Cathay Leasing Privacy Notice

Privacy Notice for Prospective Customers, Existing Customers, and Related Persons

1. Purpose and Scope

Cathay Leasing Co., Ltd. (the "Company") is committed to performing its duties in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This Privacy Notice outlines the Company’s practices regarding the protection of your personal data (as defined below). It explains the purposes and methods by which the Company collects, uses, discloses, cross-border transfers, and/or otherwise processes (collectively, "processes" or "processing") your personal data. Furthermore, it describes your legal rights regarding your personal data, including data protection rights.

This Privacy Notice governs the processing of personal data of prospective customers, existing customers, and related persons. All affected parties should thoroughly read, understand, and regularly review this Privacy Notice to remain fully informed about how their personal data is processed.

In this Privacy Notice, the following terms shall have the meanings ascribed below:

"Personal Data" means any information relating to a living individual that enables the identification of such person, whether directly or indirectly.

"Sensitive Personal Data" means any personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union membership, genetic data, biometric data, or any other data that may affect the data subject in a similar manner as prescribed by law.

This Privacy Notice applies to individuals who are customers of the Company, including prospective customers, existing customers, and related persons. Related persons include vehicle users, beneficiaries, witnesses, guarantors, spouses of customers or of persons providing consent, auction winners, referees, contact persons for inquiries or debt collection, and any individuals contacting the Company. Throughout this Privacy Notice, these individuals are collectively referred to as "You" or "your".

If you have any questions or suggestions regarding the Company’s personal data protection practices, or if you wish to exercise your rights under the PDPA, you may contact the Company through the following channels:

2. Persons Authorized to Process Your Personal Data

As the Company has the role and duty to determine the purposes and means of processing your personal data in accordance with the PDPA, the Company acts as the Data Controller of your personal data.

3. Personal Data Collected

General Personal Data

Case of Prospective Customers

The Company collects personal data of prospective customers, including but not limited to the following categories of data:

a) Identification Data: Such as name, surname, and national identification number.

b) Background Data: Such as nationality.

c) Contact Data: Such as telephone number, email address, and physical address.

d) Employment Data: Such as occupation, income, and duration of employment.

e) Other Data: Such as the specific type of loan of interest.

Case of Existing Customers and Related Persons

(Including vehicle users, beneficiaries, witnesses, guarantors, spouses of customers or of persons providing consent, auction winners, referees, contact persons for inquiries or debt collection, and any individuals contacting the Company.)

The Company collects personal data of existing customers and related persons, including but not limited to the following categories of data:

a) Identification Data: Such as name, surname, nickname, national identification number, expiration date, copy of national identification card, signature, and photograph.

b) Background Data: Such as date of birth, age, gender, height, weight, nationality, marital status, and relationship with the customer.

c) Contact Data: Such as telephone number, email address, physical address, copy of house registration, home map and address verification photo.

d) Financial Data: Such as source of income, credit limit, credit or debit card number, and refund amount.

e) Asset Identification Data: Such as motorcycle details, vehicle registration book, photos of residence, and photos of motorcycle.

f) Employment Data: Such as workplace, occupation, position, and income.

g) Other Data: Such as hire-purchase details, application number, contract number, contract date, contract status, auction price, payment and debt collection details, receipt number, insurance details, policy number, insurance certificate number, duration of residence at the address, and voice recordings of conversations

Sensitive Personal Data

In addition to the Personal Data specified above, the Company may process Sensitive Personal Data of existing customers and related persons (including vehicle users, beneficiaries, witnesses, guarantors, spouses of customers or of persons providing consent, auction winners, referees, contact persons for inquiries or debt collection, and any individuals contacting the Company) as follows:

a) Disability Status

b) Health Data

c) Religious Data

4. Methods of Personal Data Collection

Generally, the Company collects Personal Data directly including prospective customers, existing customers, and related persons (such as vehicle users, beneficiaries, witnesses, guarantors, spouses of customers or of persons providing consent, auction winners, referees, contact persons for inquiries or debt collection, and any individuals contacting the Company). However, in certain circumstances, the Company may also collect your Personal Data indirectly from third-party sources.

5. Purposes of Processing Personal Data

Case of Prospective Customers

The Company processes the Personal Data of prospective customers to execute various operations aligned with the scope and purposes of its business activities, including but not limited to:

a) Contacting

b) Marketing

Case of Existing Customers and Related Persons:

(Including vehicle users, beneficiaries, witnesses, guarantors, spouses of customers or of persons providing consent, auction winners, referees, contact persons for inquiries or debt collection, and any individuals contacting the Company.)

The Company processes the Personal Data of existing customers and related persons to execute various operations aligned with the scope and purposes of its business activities, including but not limited to:

a) Credit risk analysis.

b) Consideration of loan approval and contacting relevant parties to verify information for loan approval consideration.

c) Debt collection and asset tracking.

d) Approval of refunds.

e) Seizure of collateral and report preparation.

f) Auction of seized collateral.

g) Operations related to vehicle registration books, such as account closing, mandatory vehicle insurance (Por Ror Bor) renewal, vehicle tax renewal, ownership transfer, notice of vehicle suspension, and preparation of vehicle auction documents.

h) Data storage and backup in the database.

i) Receiving inquiries via the Call Center, email, and the website.

j) Preparation of financial documents, such as issuing receipts for excess payment verification, accounts receivable accounting, accounts payable accounting, and refunds.

k) Storage of data on the website.

The Company relies on the following legal bases and special conditions to process your personal data. Note that the legal bases and special conditions specified below do not apply to all of your personal data processing. The processing of personal data may rely on one or a combination of several legal bases.

