PERSONAL DATA PROTECTION POLICY FOR CUSTOMERS

(Applicable to registration for and use of services via the McDonald's Website and/or Mobile Application)

Thank you for giving McDonald's the opportunity to provide products and services to the Customers. In the course of our operations, we attach great importance to compliance with the laws on personal data protection and to respecting the confidential information of individuals who access the platforms of McDonald's Vietnam. Accordingly, McDonald's Vietnam has developed, and hereby gives notice of, this Personal Data Protection Policy (this “Policy”) to all personal data subjects who are customers of McDonald's Vietnam (the “Data Subjects”).

Through this Policy, McDonald's Vietnam notifies Customers of: the types of personal data processed and the purposes of personal data processing; the personal data controller or the personal data controller-cum-processor; the rights and obligations of personal data subjects; the manner in which the Company collects personal data; the time of commencement and the time of termination of personal data processing; and the mechanism for responding to Customers' complaints, in accordance with the laws of Vietnam on personal data protection.

ARTICLE 1. GENERAL PROVISIONS

By registering to use or using the products and services of McDonald's Vietnam, entering into agreements, and/or permitting McDonald's Vietnam to use the Customer's personal information and process the Customer's personal data, the Customer accepts all of the provisions set out in this Personal Data Protection Policy.

All terms used in this Policy shall be construed and interpreted consistently in accordance with the Law on Personal Data Protection No. 91/2025/QH15 dated 26 June 2025 (hereinafter referred to as the “Law on Personal Data Protection”) and the instruments guiding, amending, supplementing or replacing such Law from time to time.

McDonald's Vietnam shall collect and process Customers' personal data only in accordance with applicable law, this Personal Data Protection Policy, and/or any contract or other agreement between the Customer and McDonald's Vietnam.

Note: The collection and processing of the Customer's personal data is a necessary and sufficient condition for McDonald's Vietnam to be able to provide products and services to the Customer.

This Policy applies to data that we collect through:

1. our Website;
2. e-mails, text messages and other electronic communications between the Customer and us, including between the Customer and our Website, between the Customer and the Mobile Application, and between the Customer and our social media pages;
3. the Mobile Application that the Customer downloads from the App Store or Google Play;
4. the Customer’s registration for online promotions or participation in prize programs, online programs, surveys, or other transactions or activities;
5. the Customer's use of or access to any other online service or program that posts, or contains a link to, McDonald's Terms and Conditions or Personal Data Protection Policy;
6. the Customer's entry into any of our premises, or otherwise in connection with our business organization, or attendance at an event organized or hosted by us;
7. any purchase, sale or other transaction effected through us or through a third-party delivery service; and
8. the Customer's visits to McDonald's restaurants, use of the McDonald's Delivery Hotline, or placement of orders via the fixed telephone line of a McDonald's restaurant.

ARTICLE 2. TYPES OF PERSONAL DATA PROCESSED

In order for McDonald's Vietnam to fulfill the Customer's requests (including, without limitation, requests for the provision of products and services, and the handling of complaints relating to orders and service quality as well as inquiries and claims from Customers) and/or to provide general information on the products and utilities of McDonald's Vietnam, McDonald's Vietnam and any personal data processor with whom McDonald's Vietnam has entered into an agreement will need to use the Customer's personal data (including, without limitation, the following activities: collecting, recording, analyzing, confirming, storing, rectifying, combining, accessing, retrieving, recalling, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting or destroying personal data, or other related actions).

McDonald's Vietnam collects and processes the Customer's personal data, including:

2.1. Basic personal data:

• Surname, middle name and given name as recorded at birth, and any other names (if any).
• Date of birth.
• Email address.
• Contact address.
• Telephone number.
• Financial information provided for payment purposes when making purchases from McDonald's Vietnam, including through our website or Mobile Application, such as the Customer's bank account number, debit and/or credit card numbers, and digital wallets.
• Records of commercial information, such as the Customer's current or past information regarding point-of-sale transactions and purchases of products from us.
• Information on connection to, use of and activity on electronic networks relating to the Customer and any person authorized by the Customer to use our Website or Mobile Application, including the content viewed by the Customer, device type, operating system, application version, browser type, unique device identifiers and/or Internet Protocol (IP) address, and information about the Customer's interactions with our Website or Mobile Application.
• Internet or other electronic network activity information, including but not limited to IP address, browsing history, search history, cookies, web beacons, tags, scripts, HTML5, advertising identifiers and similar technologies, information about the Customer's interactions with the website or mobile application, and geolocation data.
• Location information, including geolocation information provided through the server logs of our Website and Mobile Application and through the operation of Google Analytics on our Website by means of your device's interaction with our Website, or information associated with your device, such as: hardware specifications, serial number, Internet Protocol (IP) address, file names, applications, GPS location, IMEI number and version, and advertising identifiers, or any information that may indicate changes to the device or its applications, to the extent that the law permits us to process such information.
• Sensory data obtained from monitoring via general business security surveillance cameras at our premises and business establishments and on our properties, in order to ensure the security and safety of our employees, customers, business organization, assets, resources and communities.
• Any personal data related to the personal data referred to above.

