PAYMENT INFORMATION PRIVACY AND SECURITY POLICY
Last updated: 16 October 2026
1. Purpose and Scope
Vexere Trading and Services Company Limited (“Vexere”) provides payment methods to facilitate your transactions on the website, mobile application and other platforms operated by Vexere (the “Platform”).
This Policy sets out the principles applied by Vexere to protect information relating to your payment activities when you use the Platform, including the receipt, transmission, processing, storage and sharing of payment information to the extent necessary to perform transactions.
Depending on the payment method, a transaction may be processed directly by Vexere and/or through banks, payment service providers, intermediary payment service providers, card schemes, e-wallets, payment technology providers, collection service providers or other relevant organizations (collectively, “Payment Partners”).
The processing of payment-related Personal Data shall also be carried out in accordance with Vexere’s Personal Data Protection Policy and other applicable laws and regulations.
For products and services provided by agents or third parties, this Policy applies only to payment information where you make payment directly on Vexere’s Platform or are redirected to a payment page or payment gateway forming part of Vexere’s Platform to complete payment for your order.
This Policy is published on the Platform, including under the “Privacy and Data” section, so that you may access and review it at any time. At the payment step, you will be asked to confirm that you have read and agree to this Policy before proceeding with the transaction. For users logged in to an account, such confirmation is recorded once and applies to subsequent payments, unless this Policy is updated and requires your re-confirmation in accordance with Section 11. For users not logged in to an account, confirmation is required for each payment.
2. Payment Methods
Depending on the Service, order, device and time, Vexere may offer one or more of the following payment methods:
–Apple Pay;
–Bank transfer QR codes/payment QR codes and payment methods made via banking applications or e-wallets;
–International payment cards, including Visa, Mastercard, JCB and other supported cards;
–Domestic ATM cards/Internet Banking;
–E-wallets or payment services such as MoMo, ZaloPay, ShopeePay, Viettel Money, VNPAY and other Payment Partners integrated into the Platform;
–Payment at supported convenience stores, supermarkets or collection points;
–Payment upon boarding or direct payment to the Service Provider;
–Other payment methods added by Vexere and displayed at the payment step.
The payment methods actually available for each transaction are displayed for your selection before you confirm payment for the Services on the Platform.
3. Payment-Related Information Processed
Depending on the payment method and the method of integration with the relevant Payment Partner, Vexere may process the information necessary to perform and manage transactions, including:
- –Order ID;
- –Transaction ID or payment reference number;
- –Payment amount and currency;
- –Selected payment method;
- –Name of the bank, e-wallet or Payment Partner;
- –Transaction status, time and result;
- –Bank account details provided by you where a refund is required;
- –Card information masked in accordance with the Payment Partners’ default masking format (such as card type and the last four digits of the card) and the token provided by the Payment Partner where you choose to save an international payment card. Vexere does not receive or store the full card number, expiry date or card security code;
- –Other information necessary for processing, confirmation, reconciliation, refunds, fraud prevention, customer support or the resolution of complaints relating to transactions, as provided to Vexere by the Payment Partner or by you.
Bank account details received (if any), bank card information masked in accordance with the Payment Partners’ default masking format, and financial transaction history are categories of data that may be classified as sensitive personal data under applicable laws. In respect of such information, Vexere applies appropriate protective measures in accordance with Vexere’s Personal Data Protection Policy and applicable personal data protection laws.
4. Information Processing by Payment Method
4.1. Card Payments
For payments by international card, domestic card or other card-related payment methods, the entry, authentication and processing of payment information may be performed on the Payment Partner’s systems or through technical components provided by the Payment Partner.
For international payment cards, the card information you enter at the payment step (including card number, cardholder name, expiry date and security code) is transmitted to the Payment Partner for transaction processing. Vexere does not directly receive or store such card information. The Payment Partner processes and stores card data in accordance with the Payment Card Industry Data Security Standard (PCI DSS).
Where you choose to save your card for future payments, the necessary card information is stored by the Payment Partner. The Payment Partner provides Vexere with a token representing the saved card and masked card information (including card type and the last four digits of the card) for display to you in future payments. Vexere stores such token and masked card information only where you agree to enable the “save card for next payment” feature, and only until you disable the storage of card information for future payments on the payment page of the Platform.
Transaction authentication may be performed by the bank, card scheme or Payment Partner via OTP, 3-D Secure, biometrics, banking applications or other authentication methods in accordance with the respective rules and mechanisms of each of Vexere’s Partners.
4.2. E-Wallets, QR Codes and Bank Payments
For e-wallets, QR codes, bank payments or similar methods, you may be redirected to the application, website or payment environment of the bank/Payment Partner to log in and authenticate the transaction.
Vexere may send the Payment Partner necessary information such as the order ID, amount and transaction reference number, and receive information on the payment status or result in order to complete the order, perform reconciliation and refunds, and handle related requests.
Login credentials, passwords, PINs, OTPs or other authentication information of your bank/e-wallet account are entered by you directly in accordance with the authentication mechanism of the relevant bank or Payment Partner.
