anou · Kalasus

anou PRIVACY POLICY

Effective Date: 15/08/2026Last Updated: 15/08/2026

INTRODUCTION

Welcome to the anou Platform, an online, app-based marketplace that enables Users, including Posters, Takers, Service Provider Users and Service Recipient Users, to post, book, accept, perform, receive, manage and settle Tasks, including Service Requests, Service Offers and Community Campaigns, in accordance with the Terms of Use. The Platform is operated and managed by Kalasus Company Limited (“anou”, “we”, “us”, or “our”).
At anou, we recognise that Personal Data is a valuable asset and Users’ privacy is a priority. Furthermore, anou takes its responsibilities under all applicable laws and regulations relating to privacy, personal data protection, cybersecurity, information security, electronic transactions, consumer protection, e-commerce, advertising, telecommunications and other matters relevant to the Processing of Personal Data, in each case as amended, supplemented or replaced from time to time (“Privacy Laws”), seriously and is committed to respecting the privacy rights and concerns of all Users of the anou Platform. This Privacy Policy (this “Policy”) explains how anou collects, uses, discloses, stores, transfers and otherwise Processes Personal Data when Users access or use the Platform and the Services. Responsible Personal Data management is both a legal compliance matter and a foundation for building a safe and sustainable digital service community.
This Policy is designed to help Users clearly understand their rights and obligations, and the measures anou takes to protect Users’ Personal Data throughout their interactions with the Platform, so that Users can make voluntary and informed decisions when using the Services.

DEFINITIONS

Capitalised terms used but not defined in this Policy shall have the meaning ascribed to them in the Terms of Use, unless the context otherwise requires.

“Basic Personal Data” means Personal Data that identifies or relates to an individual and is not Sensitive Personal Data, including (without limitation):
Identity: full name and other names/aliases (if any); date of birth; gender; nationality; photographs, and audio or video of an individual.
Addresses and contact details: place of birth; residence/temporary residence, current address, delivery/pick-up address; email address; phone number; emergency contact (where provided).
Government-issued identifiers, to the extent classified as Basic Personal Data under applicable law: national ID/identity card number, passport number, personal identification/registry number, driver’s licence number, tax identification number, social insurance/health insurance numbers, vehicle registration number.
Account and credentials: User ID/Username, Account profile information; profile settings and preferences; login timestamps and security logs; in-app communication handles.
Network and device information: IP address, device identifiers (e.g., IDFA/AAID, IMEI, MEID, UDID), hardware configurations, device type, operating system, browser type, Platform settings and version, language settings, cookie information, clickstream and usage logs, pages/screens viewed, timestamps, referral URLs, or crash and diagnostic logs.
Social features: social media handles/IDs, profile picture, content Users share from or connect to social media (subject to Users’ settings and the social media provider’s policies).
Platform usage and transactions: search and browsing history; Task creation/acceptance history; offers and negotiations; dispute records and outcomes; Services and content interactions; ratings, reviews, feedback; delivery instructions; in-app communications.
Other information linked to an identifiable individual or that can be used to identify an individual, to the extent permitted by applicable law and not classified as Sensitive Personal Data.
The classification of Basic Personal Data and Sensitive Personal Data will be determined in accordance with applicable law. Where the same category of Personal Data may be classified differently depending on its context, sensitivity, purpose of processing or applicable law, we will apply the higher level of protection required by law.
“Data Controller” means the organisation or individual that decides the purposes and means of Processing Personal Data. In the context of the Services provided, legal entity Users may act as independent Data Controllers regarding the Personal Data of their employees, clients or contractors that Users upload or manage through the Platform's features.
“Data Controller and Data Processor” means the organisation or individual that simultaneously decides the purposes and means of Processing and directly performs the Processing of Personal Data. In the context of the Services provided, Kalasus Company Limited acts as the Data Controller and Data Processor for Personal Data related to Platform administration, Users’ reputation, and Service-matching algorithms.
“Data Processor” means the organisation or individual that Processes Personal Data on behalf of the Data Controller through a contract or agreement. This includes third-party service providers engaged by anou, such as cloud hosting services, data analytics providers, and specialised security firms, who Process Users’ Personal Data strictly according to anou’s instructions.
“Data Subject” means an identifiable individual to whom the Personal Data relates.
“Personal Data” means digital data or information in any form (including text, numbers, symbols, images, audio or video) that relates to an identified or identifiable individual, as defined under applicable laws, including Basic Personal Data and Sensitive Personal Data. For the avoidance of doubt, Personal Data does not include anonymised, de-identified or aggregated information that does not identify an individual and cannot reasonably be used to identify an individual.
“Personal Data Processing”, “Processing”, or “Process” means one or more activities performed on Personal Data, including but not limited to: collection, recording, analysis, storage, modification, disclosure, lookup, retrieval, encryption, decryption, copying, transmission, provision, transfer, deletion, or destruction of Personal Data.
“Sensitive Personal Data” means Personal Data that is subject to enhanced protection under applicable law and, if misused or disclosed, may directly and adversely affect an individual’s rights and legitimate interests, including (without limitation):
Official identity information and KYC files: scans/photos and information from identity documents (e.g., ID card/passport), facial images used for selfie-matching/liveness checks, and e-KYC information. By default, anou does not conduct criminal background checks or professional licence verification. Furthermore, anou will process background-check, credit, criminal-record, licence, certification, or similar verification information only where:
a specific Platform feature or Policy expressly requires or permits such verification;
the Processing is legally permitted;
the relevant User has been provided with appropriate notice and, where required, has given valid consent.
Biometric data: facial templates, fingerprints, voiceprints and other unique biometric identifiers used for identity verification or fraud prevention.
Payment and transaction information: Payment transactions are processed by licensed payment service providers, banks, e-wallet providers or other authorised financial institutions. These providers may process payment data as independent controllers or regulated entities under their own terms and privacy policies. anou does not intentionally collect or store full card numbers, CVV/CVC or payment authentication credentials. anou may receive and process limited payment-related data such as transaction references, payment status, refund status, payout records, masked card details, alternative refund method information, unsuccessful-refund records, unsuccessful-refund notices, refund pending-period records, refund objection records, refund-to-SEN credit records and SEN balance records for Platform operation, reconciliation, fraud prevention, dispute resolution, tax and legal compliance.
Health and disability information: Information about health status, medical certificates, disability status or accommodations (where voluntarily provided or required by law for eligibility/support purposes).
Location data: general and (where features require) precise geolocation for discovery, matching and safety features (e.g., map visibility/priority, SOS/urgent radius).
Personal Data of Minors: Personal Data of individuals under eighteen (18) years old, where such Personal Data is incidentally submitted or lawfully processed for a specific safety, compliance, dispute-resolution or legally required purpose, subject to any additional requirements under applicable law.
Other protected categories designated as sensitive or confidential under applicable law (e.g., religious beliefs, political opinions, genetic data, sexual life/sexual orientation), where collected in limited cases as permitted or required by law.

