Comprehensive Enterprise Data Privacy Policy

Article 1: Introduction, Scope & Institutional Commitment to Data Privacy

EYC TECHNOLOGY AND ARTIFICIAL INTELLIGENCE COMPANY LIMITED ("EYC", "we", "us", or "our") is an advanced engineering enterprise operating in research and development of artificial intelligence (AI), multi-agent systems, enterprise platforms, cloud infrastructure, and connected technology. We recognize that data represents a core corporate asset and that privacy is an inalienable fundamental right of every individual and organization.

This Comprehensive Enterprise Data Privacy Policy ("Policy") establishes binding standards governing all collection, recording, classification, structuring, storage, adaptation, retrieval, consultation, usage, disclosure, transfer, erasure, and destruction of personal data and operational business information arising from: (i) Browsing, searching, and interacting across the web portal eyc.asia; (ii) Commercial correspondence, architectural proposals, and project briefs transmitted through official channels; and (iii) Provisioning, integrating APIs, deploying software platforms, and utilizing cloud infrastructure engineered by EYC.

EYC aims for clear, honest disclosure and does not trade privacy or data security for commercial growth. Our operations follow applicable Vietnamese law and use recognized international data protection frameworks as reference points.

• Relationship with Commercial Contracts: Where an enterprise client executes a separate Master Services Agreement (MSA), Data Processing Addendum (DPA), or Service Level Agreement (SLA) with EYC, specific contractual provisions and technical commitments in those executed instruments take precedence, provided they do not diminish the baseline standards established in this Policy.
• Scope of Application: This Policy applies to all individuals accessing our web properties, legal representatives or authorized personnel of corporate clients, technology partners, prospective candidates, and end users interacting with digital touchpoints operated by EYC.

Article 2: Global Regulatory Framework & Information Security Compliance

This Policy is anchored upon robust statutory foundations, harmonizing domestic legal mandates with global enterprise privacy benchmarks:

• Global Privacy & Cross-Border Frameworks: Rigorously benchmarked against and conforming to the highest international data protection standards, including the EU General Data Protection Regulation (Regulation EU 2016/679), UK GDPR, Swiss Federal Act on Data Protection (FADP), and APEC Cross-Border Privacy Rules (CBPR) system.
• European Union & United Kingdom Regulations: Fully compatible with the European Union General Data Protection Regulation (EU GDPR 2016/679) and UK GDPR concerning data flows associated with data subjects residing within these jurisdictions.
• United States Privacy Statutes: Enforcing transparency, consumer choice, and non-discrimination mandates pursuant to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
• Internal Security Processes: EYC operates internal processes for information security, risk management, role-based access control, audit logging, backup, and incident response. EYC does not hold, and does not claim, any third-party security or privacy certification.

Article 3: Legal Definitions & Interpretation Framework

To ensure clarity, transparency, and legal certainty, capitalized and specialized terms utilized throughout this Policy are defined in accordance with leading international data privacy standards and industry frameworks as follows:

• Personal Data: Information in the form of symbols, letters, digits, images, sounds, or similar electronic representations that is associated with or facilitates the identification of a specific natural person.
• Basic Personal Data: Encompasses full name, date of birth, gender, contact address, email address, telephone number, corporate title, employer, geolocation metadata, and digital telemetry that does not constitute sensitive personal information.
• Sensitive Personal Data: Personal data intimately linked to individual privacy which, if compromised, directly infringes upon legal rights, including political viewpoints, religious beliefs, health status, banking or financial credentials, biometrics, and precise real-time geolocation.
• Data Subject: An identified or identifiable natural person to whom personal data relates, including website visitors, corporate procurement officers, vendor contacts, and platform operators.
• Data Controller: An entity or individual that determines the purposes and essential means of personal data processing.
• Data Processor: An entity or individual that processes personal data on behalf of a Data Controller pursuant to a binding written contract.
• Joint Controller: Entities that jointly determine the purposes and means of processing.
• Enterprise Customer Content: All proprietary text, documents, databases, codebase assets, digital media, and operational data uploaded or directed into EYC cloud platforms and AI systems by corporate clients for execution.
• AI Models & Multi-Agent Systems: Machine learning algorithms, large language models (LLMs), and autonomous agent coordination workflows engineered or deployed by EYC.
• Model Context Protocol (MCP): An open security protocol standardizing secure context exchange, scoped permissions, and data governance between AI models and enterprise tools.
• TenantScope: Logical and cryptographic isolation architecture ensuring that enterprise data belonging to one organization is segregated, partitioned, and strictly inaccessible to any other organization.