4.3. Apple Pay
When you select Apple Pay, the transaction is carried out in accordance with the security and authentication mechanisms of Apple Pay, the card issuer, the card scheme and the relevant Payment Partner.
Your card is added to Apple Wallet on your device and encrypted in accordance with Apple Pay’s mechanism. When making a payment, you confirm the transaction directly on your device without entering card information on the Platform or being redirected to the Payment Partner’s page. Under Apple Pay’s mechanism, your actual payment card number is not provided by Apple to the merchant. The information necessary to process the transaction is protected and transmitted in accordance with Apple Pay’s mechanism. Vexere does not receive or store your card information.
Once the transaction has been made, the Payment Partner confirms the transaction and sends Vexere information on the transaction result, including the amount, time of payment, the last four digits of the card (if any) and the corresponding order ID. Vexere processes such information only to the extent necessary to confirm payment, fulfil the order, perform reconciliation and refunds, and resolve any issues arising.
4.4. Payment at Collection Points
Where you choose to pay at a convenience store, supermarket or collection point, Vexere may provide the payment code and necessary transaction information to the collection service provider for the purpose of completing payment for your Services on the Platform.
The collection service provider is responsible for protecting information within the scope of its systems and processing activities in accordance with the law and its agreement with Vexere.
4.5. Payment upon Boarding or Direct Payment
Where you choose to pay directly at the time of using the Service, or to pay directly to the Service Provider at its office or fee collection point, you do not make an electronic payment transaction at the time of booking the Service on the Platform.
Vexere may store information on the selected payment method and payment status to manage orders, support you and perform reconciliation with the Service Provider.
5. Payment Partners and Information Sharing
To perform payment transactions, Vexere may provide payment-related information to, or receive such information from, Payment Partners to the extent necessary for one or more of the following purposes:
- –Initiating and executing transactions;
- –Authenticating and confirming payment results;
- –Reconciling and settling transactions;
- –Processing refunds;
- –Detecting, preventing and handling fraud or unusual transactions;
- –Receiving, verifying and resolving complaints, transaction inquiries or disputes;
- –Performing other obligations as required by law.
The sharing, transfer or processing of Personal Data is carried out within the notified scope and purposes, with your consent where required by law, and on other legal bases permitted by law.
Payment Partners are responsible for the systems, data and processing activities within their control. Vexere is responsible for the systems and data processing activities within its scope of responsibility in accordance with the law.
Where payment activities involve the transfer of Personal Data outside the territory of Vietnam, Vexere shall perform its obligations relating to the cross-border transfer of Personal Data in accordance with applicable laws.
6. Payment Security Measures
Depending on the nature of the data and the payment method, Vexere applies technical measures as required by law to the systems and data processing activities within its scope of responsibility in order to protect payment information, including:
- –Using secure connections and transmission protocols to protect data exchanged between your device, Vexere and Payment Partners;
- –Encrypting, tokenizing, masking or truncating payment information to the appropriate extent;
- –Restricting and assigning access rights to systems, data and transaction information;
- –Logging, controlling and monitoring access activities, transactions or unusual events;
- –Applying controls to prevent unauthorized access, fraud and information security risks;
- –Coordinating with Payment Partners in transaction authentication and incident handling;
- –Using Payment Partners that meet the Payment Card Industry Data Security Standard (PCI DSS) to process and store international payment card data; Vexere does not directly store card data within the scope of this standard;
- –Reviewing and updating security measures in line with the level of risk, technology and legal requirements from time to time.
For transactions processed by banks or payment service/intermediary payment service providers, such entities shall ensure the application of safety and security requirements in accordance with applicable sector-specific laws and the standards specifically applicable to their systems.
However, please note that the transmission or storage of electronic data is not completely secure. Although Vexere applies appropriate measures to prevent and address risks within its scope of responsibility, no electronic data transmission or storage system can guarantee absolute security against all cybersecurity risks. Accordingly, you should be aware that, when you choose to pay for electronic transactions on Vexere’s Platform, there is always a certain level of risk to data transmitted or stored in electronic form.
7. Retention Period of Payment Information
Vexere retains transaction and payment information for as long as necessary to:
- –Provide and manage the Services;
- –Perform reconciliation and refunds and resolve transaction inquiries;
- –Fulfil accounting, tax and other legal obligations;
- –Resolve complaints and disputes;
- –Prevent fraud and protect the lawful rights and interests of Vexere, you and other relevant parties;
- –Serve other purposes permitted by law.
The retention period of payment information is determined according to the type of information, the purpose of processing and the relevant legal requirements, including but not limited to:
(i)Transaction, booking and payment invoice/document information: retained for the period prescribed by law for the purposes of transaction processing, reconciliation, accounting, fulfilment of tax obligations and resolution of complaints and disputes (if any);
(ii)Information for refunds, transaction inquiries or handling of payment incidents: retained for the period necessary to complete the request and resolve related matters. Thereafter, the portion of payment information constituting accounting documents and transaction records, following the resolution agreed between you and Vexere, shall continue to be retained for the period applicable to transaction information under item (i) of this Section.