APPLICABLE SCOPE

Applicability

This Policy applies to all Users, including but not limited to:

Posters;
Takers;
Representatives: Authorised representatives, employees, staff members, contractors, consultants, partners, or clients of Users using the Services;
General Users: Visitors to our Platform;
Recipients of Tasks or third parties whose Personal Data is provided by Users to the Platform for the purpose of Task fulfilment.
Responsibility for Third-Party Personal Data
If Users provide anou with Personal Data relating to another individual, Users must ensure that they have a lawful basis to do so and, where required by applicable law, have provided appropriate notices and obtained valid consent from the relevant Data Subject.
To the extent permitted by applicable law, Users are responsible for third-party claims, complaints, losses, penalties, costs, or liabilities arising from Users’ unauthorised provision of third-party Personal Data, failure to provide required notices or obtain required consents, or violation of third-party privacy rights.

COLLECTION OF PERSONAL DATA

As the Platform provider, anou Processes Personal Data provided by Users, as well as the Personal Data generated during Users’ search for, access to, exploration of, registration for, or use of our Services. The Personal Data that we Process includes:
the Basic Personal Data specified in the Definitions section of this Policy;
the Sensitive Personal Data specified in the Definitions section of this Policy.
Additionally, anou collects Personal Data about Users from the following sources:
Directly from Users – for example, when Users:
create or use an Account; complete registration or profile forms; submit KYC/verification documents;
provide Personal Data to determine Service eligibility (e.g., onboarding, verification, posting a Task, business or partner applications);
provide payment or payout information, such as bank account details, wallet information, payment method identifiers, masked card details, or other payment-related information processed by the PSP;
contact customer support via chat, phone (which may be recorded), email or in-app channels;
submit reviews/ratings/feedback, participate in promotions, contests or events, or upload User content (text, images, audio, video);
interact with our social media pages or link their Accounts to a social media account (subject to Users’ settings and the social media provider’s policies);
use AI-powered features (e.g., chatbots), or otherwise submit Personal Data through our Platform;
provide Personal Data about other Data Subjects (e.g., beneficiaries, employees, contractors, minors, recipients). In doing so, Users represent that Users have obtained such individuals' consent or have another lawful basis to share such individuals' Personal Data with us.
Automatically when Users use the anou Platform – for example:
Device and usage information: IP address, device identifiers (IDFA/AAID, IMEI, MEID, UDID), device and browser/OS details, app version, language and settings, pages/screens viewed, features used, content viewed, clickstream, session timestamps, referral URLs and crash/diagnostic logs;
Cookies and similar technologies: cookies, SDKs, pixels, tags and beacons;
Location data: general or precise location (subject to Users’ device permissions) for features such as address lookup, delivery, fraud prevention and safety;
Communications and safety: records of in-app communications; call recordings (where permitted by law and disclosed); images/audio/video captured when Users use features that allow or require such recordings to ensure safety, compliance and Service quality.
From third parties and public sources – for example:
our affiliates and group companies;
service partners and vendors (e.g., on-Platform partners, payment and anti-fraud providers, identity verification/KYC vendors, analytics and marketing partners);
financial insurance, credit-scoring or risk-assessment partners, where such partners are relevant to a specific feature and were permitted by applicable law;
referral programmes, loyalty or rewards partners;
credit bureaus/credit-scoring providers and other risk-assessment providers (as permitted by law);
public or governmental sources, and publicly available databases.
If Users log in with, link to, or otherwise use social media features in connection with the anou Platform, anou may access Personal Data Users have voluntarily provided to the social media provider in accordance with such provider's policies. Accordingly, anou will Process such Personal Data in accordance with this Policy.
The specific types of Personal Data Processed will depend on the particular Services Users use, and the corresponding purposes of Processing described in this Policy.
Furthermore, anou only Processes Sensitive Personal Data with Users’ express consent and/or as otherwise permitted by applicable law. Where documents Users submit for a specific purpose contain Sensitive Personal Data that is not required, Users should redact or mask such Sensitive Personal Data before submission.
To the extent permitted by applicable law, anou may record, monitor, or retain electronic communications (e.g., chat, audio, or video) between Users, and between Users and the Platform, subject to providing appropriate notices or obtaining necessary consents, to ensure compliance with regulatory obligations, internal governance requirements, and for the purposes set out in this Policy
Task Evidenxe, Location, Route, SOS and Payment-Flow Data
To operate the Task flows described in the Terms of Use and applicable Policies, anou may Process Task evidence and workflow data, including before evidence, after evidence, completion requests, rejection records, cancellation reasons, dispute materials, Platform Chat Thread records, timestamps, route information, pick-up and destination information, geolocation signals, available-for-task status, nearby matching signals, SOS incident categories, SOS response records, Community Campaign attendance records, Held SEN records, SEN Release records, Final SEN Deduction records, SEN Adjustment records, Negative SEN Balance records, Pending Funds records, Available Balance records, unsuccessful-refund notices, alternative refund method requests, refund-method verification records, refund pending-period records, refund objection records and refund-to-SEN credit records.
For Urgent Tasks, Mobility Support Tasks, Ride-Sharing Tasks and Emergency (SOS) Tasks, anou may Process location, route and proximity data to surface Tasks to nearby eligible Users, operate groups of up to five (5) nearby Takers, verify arrival, support safety features, investigate disputes, prevent fraud and administer payment, refund and SEN workflows.
For all monetary Tasks, the Fund-Receiving User is required under the applicable Policies to submit before evidence and after evidence, to the extent technically available and safe to do so. Such evidence may contain Personal Data of Users or third parties. Users must avoid uploading unnecessary Sensitive Personal Data and must obtain any required notice, consent or other lawful basis before uploading third-party Personal Data, except where emergency, safety or other legal grounds permit the Processing.
SOS-related data may be processed for safety, emergency-response support, fraud prevention, dispute handling, payment debt administration, Support-Compensation SEN administration, legal compliance, cooperation with competent authorities and protection of Users, third parties and the Platform. SOS-related data may be retained for a longer period where necessary for safety, legal claims, fraud prevention, accounting, tax, payment or regulatory purposes, subject to applicable Privacy Laws.