When the Customer uses the online ordering system, the Customer will be required to provide certain additional requested information. Such information facilitates the faster and easier delivery of products to the Customer's address. The online ordering system will also store information on the Customer's orders, enabling the Customer to recall and re-order menu items for subsequent purchases.

2.2. Sensitive personal data:

The Company collects, and applies managerial and technical measures at a level equivalent to that applicable to sensitive personal data in respect of, the following types of personal data:

• Information on connection to, use of and activity on electronic networks relating to the Customer and any person authorized by the Customer to use our Website or Mobile Application, including the content viewed by the Customer, browser type and device, unique device identifiers and/or Internet Protocol (IP) address, and information about the Customer's interactions with the Website or the Mobile Application.
• Internet or other electronic network activity information, including but not limited to IP address, browsing history, search history, cookies, web beacons, tags, scripts, HTML5, advertising identifiers and similar technologies, information about the Customer's interactions with the website or mobile application, and geolocation data.
• Location information, including geolocation information provided through the server logs of our Website and Mobile Application and through the operation of Google Analytics on our Website by means of your device's interaction with our Website, or information associated with your device, such as: hardware specifications, serial number, Internet Protocol (IP) address, file names, applications, GPS location, IMEI number and version, and advertising identifiers, or any information that may indicate changes to the device or its applications, to the extent that the law permits us to process such information.

ARTICLE 3. METHODS OF DATA COLLECTION

3.1. Directly from the Customer: We collect information that the Customer provides to us when the Customer inquires about our goods or services; registers with us; places orders; participates in prize programs, online programs, surveys, or other transactions or activities; through the billing and contact information that the Customer provides to us; when the Customer contacts or interacts with us by telephone, e-mail or other electronic means of communication; and through the use of our Website, Mobile Application or social media pages, or through the Customer’s presence in person.

3.2. Indirectly from the Customer: We collect information from the Customer, or from devices associated with the Customer, through the Customer’s use of and actions on the Website and Mobile Application, through persistent cookies on our Website and Mobile Application, through third-party analytics of our Website and Mobile Application, and from publicly available sources of information.

ARTICLE 4. PURPOSES OF PERSONAL DATA PROCESSING

The personal data referred to in Article 2 above may be processed for the following purposes:

4.1. Provision of products, goods and services to Customers:

• Authenticating and storing the Customer's personal data in order to provide products, goods and services in accordance with law;
• Confirming orders or confirming the status of Customer registrations;
• Providing services under the relevant agreement, or fulfilling other requests of the Customer arising in the course of the Customer's use of McDonald's Vietnam's services;
• Serving the purposes of administering, contacting and notifying the Customer in connection with the provision of products, goods and services to the Customer;
• Giving effect to the Customer's rights and obligations relating to personal data in accordance with law and the agreements between the Customer and McDonald's Vietnam;
• Reporting to McDonald's Corporation and to McDonald's franchisees, subsidiaries and affiliates (if any) for the purpose of carrying out commercial franchise activities in accordance with law;
• Performing operations to ensure the security of the Customer's personal data and the security of McDonald's Vietnam's information systems in service of the provision of services to Customers, such as backup, redundancy, monitoring, resource optimization and protection of Customers' personal data;
• Processing the Customer's requests, purchases, payment transactions and other requests, and/or preventing fraudulent transactions.

4.2. Performance of the Company's obligations under law:

• Serving the safeguarding of national defense, national security, and social order and safety in accordance with law and at the request of competent state authorities;
• Using the Customer's information (including sharing, disclosing, providing and transferring such information to third parties) in order to perform McDonald's Vietnam's obligations under law and at the request of state authorities, such as requirements relating to inspection; examination; audit; statistics; reporting; finance, accounting and taxation; risk management, anti-money laundering, counter-terrorism financing and sanctions compliance; the sending of notification, communication, advocacy and support messages in connection with the National Humanitarian Portal and at the request of state authorities; and other related obligations;
• Performing other obligations as prescribed by law.

