Data Deletion Policy

1. Your Right to Erasure

GTEMAS ("we," "us," or "our") is committed to honoring your right to have your personal data deleted. Under applicable data protection laws — including the EU General Data Protection Regulation (GDPR Art. 17), the California Consumer Privacy Act (CCPA §1798.105), and Vietnam's Personal Data Protection Decree (Decree 13/2023/NĐ-CP) — you have the right to request the erasure of your personal data where there is no compelling reason for us to continue processing it.

2. When You Can Request Deletion

You may submit a data deletion request in the following circumstances:

• Your personal data is no longer necessary for the purpose for which it was originally collected or processed.
• You withdraw consent on which the processing is based, and there is no other legal ground for the processing.
• You object to the processing of your data and there are no overriding legitimate grounds for the processing.
• Your personal data has been unlawfully processed.
• Your personal data must be erased for compliance with a legal obligation.

3. Data We May Hold About You

Depending on how you have interacted with us, we may hold the following categories of personal data:

• Contact enquiry data: name, email address, company name, and message content submitted via our contact form.
• Technical data: IP address, browser type, and session data collected via cookies or analytics tools.
• Recruitment data: CV, cover letter, and employment history provided during a job application.
• Communication records: email correspondence and follow-up history related to a business enquiry.

4. How to Submit a Deletion Request

To request the deletion of your personal data, please email us at privacy@gtemas.com with the subject line "Data Deletion Request" and include:

• Your full name.
• The email address or other identifier you used when interacting with us.
• A brief description of the data you wish to have deleted and the context in which it was provided (e.g., contact form submission, job application).

We may need to verify your identity before processing your request to prevent unauthorised deletion of another person's data. Verification will be limited to information already held by us.

5. Our Response Timeline

We will acknowledge your request within 5 business days and complete the deletion (or provide a reasoned response if unable to comply) within 30 calendar days of receiving a verified request. If your request is complex or you have made multiple requests, we may extend this period by a further 60 days and will inform you of any extension within the initial 30 days.

6. Exceptions — When We Cannot Delete

There are situations where we are unable to fulfil a deletion request, including where the data is necessary:

• To comply with a legal obligation (e.g., tax records, anti-money laundering requirements).
• For the establishment, exercise, or defence of legal claims.
• For reasons of public interest in the area of public health or scientific and historical research.
• To protect the vital interests of you or another natural person.

Where we cannot fulfil your deletion request, we will explain the reason and inform you of your right to lodge a complaint with the relevant supervisory authority.

7. Third-Party Data Processors

Where your data has been shared with third-party processors acting on our behalf (e.g., cloud infrastructure providers, email delivery services), we will notify those processors of your deletion request and take reasonable steps to ensure your data is erased across all systems where technically feasible. We cannot, however, be responsible for data held by third parties acting as independent data controllers.

8. Anonymisation as an Alternative

In some cases, rather than deleting data outright, we may anonymise it in a way that permanently removes all identifying information. Anonymised data can no longer be linked to you and therefore falls outside the scope of personal data protection law. If anonymisation is used as an alternative to deletion, we will inform you.

9. Contact & Complaints

If you have questions about this policy or your data deletion rights, please contact our Data Privacy team at privacy@gtemas.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority in your jurisdiction:

• EU / EEA: Your national Data Protection Authority (DPA).
• UK: Information Commissioner's Office (ICO) — ico.org.uk.
• Vietnam: Ministry of Public Security — Department of Cybersecurity and Hi-tech Crime Prevention (A05).
• California (CCPA):California Attorney General's Office.