PURPOSES OF PROCESSING PERSONAL DATA

Subject to this Policy, anou may collect, use, disclose and/or otherwise Process Users’ Personal Data for one or more of the following purposes (collectively referred to as the “Purposes”):

Provision, Operation and Administration of the Services
To provide, activate, deliver, support and maintain the Services at Users’ request;
To process Task Acceptance, Task Completion Confirmation, Payment Release, disputes, refunds, cancellations, safety incidents, Community Campaign participation, Urgent Tasks, Emergency (SOS) Tasks, SEN transactions and other Platform-related activities;
To create, administer and update Users’ Accounts, profiles, roles and preferences;
To authenticate Users’ identities and verify information provided to us;
To process and reconcile payments, fees, charges, invoices, refunds, promotions, rewards or subscription plans;
To administer unsuccessful-refund handling where a monetary refund cannot be successfully processed, including notifying the User, requesting and verifying an alternative refund method, recording unsuccessful refund attempts, administering the applicable pending period, processing any User objection, documenting user-facing notices, handling PSP or payment-method limitations, preventing fraud or abuse, complying with legal and PSP requirements, and, where permitted under the Refund Policy and SEN Rules, crediting the applicable Refundable Amount as SEN;
To enable in-app interactions, communications and features (such as messaging, notifications, reviews, feedback, evidence uploads or social features);
To carry out internal business, administrative or contractual obligations required for Service provision.
Customer Support, User Relationship Management and Communications
To provide customer care, technical support, troubleshooting, complaint handling and dispute resolution;
To respond to Users’ enquiries, requests, feedback and claims;
To contact or communicate with Users (by email, SMS, phone call, push notification, postal mail or other permitted means) regarding Users’ Accounts, transactions, Service updates, security alerts, administrative matters or necessary notices;
To manage customer relations, loyalty programmes, membership schemes, rewards, engagement and retention activities.
Service Improvements, Analytics, Research and Development
To analyse usage behaviour, trends, interactions and preferences to improve or personalise the Platform and/or Services;
To conduct market research, surveys, satisfaction measurements, User studies and behavioural analysis;
To develop, test, enhance, maintain or upgrade systems, applications, algorithms, AI-powered features, user interfaces and technological capabilities;
To support data-driven insights, statistical analysis, reporting, modelling and internal performance measurement;
Unless separately notified to Users and, where required by law, subject to Users’ consent, anou will not use Users’ Personal Data to train third-party foundation models or external AI models in a manner that would allow such Personal Data to be identified or reconstructed.
To determine suitability, eligibility, ranking, scoring, or recommendation of products, Services, or offerings to Users. In doing so, anou may use automated or semi-automated systems to support matching, ranking, fraud prevention, safety checks, Task visibility, reputation metrics, performance ratings, reliability scores, risk flags, and access to certain Platform features. These systems may consider factors such as Task history, cancellations, Task Completion Confirmations, disputes, ratings, reviews, response time, suspected fraud, policy violations, safety incidents, payment status, and Account verification status. Where an automated decision produces legal effects or similarly significant effects on a User’s access to the Services, anou will provide appropriate safeguards as required by law, which may include the ability to request human review, submit supporting information, or challenge the decision through the Platform’s support channels.
Marketing, Promotion and Personalisation
To provide Users with information, updates, offers, promotions, rewards, discounts, benefits, advertisements or marketing communications relating to our Services, or those of our partners by the following methods and frequency:
Delivering marketing communications via SMS, USSD, MMS, IVR calls, in-app or Platform notifications, or through any other methods permitted under applicable law;
Sending such marketing materials directly to Users through electronic devices, digital communication tools, online platforms, or other channels permitted in the online environment;
Issuing marketing communications in accordance with the frequency limits prescribed by applicable advertising and data-protection laws.
To personalise marketing messages, content, recommendations and Users’ experiences based on Users’ interactions, preferences and profiles;
To invite Users to events, campaigns, loyalty programmes or promotional activities;
To conduct co-marketing, affiliation, sponsorship or partnership activities in compliance with applicable law;
Where required by applicable law, anou will obtain Users’ prior consent before sending marketing communications or using Personal Data for targeted advertising or personalised marketing. Users may opt out of marketing communications at any time. Opting out of marketing communications will not affect transactional, security, legal, Account-related or Service-related notices.
Users may at any time opt out of receiving marketing or promotional communications from us. Users may exercise this right by following the unsubscribe instructions provided in our messages, adjusting their preferences in their Account settings, or contacting us through the channels specified in this Policy. Please note that even if Users opt out of marketing communications, we may still send Users non-marketing messages necessary for Service provision, such as transactional notifications, Account alerts, or Service-related updates.
Safety, Security, Compliance and Risk Management
To protect the safety, rights, property and security of Users, personnel, partners and the public;
To perform identity verification, fraud detection, abuse prevention, risk assessment, credit assessment (where applicable), anti-money laundering, counter-terrorism financing and sanctions compliance;
To monitor adherence to our policies, Terms, guidelines and community standards;
To detect, prevent, investigate or address fraudulent, unlawful, prohibited or unsafe activities, including cybersecurity threats, hacking attempts or system misuse;
To maintain the integrity, confidentiality and availability of our systems, including backups, logging, audit trails, system monitoring and incident response.
Legal and Regulatory Compliance
To comply with applicable laws, regulations, lawful requests, law-enforcement requirements, court orders or regulatory obligations;
To make disclosures required or authorised by governmental or regulatory authorities;
To fulfil tax, accounting, audit, reporting and corporate governance requirements;
To support public-interest or statutory purposes such as national security, public order, emergency response, public health or protection against unlawful acts, where permitted by law.
Business Operations, Corporate Transactions and Internal Functions
To support internal business functions such as auditing, finance, risk management, record-keeping and administration;
To store, host, backup or maintain Personal Data for operational continuity or disaster recovery;
To facilitate corporate transactions, including mergers, acquisitions, divestments, reorganisations, restructurings, financings or transfers of business assets, including evaluation and negotiation of such transactions.
Other Purposes with Notice or Consent
For any other purpose for which we have obtained Users’ consent;
For any purpose notified to Users at the point of collection or Processing in accordance with applicable law;
For any purpose necessary to protect Users’ vital interests or, where recognised by applicable law, the legitimate interests of the Platform or third parties.
The specific purposes for which we may collect, use, disclose or otherwise Process Users’ Personal Data will depend on the context and circumstances in which the Personal Data is obtained, and such purposes may not be exhaustively listed above. Where we intend to Process Users’ Personal Data for any purpose other than the purposes for which the Personal Data was originally collected, we will provide Users with prior notice of that further Processing and, where required under the applicable law, obtain Users’ consent before carrying out such Processing, unless the additional Processing is permitted without consent under applicable legal obligations.