(iii)Tokens for the saved payment method feature: Vexere only stores the encrypted token provided by the Payment Gateway Partner together with masked card information (such as card type and the last four digits of the card) for display to you, and does not directly store the Customer’s card information. Tokens are retained for the period necessary to provide the relevant feature or until there is no longer a necessary basis for continued retention under the agreement with, and the payment security policies of, the Payment Gateway Partner.
The retention, deletion, destruction or anonymization of Personal Data relating to the above-mentioned payment information shall be carried out in accordance with Section 6 “Personal Data Retention and Processing Period” of Vexere’s Personal Data Protection Policy and relevant laws.
8. Your Responsibilities
To ensure payment security, you shall:
- –Carefully check the order details, amount and payment method before confirming;
- –Keep your device, account, password, PIN, OTP and other authentication information secure;
- –Not disclose your OTP, bank password, PIN or account authentication information to any other person;
- –Make payments only through the Vexere Platform or the official payment channels displayed or instructed by Vexere in this Policy and on the payment page of our Platform;
- –Not make payments in response to requests to transfer money to any account, link or QR code that has not been verified on the Platform or through Vexere’s official customer support channels set out in Section 12 of this Policy;
- –Notify Vexere and the relevant bank/Payment Partner immediately upon detecting any unusual transaction or suspecting unauthorized access to your payment information.
- –Promptly update your registered phone number upon any change; upon ceasing to use, changing or losing the phone number/SIM used for login, or losing or transferring a logged-in device, log out, remove saved payment methods and/or request Vexere’s assistance in deleting/locking your Platform account through Vexere’s official contact channels set out in Section 12 of this Policy, in order to ensure information security and prevent unauthorized access;
- –Proactively review the payment methods saved in your account when you no longer need them to be saved or no longer have control over the device or login phone number;
- –Where your card is lost, its information is compromised or it is suspected of being used without authorization, immediately notify the bank or card issuer to block or cancel the card, and notify Vexere for coordinated handling (if applicable) where you have enabled the feature to save card information for the next payment;
- –Not allow others to use your account or any device logged in to your Vexere account without your control and consent.
Vexere does not ask you to provide your bank account password, PIN or OTP via phone calls, emails, messages or any Vexere customer support channel.
To keep your account and transactions secure, Vexere encourages you to proactively check, control and safeguard your login credentials, devices and saved payment methods, including but not limited to: updating your phone number when it changes or is no longer in use, removing payment methods you no longer use, and not allowing others to use your account or logged-in devices. If you detect or suspect any unusual access, please notify Vexere immediately via the official support channel on this Platform/our multimedia communication channels or using the contact details set out in Section 12 of this Policy so that we can promptly assist you in verifying, handling and preventing such access.
Where any loss or damage arises from a third party accessing or using your account, device or payment method, Vexere shall not be liable to compensate for losses that fall within your responsibility and arise from your fault. Fault and the extent of each party’s liability shall be determined on the basis of the results of Vexere’s verification and cross-checking and applicable laws.
9. Incident Handling, Transaction Inquiries and Payment Complaints
Upon detecting or being notified of an incident that may affect the security of payment information within its scope of responsibility, Vexere will implement the necessary measures to verify, contain, remediate and mitigate its impact. At the same time, Vexere will notify/report to and coordinate with Payment Partners and competent state authorities, or act as required by law, to contain and remediate the incident, and will send you a notification to the appropriate extent in accordance with applicable laws.
If you have any transaction inquiry, complaint or feedback relating to a payment transaction, Vexere may request the order ID, transaction ID, payment receipts and other necessary information for verification and coordinated resolution with you.
The processing time and outcome may depend on the nature of the transaction, the payment method, the Payment Partner’s rules and applicable laws. During the process, Vexere will send information to you via the official support channel on the Platform and/or multimedia communication channels and/or using the contact details set out in Section 12 of this Policy. Accordingly, we will inform you of the specific response time, update you on the progress and send you the final outcome.
10. Your Rights in respect of Payment-Related Personal Data
You have the right to be informed, to access, to request rectification, erasure and restriction of processing, to withdraw consent and to exercise other rights in respect of your Personal Data in accordance with the law.
The exercise of these rights, the circumstances in which Vexere is permitted or required to continue retaining data, and the procedure for submitting requests are set out in detail in Vexere’s Personal Data Protection Policy.
11. Policy Updates
Vexere may amend or supplement this Policy to reflect changes in laws, payment methods, technical systems, Payment Partners or business operations.
The updated version will be published on the Platform with the update date recorded. Where the law requires notice to be given or consent to be obtained for any change relating to the processing of Personal Data, Vexere will comply with applicable laws. Accordingly, any notice and collection of additional consent (if any) will be implemented by Vexere through dedicated mechanisms on the Platform.
12. Contact Vexere
For any requests, feedback or complaints relating to this Payment Information Privacy and Security Policy, you may contact:
- –Office address: Vexere – 2nd Floor, CirCO Hoang Dieu, H3 Building, Khanh Hoi Ward, Ho Chi Minh City, Vietnam.
- –Hotline: 1900 969681.
- –Email: [email protected].