4.3. Improvement of the quality of the services provided by McDonald's Vietnam to Customers:

• Researching customer needs, and carrying out analysis, statistics and other internal management activities, in order to improve the quality of the services provided by McDonald's Vietnam to Customers;
• Personalizing the Customer's experience on the Website and the mobile application, and providing content and products suited to the Customer's needs and preferences;
• Analyzing the market in order to develop better products and services in the future.

4.4. Provision of loyalty programs for the accumulation of points at McDonald's and the receipt of service incentives:

• Introducing and offering to customers fast-food meal options and the latest promotional programs, or information on products and services that McDonald's Vietnam considers beneficial to customers;
• Implementing customer appreciation programs.

4.5. Conduct of communications and advertising activities in respect of related services.

ARTICLE 5. PROCESSING OF DATA OF CUSTOMERS UNDER 16 YEARS OF AGE

In the course of providing products, goods and services, McDonald's Vietnam may have Customers who are individuals aged from full 7 (seven) years to under 16 (sixteen) years of age (“Child Customers”). In such cases, McDonald's Vietnam will carry out the necessary procedures to verify the age of the Child Customer before processing his or her personal data.

Where a Child Customer purchases, registers to use, or uses products, goods or services, the contents of the table set out in Appendix 01 to this Document shall be ticked in confirmation by the Child Customer. The father, mother or guardian of the Child Customer shall tick in confirmation to indicate his or her consent to the processing of the Child Customer's personal data in accordance with the contents of Appendix 02 to this Document, unless otherwise provided by law.

ARTICLE 6. ORGANIZATIONS AND INDIVIDUALS PARTICIPATING IN PERSONAL DATA PROCESSING

Depending on the time or the circumstances, the Company acts as the personal data controller, or as the personal data controller-cum-processor, in respect of the Customer's personal data.

In order to achieve the purposes stated in this Policy, McDonald's Vietnam may share the Customer's personal data with the following organizations and individuals:

• Individuals, departments, organizations and/or suppliers affiliated with McDonald's Vietnam, for the purpose of performing services and/or supporting the process of supplying services to Customers, in accordance with the functions and scope of operation of the relevant department/division or under the cooperation agreements/contracts between the parties;
• McDonald's Corporation, and McDonald's franchisees, subsidiaries and branches (if any);
• Providers of ancillary and/or other related services, such as delivery service providers and payment processors, for the purpose of completing the Customer's orders and/or handling complaints and issues arising out of or in connection with purchases;
• Competent state authorities, in accordance with law.

ARTICLE 7. TIME OF COMMENCEMENT AND TIME OF TERMINATION OF PERSONAL DATA PROCESSING

Time of commencement of personal data processing: from the time the Customer consents to this Personal Data Protection Policy.

Time of termination of personal data processing: the time at which the Customer requests McDonald's Vietnam to cease processing his or her personal data, or the time at which McDonald's Vietnam no longer has any obligation to provide products or services to the Customer, or such other time as prescribed by law.

ARTICLE 8. RIGHTS AND OBLIGATIONS OF CUSTOMERS

Rights of the Customer

8.1. To be informed of personal data processing activities;

8.2. To give or withhold consent, and to request the withdrawal of consent, to the processing of personal data;

8.3. To access, rectify, or request the rectification of, personal data;

8.4. To request the provision, deletion or restriction of the processing of personal data, and to submit requests objecting to the processing of personal data;

8.5. To lodge complaints and denunciations, to initiate legal proceedings, and to claim compensation for damage, in accordance with law;

8.6. To request competent authorities, or agencies, organizations and individuals involved in the processing of personal data, to implement measures and solutions to protect his or her personal data in accordance with law.

Obligations of the Customer

8.7. To protect his or her own personal data;

8.8. To respect and protect the personal data of others;

8.9. To provide his or her personal data fully and accurately, as required by law, under contract, or upon consenting to the processing of his or her personal data;

8.10. To comply with the law on personal data protection and to participate in the prevention of, and the fight against, acts of infringement of personal data;

8.11. To comply with the provisions of law, this Personal Data Protection Policy, and the regulations and guidelines of McDonald's Vietnam relating to the processing of the Customer's personal data;

8.12. To cooperate with McDonald's Vietnam, competent state authorities or third parties in the event of any issue affecting the Customer's personal data;

8.13. To bear sole responsibility for the information, data and consents that he or she creates or provides in the online environment, and to bear sole responsibility in the event that his or her personal data is leaked or infringed as a result of his or her own fault;

8.14. To perform other obligations as prescribed by law.

ARTICLE 9. COOKIES

We may use cookies on our website for the purpose of providing better services to Customers.