DISCLOSURE OF PERSONAL DATA

We do not disclose Users’ Personal Data to third parties except as described in this Policy or where required or permitted by applicable law. For the purposes set out in this Policy, we may disclose or transfer Users’ Personal Data to the following categories of recipients, strictly on a need-to-know basis and subject to appropriate safeguards:

Group Companies and Affiliates

We may share Users’ Personal Data with our subsidiaries, affiliates, related companies, business units, and/or authorised staff to support the provision, operation, administration and improvement of our Services and the Platform, and to enable consolidated reporting, risk management, internal governance and compliance activities.

Service Providers and Operational Partners
We may disclose Users’ Personal Data to third-party service providers engaged to assist with our business operations, including but not limited to:
payment processors, PSPs or authorised payment/settlement providers supporting Escrow or similar payment holding workflows, and financial institutions;
identity-verification, background-checking and anti-fraud providers;
cloud hosting, data-storage and IT infrastructure vendors;
customer support, call-centre, logistics, delivery and field-service providers;
analytics, data-processing, marketing and advertising partners;
legal, tax, compliance, audit and accounting advisors; and
consultants, contractors, agents or other authorised representatives.
These third parties Process Users’ Personal Data on our behalf and according to our instructions, subject to confidentiality and data-protection obligations.
Business Partners, Merchants and Integrated Service Providers
Depending on the Services Users use, we may share relevant Personal Data with our business partners, merchants, vendors, advertisers or other third parties involved in delivering, fulfilling or enabling those Services. This may include:
partners providing goods, delivery or on-Platform Services;
partners offering promotions, loyalty programmes, membership benefits or bundled Services;
partners co-hosting events, campaigns or joint activities with us;
third parties whose services Users choose to access, link to, or authorise through our Platform.
Where Users participate in loyalty or marketing programmes managed by partners, we may share Users’ names, contact details, transaction information and other relevant Personal Data necessary to administer such programmes.
Other Users (Where Necessary)
We may disclose specific Personal Data to other Users of the Platform when necessary to fulfil a Task, allow communication, and enable the Tasks requested by Users. Examples include:
sharing Users’ profile names, ratings, contact details, location data, selected evidence, and other necessary Service details with service providers, recipients, senders, merchants or other Users involved in the Task or Services;
displaying Users’ publicly posted reviews, feedback, comments or profile information;
facilitating group features, Legal Entity Accounts, shared Services where expressly supported by the Platform, and dispute resolution;
sharing Users’ real-time location when Users activate relevant safety or communication features.
Users remain in control of information Users choose to publicly display.
Government Authorities, Law Enforcement and Regulatory Bodies

We may disclose Users’ Personal Data to competent courts, regulators, enforcement agencies, tax authorities or other government bodies where required to do so by law, regulation, legal process, enforceable request, or where such disclosure is necessary to:

comply with legal or regulatory obligations;
respond to lawful requests or investigations;
protect our rights, Users, the public, or the security and integrity of our Services;
prevent, detect or investigate fraud, abuse, illegal activities or safety-related incidents.
Corporate Transactions

We may disclose or transfer Users’ Personal Data in connection with any merger, acquisition, divestment, restructuring, financing, asset sale or similar corporate transaction. In such cases, Personal Data will remain subject to safeguards consistent with this Policy.

Other Disclosures Permitted by Law or with Users’ Consent
We may disclose Users’ Personal Data:
where Users have provided Users’ express consent;
to third parties as required or permitted under applicable law;
where the disclosure is necessary to protect Users’ vital interests or those of others;
where the disclosure is necessary for the performance of the Terms;
for any other purpose notified to Users at the time of collection.
For the avoidance of doubt, where Privacy Laws or other applicable laws permit or require us to collect, use, or disclose Users’ Personal Data without Users’ consent, we will continue to rely on such legal permissions. Consistent with the foregoing and subject to applicable law, we may Process Users’ Personal Data on recognised legal grounds, including but not limited to: compliance with our legal obligations; performance of the Terms; the pursuit of our legitimate interests (to the extent recognised as a valid legal basis under applicable law) where such interests are not overridden by Users’ data protection rights; or where necessary for the establishment, exercise, or defence of legal claims.
No Sale of Personal Data: For the avoidance of doubt, anou does not sell, rent, or trade Users’ Personal Data to any third parties for commercial gain. Any sharing or disclosure of Personal Data is conducted strictly for the Purposes outlined in this Policy, in connection with the provision of the Services, or as explicitly authorised by the User.

DATA PROTECTION FOR MINORS

The Platform is not intended for individuals under eighteen (18) years old. Therefore, anou does not knowingly allow minors to create Accounts, post Tasks, accept Tasks, purchase or use SEN, or otherwise use the Services.
Furthermore, anou may process Personal Data relating to minors only where such data is incidentally submitted or strictly necessary for safety, compliance, dispute resolution, legal claims, legal obligations, or another purpose permitted by law. Additionally, anou will not use minors’ Personal Data for marketing, behavioural advertising, profiling or non-essential analytics.
If anou becomes aware that Personal Data of a minor has been submitted in breach of the Terms or this Policy, anou may delete, restrict, de-identify, isolate, retain, or otherwise handle such Personal Data in accordance with applicable law, the Terms, this Policy and anou’s internal compliance procedures.

DATA PROTECTION PRINCIPLES

As the Platform provider, anou is committed to the following fundamental principles throughout the collection, Processing, use, and storage of Users’ Personal Data:

Users’ Personal Data shall be Processed in a lawful, fair, and transparent manner. Accordingly, anou ensures that all Personal Data Processing activities are based on a valid legal ground (such as consent or contractual necessity) and that Users are fully informed of the purposes and methods of such Processing.
Personal Data is collected only for specified, explicit, and legitimate purposes related to the operation of the Platform. Accordingly, anou strictly adheres to the principle of “data minimisation”, ensuring that we only collect and Process the Personal Data that is strictly necessary to fulfil these purposes.
To ensure security, anou implements reasonable legal, physical, organisational, and technical measures to protect Users’ Personal Data against loss, unauthorised access, misuse, alteration, or accidental destruction. These measures include, but are not limited to:
Using industry-standard encryption for Sensitive Personal Data such as identity documents and financial logs.
Implementing the need-to-know principle, whereby access to Users’ Personal Data is restricted to authorised personnel who require such access to perform such personnel's specific duties.
Binding all personnel handling Personal Data by strict confidentiality agreements, subjecting such personnel to disciplinary action or legal proceedings in the event of unauthorised disclosure.
Furthermore, anou shall take reasonable steps, anou shall take reasonable steps to ensure that the Personal Data we Process remains accurate, complete, and up-to-date. We provide mechanisms for Users to rectify Users’ Personal Data and ensure the integrity of the Platform.
Safety and information security activities are conducted regularly, continuously, and in a timely manner. Furthermore, anou proactively monitors its systems to detect vulnerabilities and ensures that incident response protocols are executed effectively to protect the rights and interests of Users during any potential security event. In the event of a Personal Data breach, anou will promptly notify the competent governmental authorities and affected Users in accordance with the procedures and timeframes mandated by applicable Privacy Laws and will take immediate remedial actions to mitigate any potential harm. Any liability or claim for compensation arising out of or in connection with such security events shall be governed by the Terms, subject always to any mandatory rights, remedies or liabilities that cannot be limited or excluded under applicable law.
In alignment with national standards, anou acknowledges its responsibility to ensure network information safety to contribute to social order, national security, and the healthy development of the digital economy. In cases involving SOS Tasks or emergency situations, Personal Data Processing will prioritise the protection of life, health, and safety as a paramount principle.
Furthermore, anou ensures that any third-party Data Processors (such as payment gateways or cloud service providers) who Process Personal Data on our behalf are contractually obligated to adhere to security standards that are no less stringent than those described in this Policy.

USE OF COOKIES AND SIMILAR TECHNOLOGIES

We may use cookies and similar tracking technologies to operate, improve and personalise our Platform and online Services. Cookies are small data files stored on Users’ devices when Users access our Platform or certain online advertisements. These technologies help us recognise Users’ devices and enable various functions, including:
Essential and Functional Purposes
Determining whether cookies on Users’ devices are enabled, so we can understand what information may be collected and which features can function properly;
Remembering Users’ preferences so that Users do not have to re-select settings each time Users revisit our Platform;
Enabling basic features required for the Platform to operate smoothly.
Performance, Analytics and Experience Enhancement
Analysing usage patterns, traffic and interactions to distinguish new visits from returning visits and evaluate the effectiveness of our Platform;
Temporarily storing session information to provide faster loading, smoother navigation and a more customised User experience; and
Improving the design, content, interface and functionality of the Platform based on aggregated user behaviour.
Advertising and Marketing
Delivering online advertisements that may be relevant to Users’ interests, whether on the Platform or through third-party platforms;
Measuring and understanding the performance of our advertisements and marketing campaigns;
Allowing approved advertising networks and analytics partners to deploy cookies to help us show Users more relevant content.
Cookies may be placed on Users’ devices either by us or by authorised third parties acting on our behalf, such as analytics providers, advertising networks or service providers that help us measure Platform usage. These third parties may use cookies to collect information about Users’ interactions with our digital Services. Where third parties Process Personal Data on our behalf, they are required to do so under appropriate contractual, confidentiality and data-protection obligations. Where third-party services operate independently or Process Personal Data as independent controllers, their Processing will be governed by their own privacy policies and terms.
Most browsers and mobile devices accept cookies by default. Users may choose to disable, block or delete cookies by adjusting Users’ browser or device settings. However, please note that blocking certain types of cookies, especially those strictly necessary for operation, may affect the availability or functionality of some features of our Platform.

THIRD-PARTY DATA COLLECTION AND EXTERNAL SITES

Third-Party Analytics and Tracking Technologies

We may use analytics, attribution, crash-reporting, advertising measurement, fraud-prevention, performance-monitoring and similar tracking technologies provided by third-party vendors to understand Platform usage, improve Services, detect errors, measure campaigns and support advertising attribution. These tools may use cookies or similar technologies to collect information about Users’ usage patterns. Information generated by such technologies (including Users’ IP addresses) may be transmitted to and stored on third-party servers in other countries. These third-party analytics providers may use the information to analyse usage, compile reports, and provide related services. These analytics providers may also disclose this information to other parties where required by law, or where such other parties Process Personal Data on behalf of these third-party analytics providers. We do not combine the analytics-generated IP addresses with other Personal Data we hold. Where required by applicable law, non-essential cookies, SDKs, pixels or tracking technologies will be used only with Users’ consent or after Users have been provided with appropriate choices.

Third-Party Applications, Integrations and Downloads
From time to time, we or authorised third parties may offer downloadable software, plug-ins or integrated applications for use with our Services. These applications may access or allow third parties to access Users’ identifiers (names, usernames, device IDs, IP addresses, session activity, or cookies previously stored on Users’ devices). Some third-party applications may request additional Personal Data directly from Users.
Products or services provided through these applications are not owned or controlled by us, and we are not responsible for such providers' practices. Users should review the privacy policies and terms of such third-party providers before using such third-party applications or services.
Links to Third-Party Websites, Applications and Services
Our Platform may contain links to third-party websites, applications or services, including those that host advertisements, promotions or features integrated with our Services. These websites and applications operate independently and have their own privacy policies and security measures.
Even if such third parties are affiliated with us, we do not control their content, data-collection practices, or use of Personal Data. Personal Data collected by third-party partners, including co-marketing partners, advertisers, analytics providers or service operators, may not be accessible to us and may be Processed under their own policies.
No Responsibility for External Sites

We are not responsible for the content, privacy practices, security measures or Personal Data Processing activities of any third-party website, application or service, whether or not it is linked from our Platform. Access to these external sites is at their own discretion and risk. However, we welcome feedback regarding third-party links featured on our Platform, including reports of non-functioning or unsafe sites

Control Over Targeted Advertising: Users may control how Users’ Personal Data is used for targeted advertising in several ways:
Within our Platform: by adjusting advertising or privacy preferences in their Account settings (where available);
On external platforms: by modifying ad-personalisation settings directly on third-party services that display ads;
On Users’ devices: depending on Users’ operating systems, Users may disable mobile advertising identifiers (e.g., Apple’s IDFA, Google’s GAID) or restrict app tracking in Users’ device privacy settings.
Please note that disabling certain identifiers or tracking tools may limit the functionality or personalisation of some features on our Platform.

CROSS-BORDER DATA TRANSFER

Users’ Personal Data may be transferred to, stored in, or processed in countries or territories other than Users’ country of residence where necessary for the Purposes described in this Policy. To ensure transparency, the primary cross-border transfer scenarios include:
Cloud hosting and data backup: Account logs and Task data may be transferred to our cloud infrastructure providers located in jurisdictions where our cloud, infrastructure, analytics, security, KYC, payment, support or group-company service providers operate, which may include Vietnam, Singapore, other Asia-Pacific jurisdictions, the United States, the European Union or other jurisdictions notified to Users where required by law.
Analytics and crash reporting: Device information, usage patterns, and crash logs may be processed by analytics vendors located outside Users' country of residence for Service improvement, protected by data minimisation and pseudonymisation.
Payment processing: Transaction status, payout information, and masked card details may be routed through international Payment Service Providers (PSPs) and financial institutions to process settlements, subject to PSP security controls and terms.
KYC and identity verification: Identity documents and liveness verification results may be processed by specialised third-party KYC vendors, safeguarded by DPAs and restricted access.
Group company support: Account, support, and Task records may be accessible to our affiliates or group companies located in other jurisdictions for compliance, reporting, and customer support, governed by intra-group data transfer agreements.
To ensure ongoing compliance, we will maintain and update any required cross-border transfer impact assessment dossier and submit or make it available to competent authorities where required by applicable law. Where consent is required for a cross-border transfer, anou will obtain such consent through a separate affirmative mechanism before carrying out the transfer, unless an applicable legal exception applies.
Where Personal Data is accessed or requested by foreign governmental, law enforcement, or regulatory authorities, anou will handle such access or request in accordance with applicable law, applicable contractual safeguards, and its internal compliance procedures, to the extent legally permissible.

DATA RETENTION AND STORAGE

The Processing of Users’ Personal Data commences from the moment we receive the Personal Data provided by Users, or when Users’ interactions with the Platform generate Personal Data, provided that a valid legal basis for Processing exists under applicable law.
We shall retain Users’ Personal Data for the duration necessary to fulfil the Purposes outlined in this Policy, unless a longer retention period is required or permitted by law. The specific retention duration may vary depending on the nature of the Personal Data, the purpose of Processing, and the applicable regulatory requirements. To support this, anou maintains an internal retention schedule specifying the applicable retention period for each category of Personal Data, taking into account legal, tax, accounting, payment, security, dispute-resolution, and operational requirements. Examples of retention periods include:
Account and profile data: retained for the duration of the Account and for a reasonable period after closure where required for legal, tax, audit, fraud prevention, safety, dispute-resolution, or enforcement purposes.
KYC, identity verification, and tax information: retained for the period required under applicable KYC, tax, accounting, anti-fraud, payment, dispute-resolution, and legal compliance requirements.
Biometric and liveness data: Biometric templates or liveness verification data will be retained only for as long as necessary for identity verification, fraud prevention, security, legal compliance, or dispute-resolution purposes, and will be deleted, de-identified, or isolated when no longer required.
Task records, Chat Threads, evidence, images, files, ratings, reviews, and dispute records: retained for the period necessary to operate the Platform, resolve disputes, protect safety, prevent fraud, enforce the Terms, and comply with legal obligations.
Payment, SEN, and transaction records: retained for the period required for payment reconciliation, refunds, chargebacks, accounting, tax, audit, fraud prevention, and legal compliance.
Marketing preferences and consent records: retained for as long as necessary to honour Users’ preferences, consents, withdrawals, opt-outs, and suppression requests.
Security logs, access logs, and technical records: retained for a reasonable period necessary for cybersecurity, fraud prevention, system integrity, incident response, and legal compliance.
Personal Data of minors submitted in breach of the Terms: deleted, restricted, de-identified, isolated, or otherwise handled in accordance with applicable law, this Policy, and anou’s internal compliance procedures.
If Users cease using the Platform or Users’ access is terminated, we may continue to store, use, or disclose Users’ Personal Data in accordance with this Policy if:
retention is necessary to fulfil a legal obligation or a request from a competent governmental authority;
the Personal Data is required for the establishment, exercise, or defence of legal claims;
there is a legitimate business interest (to the extent recognised as a valid legal basis under applicable law) in preventing fraud, ensuring security, or maintaining the integrity of the Platform’s reputation system.
When Personal Data is no longer necessary for the Purposes or legal requirements, we will take reasonable steps to securely erase the Personal Data so it cannot be recovered or anonymise/de-identify the Personal Data such that the Data Subject can no longer be identified, allowing the anonymised data to be used for statistical or analytical purposes.
Where Users request Account Deletion, anou will process the Account Deletion request in accordance with the Account Deactivation and Deletion Policy. Any request relating to deletion, destruction, de-identification, restriction, retention, or Processing of Personal Data will be handled in accordance with this Policy and applicable Privacy Laws. For the avoidance of doubt, Account Deletion may result in termination of access to the Account but does not necessarily require immediate deletion of all Personal Data where retention, restriction, isolation, de-identification or continued Processing is required or permitted under this Policy, the Terms, applicable Policies or applicable law.
A request for deletion, destruction, de-identification, restriction of Processing or withdrawal of consent does not automatically require immediate deletion of records that anou is legally permitted or required to retain for pending refund handling, unsuccessful-refund administration, PSP compliance, fraud prevention, audit, dispute resolution, legal compliance or establishment, exercise or defence of legal claims. In such cases, anou may restrict, isolate, de-identify, delete or retain the relevant records as appropriate and required under applicable Privacy Laws.
As a Platform provider, anou may securely delete, destroy, de-identify, or anonymise Personal Data without separate prior notice to Users where such action is consistent with this Policy, applicable law, and anou’s internal retention schedule. Furthermore, we reserve the right to refuse a request for the deletion or destruction of Personal Data if such a request is inconsistent with applicable laws, or if the Personal Data falls under a category that we are legally mandated to retain.

USERS’ RIGHTS, RESPONSIBILITIES AND HOW TO EXERCISE THEM

Users’ Rights

Users have the right to control Users’ Personal Data and may exercise these rights at any time in accordance with applicable data-protection laws. Depending on the jurisdiction and the circumstances of Processing, Users’ rights may include the following:

Right to Know and Access: Users may request confirmation as to whether we Process Users’ Personal Data and obtain a copy of such Personal Data.
Right to Consent and Withdraw Consent
Where Processing is based on Users’ consent, Users may withdraw such consent at any time.
Withdrawal of consent may affect Users’ ability to use certain features or Services. We may continue to Process Users’ Personal Data where permitted or required by law, including where necessary to perform the Terms, ensure safety, protect legitimate interests, or comply with legal obligations.
Right to Rectification: Users may access, review and update Users’ Personal Data by logging into their Accounts (where available) or by submitting a request for correction. If we are unable to make the correction for legitimate reasons, we will notify Users accordingly.
Right to Erasure: Users may request the deletion of Users’ Personal Data in the circumstances permitted by law. Deletion may not apply where retention is required for legal, regulatory, contractual, safety, or dispute-resolution purposes.
Right to Restrict Processing: Users may request that we restrict the Processing of Users’ Personal Data where Users contest its accuracy, object to the Processing, or where Processing is unlawful, subject to conditions prescribed by law.
Right to Object
Users may object to our Processing of Users’ Personal Data, including for direct marketing purposes or for other reasons permitted by law.
Where Users’ objection affects Service delivery or contractual performance, we may suspend, limit, or terminate certain Services in accordance with legal requirements.
Right to Data Portability: Where legally applicable, Users may request that we provide Users or a third-party organisation designated by Users with Users’ Personal Data in a structured, commonly used, machine-readable format.
Right to Lodge a Complaint, Claim Damages and Self-Defence: Users may file a complaint, claim damages, or exercise self-defence rights with us or with the competent data-protection authority if Users believe Users’ rights have been violated or their concerns have not been resolved.
Users’ Responsibilities
Users also have legal obligations regarding Users’ Personal Data to ensure the safe, lawful and fair use of Personal Data within the digital environment. Depending on the jurisdiction and the circumstances of Processing, Users’ responsibilities may include the following:
Self-Protection of Personal Data

Users are responsible for protecting their own Personal Data, including safeguarding Account credentials, devices, and any Personal Data Users disclose or upload. Users are responsible for taking reasonable steps to prevent unauthorised access, loss, leakage, or misuse of Users’ Personal Data.

Respect for the Personal Data of Others

Users must respect and protect the Personal Data of other individuals. Users may not collect, disclose, share, or use another person’s Personal Data in a manner that violates the applicable law or infringes upon another person’s lawful rights and interests.