Article 4: Legal Capacity & Role Designation (Controller vs. Processor)

Depending on the technical and commercial context of our engagements, EYC's legal capacity is defined to delineate operational and statutory obligations:

• EYC as a Data Controller: Applies to personal data of visitors to eyc.asia; business development inquiries and architectural briefs voluntarily submitted by prospective clients; corporate representative records of vendor partners; and internal administrative account credentials.
• EYC as a Data Processor: Applies where enterprise clients utilize EYC SaaS platforms, multi-agent pipelines, or cloud infrastructure to process their own organizational or customer data. In this capacity, the enterprise client acts as the Data Controller, determining the purpose and legal basis; EYC processes data strictly pursuant to documented instructions and formal Data Processing Addenda (DPAs).
• Joint Controllership: Where enterprise integration engagements involve joint determination of processing means and objectives, the respective allocation of responsibilities is established explicitly in a binding Data Processing Addendum (DPA) pursuant to GDPR Article 26 and international data protection standards.

Article 5: Core Data Protection Principles & Accountability Framework

All data processing activities across EYC strictly adhere to seven institutional privacy tenets and a comprehensive accountability framework:

• 1. Lawfulness, Fairness, and Transparency: Data is processed solely under verifiable legal bases and communicated openly to data subjects prior to intake.
• 2. Purpose Limitation: Data is collected exclusively for explicit, legitimate, and specified technical and business purposes, with zero unapproved secondary usage.
• 3. Data Minimization: Intake is restricted strictly to parameters necessary to perform contracted technical services or fulfill legal obligations.
• 4. Accuracy and Recency: Data subjects are provided with verifiable mechanisms to inspect, rectify, and update personal records.
• 5. Storage Limitation: Records are maintained only for the timeframe necessary to achieve designated business purposes or fulfill statutory requirements, followed by cryptographically verified erasure.
• 6. Integrity and Confidentiality: Advanced technical and organizational controls are enforced against unauthorized exposure, alteration, or exfiltration, backed by continuous audit readiness.
• 7. Accountability: Maintaining auditable compliance records, DPIAs, and operational logs to verify adherence before regulatory and supervisory authorities.

Article 6: Granular Categories of Data Collected by Source

EYC implements structured data classification across all system ingress points:

• Voluntarily Provided Commercial Data: Full name, executive title, corporate organization, work email address, telephone contact, operating jurisdiction, and project requirement briefs submitted through contact forms or direct commercial correspondence.
• Technical Telemetry & Network Security Logs: Internet Protocol (IP) addresses, browser user-agent strings, client hardware fingerprints, HTTP status codes, request/response timestamps, referring URLs, and Web Application Firewall (WAF) event logs essential for detecting intrusions, mitigating DDoS attacks, and ensuring infrastructure availability.
• Platform Credentials & Immutable Audit Trails: Unique user identifiers (UIDs), cryptographic password hashes, role-based access control (RBAC) privilege sets, multi-factor authentication (MFA) session logs, and immutable system audit logs documenting administrative configurations.
• Enterprise Customer Content: Proprietary operational records, datasets, API payloads, and digital assets directed by clients into EYC systems for AI orchestration. This data remains under exclusive client ownership.
• Sensitive Personal Data Exclusions: EYC does not request, collect, or store personal payment card data (PANs, CVVs), bank account passwords, national identity numbers, biometric records, political affiliations, religious beliefs, medical history, or sexual orientation via public website forms.

Article 7: Data Collection Methods & Tracking Technologies

Data ingress into EYC systems occurs exclusively via secure, cryptographically enforced channels:

• Encrypted Ingestion Forms: All data submitted through corporate intake forms is transmitted using TLS 1.3 encryption and processed at the cloud edge without unencrypted staging buffers.
• Automated Edge Telemetry: Server edge nodes automatically capture anonymized request logs and telemetry for traffic routing, load distribution, and security filtering.
• Enterprise API & Ingestion Pipelines: B2B system connections transfer data through authenticated enterprise endpoints enforcing digital certificates and scoped API keys.
• Transparent Cookie Governance: Our website uses only the storage needed for security, theme selection, and remembering your cookie choice. Analytics runs only if you allow it in the cookie settings. We do not deploy third-party cross-site behavioral tracking cookies for advertising. Details are in the Cookie Notice.

Article 8: Specific Processing Purposes & Lawful Bases Mapping

EYC processes personal data strictly pursuant to recognized lawful bases under international privacy law, including GDPR Article 6 and comparable global standards, categorized as follows:

• Inquiry Intake & Architectural Consultation: Grounded in the voluntary, explicit Consent of the data subject when submitting inquiries via contact channels.
• Enterprise Contract Performance & SLA Operations: Grounded in Contractual Necessity to provision dedicated tenants, administer cryptographic credentials, deliver cloud resources, and fulfill service level commitments for corporate clients.
• Infrastructure Defense & Cyber Threat Mitigation: Grounded in Legitimate Interests to preserve network integrity, prevent volumetric DDoS attacks, block exploitation attempts, and support the availability targets of contracted services.
• Statutory & Regulatory Compliance: Grounded in Legal Obligations under applicable corporate governance mandates, fiscal reporting rules, electronic transaction laws, and lawful orders issued by competent judicial or regulatory authorities.

Article 9: Enterprise AI Governance, Machine Learning & Model Safety Framework

As an engineering pioneer in enterprise AI and multi-agent coordination, EYC maintains uncompromising boundaries regarding data integrity and model isolation:

• Zero Public Model Training Commitment: Enterprise operational data, prompts, completions, proprietary code, and organizational documentation are not used to train, retrain, fine-tune, or improve any public foundation models, commercial LLMs, or shared model weights of third parties or EYC, unless an explicit written contract for private fine-tuning says otherwise.
• Strict Multi-Tenant Isolation (TenantScope): Every enterprise organization's data resides in logically segregated, cryptographically isolated partitions governed by dedicated per-tenant encryption keys, eliminating cross-tenant leakage risks.
• Context Window Isolation: Real-time inference pipelines execute within ring-fenced ephemeral memory partitions with strictly zero leakage between concurrent execution sessions.
• Data Lineage & Provenance Governance: Complete transparency and traceability regarding the transformation, embedding, and routing of data throughout AI execution chains.

Article 10: Vector Database Security, Embeddings & Prompt Privacy

For advanced enterprise AI systems utilizing Retrieval-Augmented Generation (RAG) and semantic vector databases:

• Semantic Embedding Isolation: Vector representations of customer enterprise data are stored in dedicated namespaces partitioned by tenant with field-level encryption.
• Prompt Injection & Jailbreak Defense: All input payloads undergo automated validation to neutralize prompt injection, prompt leakage, and automated data exfiltration vectors.
• Zero-Retention Inference Scratchpads: Ephemeral document chunks and retrieved contexts are automatically flushed from volatile memory upon response completion.

Article 11: Autonomous Agent Governance & Model Context Protocol (MCP)

EYC implements the Model Context Protocol (MCP) to standardize and rigorously audit all multi-agent tool calls and data interactions:

• Strict JSON Schema Validation: AI agent tool invocations must adhere strictly to verified, immutable JSON schemas, preventing unauthorized parameter injection or data extraction.
• Principle of Least Privilege: Agents operate under scoped, temporary credentials restricted exclusively to the specific entities required for the designated workflow.
• Immutable Agent Audit Trails: Every reasoning step, tool call, query parameter, and payload return is recorded in an immutable audit repository for post-execution verification.

Article 12: Human-in-the-Loop Oversight & Ethical AI Governance

Our governing philosophy is: 'Human-led systems. AI-coordinated work.' We enforce robust multi-tier human oversight:

• Mandatory Human Gateways: Actions proposed by AI agents that involve binding legal obligations, financial commitments, credential modifications, or core architectural deployments mandate verified human sign-off.
• Prohibition of Unsupervised High-Stakes Profiling: EYC strictly prohibits automated decision-making systems that produce legal or similarly significant effects on individuals without meaningful human involvement.
• Explainability and Traceability: Providing auditable reasoning traces for AI-assisted outputs to support algorithmic transparency and regulatory compliance.

Article 13: Subprocessors & Technology Supply Chain Management

EYC uses the following infrastructure providers as a customer. They may process data on EYC's behalf within the scope of the services they provide:

• Cloudflare: Cloudflare Pages for website hosting and delivery, Cloudflare Workers for contact-form processing, R2 for object storage, D1 as a database, plus CDN, SSL/TLS and DDoS protection.
• GreenNode: virtual servers and object storage in data centres in Vietnam, used for EYC systems and for client systems as agreed in the contract.
• Google Cloud and Microsoft Azure: cloud computing infrastructure for systems, AI services and data, used according to each project's requirements.
• GitHub Enterprise: source-code management, version control and automated testing and deployment pipelines.
• Security certifications published by these providers belong to the providers, not to EYC. This list is updated when EYC changes providers.
• Mandatory Subprocessor Commitments: All subprocessors execute binding Data Processing Addenda (DPAs) imposing confidentiality and security obligations equivalent to or exceeding this Policy.
• Disclosures to Public Authorities: Personal data is disclosed to law enforcement or governmental agencies solely upon receipt of formal, lawful subpoenas or judicial orders executed pursuant to due process, with prompt client notice unless legally prohibited.

Article 14: Cross-Border Data Transfers & International Safeguards

Given the distributed architecture of modern edge computing and international API integrations, data transfers across international borders are governed by strict compliance protocols:

• Standard Contractual Clauses (SCCs) & Adequacy Safeguards: For international data transfers across multi-region infrastructure, EYC incorporates European Commission-approved Standard Contractual Clauses (SCCs), UK International Data Transfer Addenda, and executes comprehensive Transfer Impact Assessments (TIAs) to guarantee equivalent protection wherever data is processed.
• Standard Contractual Clauses (SCCs): For data flows concerning residents of the European Economic Area or global jurisdictions, EYC incorporates European Commission-approved Standard Contractual Clauses to guarantee GDPR-level protections.
• Supplemental Technical Controls: Cross-border payload transit requires end-to-end encryption with robust ciphers, ensuring data remains unreadable to intermediate telecommunications carriers.

Article 15: Technical & Organizational Security Measures (TOMs)

EYC deploys multi-layered Defense-in-Depth combined with Zero-Trust architecture to eliminate intrusion vectors and safeguard data:

• Cryptography: Data traversing public networks is encrypted in transit using modern TLS; sensitive persistent data at rest is encrypted using AES-256.
• Role-Based Access Control (RBAC) & Multi-Factor Authentication (MFA): Administrative access is restricted based on Need-to-Know and Least-Privilege principles, requiring mandatory hardware security keys (FIDO2) or authenticator apps for all engineers.
• Environment Segregation & Independent Testing: Development, staging, and production environments are strictly isolated physically and logically. We conduct automated vulnerability scans and independent annual penetration testing.
• Cryptographic Key Management (HSM/KMS): Encryption keys are managed via dedicated Hardware Security Modules and enterprise KMS solutions with zero hardcoded credentials.
• Source Code Verification: Enforcing mandatory cryptographic commit signing and mandatory peer review prior to staging and production deployment.

Article 16: Vulnerability Management, Independent Audits & Penetration Testing

EYC enforces continuous vulnerability management and independent audit verification across all product engineering lifecycles:

• Static Application Security Testing (SAST) & Software Composition Analysis (SCA): Automated vulnerability and dependency scanning integrated into CI/CD build pipelines.
• Dynamic Application Security Testing (DAST): Continuous runtime vulnerability detection across all active endpoints and services.
• Independent Third-Party Penetration Testing: Engaging certified third-party cybersecurity firms annually to conduct rigorous black-box and grey-box penetration tests.
• Responsible Vulnerability Disclosure: Maintaining a dedicated intake channel for security researchers and committing to acknowledgment within 24 business hours.

Article 17: Incident Response Protocol & 72-Hour Breach Notification

EYC maintains an enterprise Security Incident Response Plan operational 24/7 in compliance with international standards:

• Four-Phase Incident Lifecycle: (i) Detection and severity triage; (ii) Containment and threat isolation within 1 hour; (iii) Eradication and verified recovery; and (iv) Post-incident forensic review.
• Statutory 72-Hour Breach Notification: Upon verifying an unauthorized security breach affecting customer personal data, EYC issues formal alerts to relevant supervisory authorities and affected enterprise customers without undue delay and, where feasible, within 72 hours of becoming aware of the incident, pursuant to GDPR Article 33 and international breach management protocols.
• Incident Notification Contents: Detailing incident nature, compromised data categories, potential consequences, implemented countermeasures, and remediation recommendations.

Article 18: Data Retention Matrix & Lifecycle Management

EYC enforces strict storage limitation rules backed by automated retention schedules and cryptographically verified disposal:

• Inquiries & Commercial Correspondence: Preserved throughout active engagement and retained for up to 24 months from the latest interaction, after which records are permanently deleted or anonymized.
• Commercial Contracts & Fiscal Records: Retained for a minimum of 10 years pursuant to statutory accounting and tax administration laws.
• Network Security & Access Logs: Preserved for 12 to 24 months in compliance with cybersecurity regulations.
• Ephemeral AI Session Telemetry: Automatically purged upon session conclusion.
• Decommissioned Customer Accounts: Frozen for a 30-day grace period to facilitate customer export, followed by permanent, irreversible purging.

Article 19: Cryptographic Erasure & Sanitization Standards (NIST SP 800-88)

Upon retention expiration or receipt of a verified deletion request from a data subject:

• Cryptographic Erasure (Crypto-Shredding): Permanently destroying decryption keys corresponding to tenant storage blocks, rendering stored ciphertext mathematically irrecoverable.
• NIST SP 800-88 Rev. 1 Sanitization: Applying multi-pass overwrite and physical destruction protocols for retired physical storage devices.
• Backup Purge Cycles: Backup volumes operate on a 30-day rolling retention cycle, ensuring that deleted records are completely and permanently eradicated from all secondary backups within 30 days.
• Verification Attestation: Providing enterprise clients with written certificates of cryptographic data sanitization upon contract termination.

Article 20: Data Subject Rights & Formal Execution Protocols

Pursuant to Chapter III of the GDPR and recognized international privacy standards, data subjects possess comprehensive statutory rights:

• 1. Right to be Informed: The right to understand personal data processing operations prior to intake.
• 2. Right to Consent: The right to freely give or withhold consent for data processing activities.
• 3. Right of Access: The right to inspect, review, or receive a copy of personal data processed by EYC.
• 4. Right to Withdraw Consent: The right to revoke previously granted consent at any time without compromising prior lawful processing.
• 5. Right to Erasure ("Right to be Forgotten"): The right to demand permanent deletion of personal data where statutory criteria are met.
• 6. Right to Restrict Processing: The right to request the temporary suspension or limitation of data processing.
• 7. Right to Data Portability: The right to receive personal data in a structured, commonly used, machine-readable format.
• 8. Right to Object: The right to object to processing for direct marketing, commercial profiling, or automated decision-making.
• 9. Right to Lodge Complaints & Seek Redress: The right to petition regulatory authorities or initiate judicial proceedings for statutory violations.
• 10. Right to Claim Damages: The right to claim compensation for actual losses arising from unlawful data handling.
• 11. Right to Self-Protection: The right to exercise self-defense mechanisms pursuant to civil law and applicable privacy statutes.
• Rights Execution Workflow: To exercise statutory rights, submit an official request through our secure contact form at /en-us/contact/ or via email to info@eyc.asia. EYC validates requester identity within 72 hours and delivers a formal written determination within 30 calendar days as required by law.

Article 21: Jurisdiction-Specific Privacy Addenda (Vietnam, EEA/UK, California)

To address the legal requirements of specific jurisdictions:

• Global Jurisdictional Alignment: Providing consistent, baseline privacy rights for all users worldwide while dynamically applying specialized regional addenda (including EU/UK GDPR, Swiss FADP, and US State privacy laws) based on user domicile.
• EEA & UK Specific Provisions: Grounding all operations in GDPR Article 6 lawful bases, recognizing supervisory authority escalation paths, and providing EU representative coordination.
• California Consumer Notice (CCPA/CPRA): Disclosing categories of personal information collected, rights to know, delete, correct, and opt-out. EYC explicitly certifies: We do not sell or share consumer personal information for cross-context behavioral advertising.

Article 22: Children's Privacy Protections in Education Systems

EYC upholds strict safeguards for minor privacy in compliance with the Children's Online Privacy Protection Act (COPPA), GDPR Article 8 / Recital 38, and international child data protection principles:

• Corporate Portal Boundary: eyc.asia is tailored exclusively for adult professionals and enterprises; we do not knowingly solicit or collect personal information from individuals under 16 years of age.
• Early Years Circle Platform (eyc.education): Within our dedicated early childhood technology solution, children's data is processed strictly under verifiable parental or guardian consent.
• Heightened Protection Standard: Children's records are ring-fenced within institutional school boundaries, encrypted with enhanced controls, never commercialized or used for behavioral profiling, and purged upon educational completion.

Article 23: Corporate Restructuring, Mergers & Acquisitions Continuity

In the course of business evolution, EYC may engage in corporate reorganizations, mergers, acquisitions, or asset assignments:

• Continuity of Privacy Safeguards: Any successor entity assuming EYC assets remains legally bound to honor all data protection commitments established under this Policy.
• Advance Client Notice: EYC commits to providing at least 30 days advance notice to enterprise clients and data subjects prior to completing any transfer affecting data ownership, affording clients the right to withdraw consent or request data erasure.

Article 24: Policy Governance, Amendments & Data Protection Contact

This Comprehensive Enterprise Data Privacy Policy becomes formally effective on October 3, 2026, superseding all prior published versions.

EYC reserves the right to review and amend this Policy periodically to reflect technological advancements, infrastructure upgrades, or regulatory updates. Material modifications will be prominently notified across our website at least 15 days prior to effective enforcement.

For inquiries regarding enterprise data privacy, data subject requests, or regulatory audits, contact our designated Data Protection Officer (DPO):

• Corporate Legal Entity (VI): CÔNG TY TNHH CÔNG NGHỆ VÀ TRÍ TUỆ NHÂN TẠO EYC
• Corporate Legal Entity (EN): EYC TECHNOLOGY AND ARTIFICIAL INTELLIGENCE COMPANY LIMITED
• Enterprise Tax ID: 0319723892
• Registered Headquarters: 2nd Floor, 68 Nguyen Hue, Sai Gon Ward, Ho Chi Minh City, Vietnam
• Designated Unit: Data Protection & Information Security Compliance Unit
• Official Online Intake Channel: Secure contact form at /en-us/contact/
• Designated Data Protection Contact: info@eyc.asia