A cookie is a mechanism that allows a website provider to temporarily record and store data on your computer through the web browser. The cookies that we use do not contain any personally identifiable information of the Customer.

For detailed instructions on cookie settings, Customers are kindly requested to refer to the “Cookies” section under the “Help” menu of their browser.

The Customer may refuse the use of cookies by selecting the appropriate settings on his or her browser or device. However, please note that if the Customer does so, the Customer may be unable to use the full functionality of McDonald's Vietnam's Platform or Services.

ARTICLE 10. STORAGE OF PERSONAL DATA

The Customer's personal data is stored on servers within the Company's systems, or in such other forms as may be required by relevant law from time to time.

McDonald's Vietnam will take reasonable steps to ensure that the Customer's personal data is stored securely and in accordance with this Personal Data Protection Policy, even where the Customer's personal data is processed at, transferred to and/or retained in other locations, whether within or outside the territory of Vietnam.

ARTICLE 11. LINKS TO OTHER WEBSITES

McDonald's Vietnam may provide links to websites that are not operated by McDonald's Vietnam. When accessing such linked websites, the Customer should take the initiative to carefully review the privacy, security and other policies applicable on those websites. We accept no responsibility for the policies and practices of other companies, and any information that the Customer provides to such parties will be governed by their respective privacy policies.

ARTICLE 12. AMENDMENT AND SUPPLEMENTATION OF THE PERSONAL DATA PROTECTION POLICY

This Personal Data Protection Policy may be amended, updated or adjusted from time to time, and any such changes will be notified directly to Customers through McDonald's Vietnam's information channels and other means prior to their application, in accordance with law. McDonald's Vietnam recommends that Customers regularly review the Personal Data Protection Policy on the official website of McDonald's Vietnam in order to keep up to date with any changes and to remain informed by McDonald's Vietnam of how the Customer's personal data is protected. The Customer's continued use of the products and services of McDonald's Vietnam shall be deemed to constitute the Customer's acceptance of the updated Personal Data Protection Policy.

ARTICLE 13. FEEDBACK AND COMPLAINT MECHANISM

In the event of any inquiry, comment, request, feedback or complaint, the personal data subject may contact McDonald's Vietnam through the following mechanisms:

1. contacting the head office in person, or sending correspondence by courier, to the address: 2-6bis Dien Bien Phu, Tan Dinh Ward, Ho Chi Minh City;
2. sending an e-mail to the Company's Personal Data Protection Department at: data.protection.officer@vn.mcd.com;
3. calling the telephone number of the Company's Personal Data Protection Department: 1900 9001;
4. upon receipt of the Customer's inquiry, comment, request, feedback or complaint, the Company's Personal Data Protection Department will assign personnel to make contact and resolve the relevant matters, so as to safeguard the rights and interests of the personal data subject in accordance with law.

This Personal Data Protection Policy for Customers was last updated on: 31 July 2026.

APPENDIX 1

CONFIRMATION OF CONSENT TO THE PURPOSES OF PERSONAL DATA PROCESSING

(Applicable to Customers registering to use services via the Website)

I hereby confirm that I have read and fully understood the contents of, and matters relating to, the personal data protection provisions set out in the Personal Data Protection Policy published on the website of McDonald's Vietnam, and that I fully understand the contents concerning the feedback and complaint mechanism in the event of an incident. I acknowledge that my personal data is processed by McDonald's Vietnam for the purposes of providing products, goods and services to Customers and performing the Company's obligations under law.

By ticking the consent boxes in the table below, I confirm my consent to the processing of my personal data by the Company for the following purposes:

APPENDIX 2

CONFIRMATION OF CONSENT OF THE FATHER, MOTHER OR GUARDIAN

(With respect to the purposes of processing the personal data of Child Customers)

I am the father, mother or lawful guardian of the Child Customer. I hereby confirm that I have read and fully understood the contents of, and matters relating to, the personal data protection provisions set out in the Personal Data Protection Policy published on the website of McDonald's Vietnam, and that I fully understand the contents concerning the feedback and complaint mechanism in the event of an incident. I acknowledge that the personal data is processed by McDonald's Vietnam for the purposes of providing products, goods and services to Customers and performing the Company's obligations under law.

By ticking the consent boxes in the table below, I confirm my consent to the processing of the personal data by the Company for the following purposes: