1. Scope of application

This Privacy Policy applies to personal data processing carried out by Aladdin International Vision Joint Stock Company (“ALADDIN”, “we”, “us” or “our”) while providing products and services and operating channels within the ALADDIN system.

It covers data generated when customers visit the Tian Long website, make a reservation, dine at a restaurant, join Aladdin Rewards, receive offers, contact customer care, apply for a position, answer a survey, or interact with us through digital channels and business locations.

This policy does not govern independent processing by third parties. If you are directed to a third-party website, application or service, please review that provider's privacy policy.

2. Definitions

• Personal data means information in the form of symbols, writing, numbers, images, sounds or similar forms that relates to, or can identify, a particular person.
• Basic personal data includes identity, contact, transaction, account and other information classified as basic data by applicable law.
• Sensitive personal data is data closely connected to privacy which, if compromised, may directly affect an individual's lawful rights and interests.
• Data subject means the individual to whom personal data relates.
• Processing includes one or more operations performed on personal data, such as collecting, recording, analyzing, confirming, storing, changing, publishing, combining, accessing, retrieving, recovering, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting or destroying it.
• Data controller means the organization that determines the purposes and means of processing. A data processor processes data on behalf of the controller under a contract or agreement.
• Consent means a freely given, specific and affirmative indication that a data subject permits processing after receiving adequate information.

3. Data controller and contact details

These contact points receive requests about personal data, data subject rights and questions concerning this policy.

4. Processing principles and legal bases

ALADDIN processes personal data lawfully, fairly and transparently; for stated purposes; with data minimization and reasonable accuracy; for a limited retention period; and with appropriate security, confidentiality and accountability.

Depending on the circumstances, processing relies on one or more of the following bases:

• The data subject's valid consent;
• Performance of a contract, transaction or a request made before entering into a contract;
• Compliance with ALADDIN's legal obligations;
• Protection of the life, health or vital interests of the data subject or another person in an emergency;
• Other circumstances permitted by law, including protecting the lawful rights and interests of ALADDIN or a relevant party without disproportionately affecting the data subject's rights.

Where processing depends on consent, you may withdraw consent at any time. Withdrawal does not affect processing lawfully completed before we receive your request.

5. Categories of personal data collected

Mandatory fields will be identified when data is collected. If required data is not provided, we may be unable to complete certain requests, transactions or benefits.

6. Sources of personal data

We may collect personal data from:

• You directly when you reserve a table, register an account, join a program, complete a form, contact support, apply for a role or use our services;
• Your activity on the Tian Long website, Aladdin Rewards and other digital channels through cookies, system logs and similar technologies;
• Restaurants, member companies or departments within the ALADDIN system where necessary to provide services;
• Payment, delivery, reservation, media, social network and other service partners when you use a relevant feature and there is a valid basis for the transfer;
• Publicly available sources or sources permitted by law.

If you provide another person's data to ALADDIN, you must have the right to do so and must give that person any notice required by law.

7. Personal data in Aladdin Rewards

When you join Aladdin Rewards, we may process registration details, membership ID, points, membership tier, transaction history, offers received or redeemed, device data and location data if you permit access.

This data is used to create and authenticate accounts, record transactions, manage points and tiers, provide benefits, personalize offers, support members, prevent fraud and improve the program.

ALADDIN may engage platform, hosting, messaging or analytics providers to operate the program. They may process data only under our instructions, within the agreed scope of work and subject to appropriate security obligations.

The Aladdin Rewards terms apply alongside this policy. If provisions differ on personal data protection, the provision offering stronger protection to the data subject will prevail to the extent permitted by law.

8. Purposes of processing and retention periods

ALADDIN keeps data only as long as needed for the stated purpose, contractual duties, dispute resolution, protection of lawful rights and legal requirements. Indicative periods for our main activities are set out below:

After the applicable period, data will be deleted, destroyed, anonymized or segregated where continued preservation is required by law.

9. Cookies, tracking technologies and advertising

The Tian Long website may use cookies, pixels, SDKs, server logs and similar technologies to maintain sessions, remember choices, measure performance, analyze aggregate behavior, protect security and provide relevant content.

These technologies may include:

• Essential cookies: required for website operation, security and core functionality;
• Functional cookies: remember language, region, restaurant or user choices;
• Analytics cookies: help us understand website use and improve the experience;
• Advertising cookies: measure campaign effectiveness and deliver relevant content where consent is required and obtained.

You can manage cookies through the controls available on the website or in your browser. Disabling essential cookies may prevent some functions from working correctly. Analytics or advertising partners may set their own technologies and are responsible under their respective policies.

10. Data sharing and transfer

ALADDIN does not sell personal data. We share data only where necessary with:

• Companies, brands, restaurants and departments within the ALADDIN system to fulfill transactions and provide customer care;
• Technology, cloud hosting, CRM, payment, communication, reservation, delivery, analytics, marketing, security and loyalty-program providers;
• Partners involved in delivering a product, service or benefit you request;
• Government, law enforcement, judicial or other competent authorities where required by law;
• A lawful recipient in a restructuring, merger, asset sale or other corporate transaction.

Recipients must protect confidentiality, process data only for the agreed purpose, limit access, and return or delete data when their work ends unless applicable law requires otherwise.

11. Cross-border transfer of personal data

Some infrastructure, software, analytics or support providers may operate servers or personnel outside Vietnam. Personal data may therefore be stored in or accessed from another country.

ALADDIN conducts cross-border transfers in accordance with applicable requirements, including impact assessment, preparation and retention of required records, use of an appropriate processing basis, completion of procedures with competent authorities where required, and contractual, organizational and technical safeguards.

You may contact us for reasonable information about the destination and protections applied to a cross-border transfer involving your data.

12. Cybersecurity and data protection

ALADDIN uses measures appropriate to risk, including access controls, authentication, encryption or masking where suitable, backups, logging, anomaly monitoring, vendor management, staff training, testing and incident-response procedures.

Access is limited to personnel who need data for their work and who are subject to confidentiality obligations. We periodically review systems, procedures and safeguards to address changing risks and technology.

No electronic transmission or storage method is completely secure. If an incident may affect personal data, we will assess it, contain harm, remediate the issue and notify competent authorities or data subjects as required by law.

You are responsible for safeguarding login information, not sharing verification codes and promptly notifying us if you suspect unauthorized account access.

13. Children and represented persons

For children, persons who have lost or have limited civil act capacity, and persons with difficulty in perceiving or controlling their acts, processing is carried out through the lawful representative and in accordance with applicable protection requirements.

When processing data of a child aged seven or older, we will verify and obtain consent as required by law, including consent from the child and a parent or guardian where necessary. For a child under seven, consent is given by the lawful representative.

If we learn that a child's data was provided without proper authority or required consent, ALADDIN will stop processing and delete it to the extent permitted by law.

14. Data subject rights and response times

Subject to applicable law, data subjects have the right to be informed; to consent or refuse consent; to withdraw consent; to access, review, correct or request provision of data; to request deletion or restriction; to object to processing; and to complain, denounce, initiate legal action, claim compensation and protect themselves.

To exercise a right, email [email protected]. Please identify yourself, provide contact details, state the right being exercised and the relevant data or transaction, and include suitable identity verification. We may request more information to prevent disclosure to an unauthorized person.

Direct marketing opt-out requests are prioritized for acknowledgement within 72 hours. Certain rights may be limited where processing is necessary to comply with law, perform contractual duties, protect another person's rights, support legal proceedings or meet another lawful exception. If we cannot fully satisfy a request, we will explain the reason to the extent permitted.

15. Third-party links and services

ALADDIN websites or communications may contain links to third-party platforms, applications, social networks, payment gateways or services. We do not control the way independent providers collect and process data.

A link does not mean ALADDIN endorses the third party's privacy practices. Please review that provider's terms and policy before submitting data or using the service.

16. Policy amendments

We may update this policy to reflect changes in law, technology, services or data practices. A new version will be posted on the Tian Long website with its effective date.

For a material change that significantly affects your rights, ALADDIN will provide appropriate notice and seek renewed consent where required. Continued use after the effective date has effect only to the extent permitted by law and does not replace mandatory consent.

17. Effective date and contact

This Privacy Policy, version 1.0, takes effect on July 1, 2026 and applies together with relevant service terms, collection notices and separate agreements.