Accuracy and Completeness of Personal Data Provided

Users are responsible for ensuring that all Personal Data Users provide to us is accurate, complete and up-to-date. Failure to do so may affect Users’ rights, Users’ Service experience, or our ability to assist Users.

Compliance with Personal Data Protection Law

Users must comply with all applicable regulations on Personal Data protection and must cooperate with the Data Controller, Data Processors, competent authorities, or relevant third parties in preventing, detecting, and mitigating violations of data-protection legislation.

If Users fail to fulfil any of the responsibilities mentioned above, it may result in:
limitations on the ability to use certain Services;
delays or refusals in handling requests where legal conditions are not met;
suspension or termination of Service use where required for compliance or safety;
liability under applicable laws for any damage, loss or violations arising from Users’ actions.
Principles Governing the Exercise of Rights and Obligations

When exercising Users’ Personal Data rights, Users must do so in accordance with the following principles:

The exercise of any Personal Data rights must be lawful and must not violate contractual commitments or statutory obligations.
Users may only exercise Users’ rights for the purpose of protecting their own legitimate interests. Requests must not be abusive, frivolous, obstructive, or made in bad faith.
Users must not hinder, obstruct or disrupt the lawful operations, activities or Processing conducted by the Data Controller, Data Processors or relevant third parties, including essential business, technical or security operations.
The exercise of Personal Data rights must not infringe upon the lawful rights, interests, safety, or freedoms of the State, organisations or other individuals.
How to Submit Requests
Users may exercise Users’ rights by:
accessing and updating Users’ Personal Data directly through their Account settings (where available); or
submitting a written request or enquiry to us through the contact channels provided in this Policy.
To protect Users’ privacy, we may need to verify Users’ identities before fulfilling Users’ requests. We may ask Users to provide additional information or documentation, particularly for access, correction, deletion, or portability requests.
Handling of Requests
We will acknowledge, assess and handle Users’ requests within the time periods required by applicable law. In complex cases, we may extend the response period once, as permitted by law, and will inform Users of the reason for the extension.
Where permitted by applicable law, we may charge a reasonable fee or refuse to act on a request if the request is manifestly unfounded, excessive, repetitive, abusive, technically infeasible, or if disclosure would harm national security, public order, or the lawful rights and safety of others. We will inform Users of the reason for any fee or refusal before taking action, where required by applicable law.
Requests to restrict, delete, or withdraw consent do not affect the lawfulness of Processing carried out before the request was made.
In certain situations, withdrawal of consent, objections, or deletion requests may require us to suspend, limit, or terminate some or all Services provided to Users.

CONTACT US

If Users have any questions about this Policy, our data-protection practices, or if Users wish to exercise Users’ rights or submit a request, concern, or complaint regarding the Processing of Users’ Personal Data, Users may contact us through the following channels:
Kalasus Company Limited

Registered address: 44 Ung Van Khiem Street, Thanh My Tay Ward, Ho Chi Minh City, Vietnam

Data protection contact: privacy@anou.vn
Support contact: support@anou.vn
In-app request path: Settings → Privacy & Data Requests.
In-App Support: Users may also submit enquiries directly via the anou Platform through Settings → Privacy & Data Requests → Contact Support.
For faster support and to ensure proper routing of Users’ requests, we encourage Users to contact us via email or through any designated online request form made available on our Platform (where applicable).
We will address all enquiries, concerns, and complaints in accordance with applicable laws, our internal procedures, and our commitment to protecting Users’ Personal Data.
Data Protection Contact: In compliance with applicable Privacy Laws, anou has appointed a personal data protection officer, team or other qualified data protection function responsible for overseeing personal data protection compliance, handling data subject requests, coordinating incident response, maintaining required impact assessment dossiers, and liaising with competent authorities where required by law.

IMPLEMENTATION PROVISIONS

This Policy forms an integral and inseparable part of the Terms governing the access to and use of the Platform.
This Policy becomes effective on 15/08/2026 upon its publication on support.anou.vn/privacy and/or within the Platform.
This Policy applies together with the Complaint and Dispute Resolution Policy, Account Deactivation and Deletion Policy, Task Cancellation Policy, Refund Policy, SEN Rules, Fee Schedule, Task Rule, Tax Policy, Terms of Use, Prohibited Goods and Services List, and any other notices, contractual agreements, or consent provisions that relate to our Processing of Users’ Personal Data. It is not intended to override or replace those notices or agreements, unless we expressly state otherwise.
Precedence
Where this Policy specifically addresses privacy or Personal Data protection matters, this Policy shall prevail over any conflicting provisions in the Terms solely with respect to those privacy or Personal Data protection matters, unless otherwise prohibited by applicable law.
Where a related Personal Data Processing regulation promulgated by competent governmental authorities exists, such regulation shall take precedence with respect to the Processing of Users’ Personal Data.
Any matters not governed by this Policy shall be governed by the Terms.
From time to time, anou may modify, update, supplement, or replace this Policy. Changes will be published on support.anou.vn/privacy and/or within the anou Platform prior to taking effect. Unless otherwise stated, changes will take effect on the date specified in the notice (or, if not specified, upon publication).
Where an update materially affects the way anou Processes Users’ Personal Data, anou will provide appropriate prior notice through the Platform, website, email, in-app notice or other suitable means. Where applicable Privacy Laws require consent for a new or changed Processing activity, anou will obtain such consent before carrying out that Processing activity. Users should regularly review support.anou.vn/privacy and/or the Platform for updates.

This Policy is intended to serve as the Platform’s notice of Personal Data Processing and is designed to comply with applicable Personal Data protection laws, including the laws of Vietnam.

Language: This Policy may be translated into multiple languages for convenience. In the event of any conflict, ambiguity, or inconsistency between the Vietnamese version and any translation thereof, the Vietnamese version shall strictly prevail, unless otherwise mandated by applicable law.