing Party and Receiving Party.
1.3. “Related Party” means an employee, manager, adviser, lawyer, auditor or subcontractor of a Party who needs access to the Confidential Information in order to fulfill the purpose of this Agreement.
1.4. “Trade Secrets” as defined under the Law on Intellectual Property; “Personal data” as defined in the Personal Data Protection Law 2025.
Article 2. Scope of Confidential Information
2.1. Confidential Information includes, but is not limited to: (a) source code, system architecture, algorithms, technical documentation and information about unreleased products (including beta products); (b) trade secrets, business methods, strategy, pricing and commercial terms; (c) customer information, customer lists and personal data; (d) information about infrastructure, security configuration, vulnerabilities and defensive measures; (e) financial information, plans and projects; and (f) any other information marked or notified as confidential.
Article 3. Information outside the scope of confidentiality
3.1. Confidential Information does not include information that the Receiving Party can demonstrate: (a) was lawfully in the public domain before disclosure, or entered the public domain other than through the Receiving Party's fault; (b) was lawfully in the Receiving Party's possession before receipt, free of any confidentiality obligation; (c) was lawfully supplied by a third party without breach of any confidentiality obligation; or (d) was independently developed by the Receiving Party without use of the Confidential Information.
PART II – CONFIDENTIALITY OBLIGATIONS
Article 4. Obligations of the Receiving Party
4.1. The Receiving Party undertakes to: (a) keep Confidential Information confidential with at least the same degree of care it applies to its own confidential information, and in no case less than reasonable care; (b) use Confidential Information only for the purpose of the Agreement or contract between the Parties (the “Purpose”); (c) not disclose it to any third party without the Disclosing Party's written consent; and (d) share Confidential Information with Related Persons only on a need-to-know basis, ensuring that those persons are bound by equivalent confidentiality obligations.
4.2. The Receiving Party must not copy, reproduce, decompile or reverse engineer Confidential Information beyond what is necessary for the Purpose, and is responsible for any breach by its Related Persons as if it were its own act.
Article 5. Personal data protection
5.1. Where Confidential Information includes personal data (dữ liệu cá nhân), the Parties processing that personal data shall comply with the Personal Data Protection Law 2025 (Luật Bảo vệ dữ liệu cá nhân 2025), Decree 356/2025/NĐ-CP, and HiTechCloud's Personal Data Protection Policy (PDPD), including obligations regarding consent, protective measures, impact assessment, and data breach notification.
5.2. The Parties apply appropriate technical and organizational measures (encryption at rest and in transit, access control, logging) to protect Confidential Information, in line with the Cybersecurity Law 2025 (Luật An ninh mạng 2025).
Article 6. Information disclosure incidents
6.1. If Confidential Information is disclosed, accessed without authorization, or lost, the Receiving Party must notify the Disclosing Party as soon as possible and cooperate on investigation, remediation, and damage mitigation. If the incident involves personal data (dữ liệu cá nhân), the Parties shall cooperate to fulfill the breach-notification obligations under the Personal Data Protection Law 2025 (Luật Bảo vệ dữ liệu cá nhân 2025) and the PDPD.
Article 7. Disclosure required by law
7.1. The Receiving Party is permitted to disclose Confidential Information when lawfully requested by the competent state authority or as required by law, provided that (to the extent permitted by law) it gives prior notice to the Disclosing Party so that the Disclosing Party may take protective measures, and discloses only the minimum extent required.
PART III – OWNERSHIP, TERM AND TERMINATION
Article 8. Ownership
8.1. This Agreement transfers no ownership, intellectual property right or license in the Confidential Information, other than a limited right of use for the Purpose. All Confidential Information remains the property of the Disclosing Party.
Article 9. Return and destruction
9.1. When the Purpose is fulfilled, the agreement is terminated, or the Disclosing Party so requests, the Receiving Party must return or destroy all Confidential Information (including copies) and confirm this in writing, except for any portion it is required to retain under applicable law or a reasonable internal retention policy — that retained portion remains subject to the confidentiality obligation.
Article 10. Confidentiality period
10.1. The confidentiality obligations take effect on the signing date and continue throughout the term of the cooperation and 3 (three) years after termination, unless the Parties agree otherwise in writing.
10.2. For trade secrets and personal data specifically, the confidentiality obligation continues until the information ceases to be a trade secret under the Intellectual Property Law, or for the period prescribed by personal data protection law — whichever applies — and is not limited to the three-year term stated above.
Article 11. Breach, sanctions and damages
11.1. A party that breaches its confidentiality obligations is liable to compensate the non-breaching party in full for all actual damages incurred, under the Civil Code 2015 (Bộ luật Dân sự 2015), including reasonable remediation costs and legal fees.
11.2. Because damage arising from a confidentiality breach is often difficult to remedy through monetary compensation, the aggrieved Party has the right to request provisional emergency measures and other measures under the law to prevent and stop the breach.
11.3. Infringement of trade secrets, personal data or cybersecurity may also be subject to administrative penalties or criminal prosecution under applicable law.
Article 12. Term and termination
12.1. This Agreement takes effect on the date of signature (or when Party B accepts it electronically under the Law on E-Transactions 2023 (Luật Giao dịch điện tử 2023)) and remains in force until the confidentiality obligations under Article 10 have been discharged.
12.2. Termination of the partnership or the service contract does not end the confidentiality obligations that remain in force under this Agreement.
Article 13. General provisions
13.1. This Agreement is governed by the laws of Vietnam. Disputes are to be resolved first by negotiation and conciliation; failing that, they are to be resolved by the competent People's Court in Ho Chi Minh City, consistent with the Dispute Resolution section of the Terms of Service. Where Party B is a foreign organization, the Parties may agree to arbitration at VIAC.
13.2. If a provision of the Agreement is held invalid, the remaining provisions remain in force. Any amendment must be made in writing and confirmed by both Parties. The Agreement is made in Vietnamese; the Vietnamese version has the highest legal force.