1. Contractual Basis: The Company has a duty to process your personal data for the performance of duties under the hire-purchase contract. The personal data required for processing under this basis is mostly the data appearing in Section 3. In the event that you do not provide your personal data to the Company for the specified purposes, the Company may not be able to contact you or enter into a contract with you.
2. Legitimate Interest Basis: In some cases, the Company needs to use your personal data for the legitimate interests of the Company or of third parties. Such legitimate interests must not override your fundamental interests, rights, and freedoms.
3. Consent Basis: In some cases, the Company needs to obtain explicit consent from prospective customers, existing customers, and related persons to process their personal data for communication purposes, including marketing.
4. Legal Obligation Basis: The Company has a duty to process your personal data in accordance with legal obligations, court orders, or any judgments related to the Company’s operations. In the event that you do not provide your personal data to the Company for the specified purposes, there may be legal consequences as prescribed by relevant laws.
5. Compliance with the Law to Achieve Public Interest Purposes: The Company needs to comply with the law to achieve important public interest purposes regarding the collection of disability data of customers who wish to apply for accident insurance.

6. To Whom Does the Company Disclose or Transfer Your Personal Data?

The Company may find it necessary to disclose or transfer your personal data to third parties for the purpose of processing your personal data. Such persons may include the following:

a) Companies within the business group: Srisawad Corporation Public Company Limited, Srisawad Power 2014 Company Limited, Fast Money Company Limited, Srisawad Capital 1969 Public Company Limited, S Leasing Company Limited, and any other affiliated companies.

b) Cloud service providers.

c) Outsourced agencies performing debt collection.

d) Outsourced service providers dealing with vehicle registration books.

e) Car auction companies and the National Credit Bureau.

f) Insurance brokers and insurance companies.

g) Relevant government agencies.

h) Auditing firms.

i) Companies performing document storage.

j) Business partners of the Srisawad Group, including relevant third parties: Chubb Samaggi Insurance Public Company Limited, Generali Insurance (Thailand) Public Company Limited and Thai Paiboon Insurance Public Company Limited.

7. International Transfer of Personal Data

For the purposes specified in this Privacy Notice, the Company may disclose or transfer your personal data to third parties or servers located in foreign countries, which may or may not have personal data protection standards equivalent to those of Thailand. Furthermore, the Company has implemented measures ensuring that your personal data is transferred securely, that the recipients apply appropriate personal data protection standards, and that such transfers of personal data comply with the PDPA.

8. Security Measures for Personal Data Protection

The Company has established technical and administrative measures to prevent the loss, misuse, and unauthorized access, disclosure, or alteration of your personal data. Third parties must also process your personal data in accordance with the Company's security policy.

9. Retention Period of Your Personal Data

The Company will retain your personal data for as long as reasonably necessary to fulfill the scope and purposes specified in this Privacy Notice, and to establish, exercise, or defend legal claims. However, the Company may be required to retain your personal data for a longer period if required by any applicable laws.

10. Your Rights Regarding Personal Data

Subject to the provisions and exceptions of applicable laws, your rights regarding your personal data are as follows:

a) Right to Withdraw Consent: In cases where you have provided explicit consent, you have the right to withdraw such explicit consent at any time by sending a notice of consent withdrawal to the Company.

b) Right to Access Personal Data: You have the right to request access to and a copy of all your personal data that the Company is processing.

c) Right to Data Portability: In cases where the Company maintains a platform that allows you to access your personal data by automated means:

1. You have the right to request that the Company transfer your personal data to another organization by automated means.
2. You have the right to request that the Company transfer your personal data directly to another organization, except where restricted by technical limitations.

d) Right to Object to Personal Data Processing: You have the right to object to the processing activities of your personal data in certain circumstances.

e) Right to Request Erasure of Personal Data: You have the right to request that the Company delete your personal data that the Company is processing, or to render such data anonymously, in the following cases:

1. In cases where your personal data is no longer necessary for the purposes of processing.
2. In cases where you have withdrawn your explicit consent for the Company to process your personal data.
3. In cases where you object to the processing of your personal data which the Company has performed based on legitimate interests, and the Company has no overriding legitimate grounds for processing the personal data.
4. In cases where the personal data processing activity is not in accordance with the law.

f) Right to Request Suspension of Personal Data Processing: You have the right to request that the Company restrict the processing of your personal data in the following cases:

1. In cases where the Company is verifying your request to exercise your right to rectify your personal data.
2. In cases concerning personal data that you have previously requested the Company to delete, but you have subsequently requested the Company to restrict the processing of your personal data instead.
3. In cases where the personal data retention period has ended, but you have requested the Company to restrict the processing of your personal data for legal reasons.
4. In cases where the personal data is undergoing verification regarding an objection to the processing of personal data.

g) Right to Request Rectification of Personal Data: You have the right to correct your personal data so that it is accurate, up-to-date, complete, and not misleading.

Please be informed that the exercise of your rights as specified above is subject to various relevant factors, and the Company may not be able to comply with your request if the Company can rely on a legal basis to continue processing your personal data. In the event that you wish to exercise your rights regarding the protection of your personal data, you may contact the Company through the channels specified above, and the Company will process your request rigorously and promptly.

11. Amendments to the Privacy Notice

The Company may amend this Privacy Notice as deemed appropriate to improve the efficiency of processing your personal data. The Company will notify you if such amendments significantly affect the processing of your personal data or if the Company is required to do so by law.

Privacy Notice for Job Applicants and Related Persons

1. Purpose and Scope

Cathay Leasing Co., Ltd. (the "Company") is committed to performing its duties in accordance with the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). This Privacy Notice outlines the Company’s practices regarding the protection of your personal data (as defined below). It explains the purposes and methods by which the Company collects, uses, discloses, cross-border transfers, and/or otherwise processes (collectively, "processes" or "processing") your personal data. Furthermore, it describes your legal rights regarding your personal data, including data protection rights when you apply for a job with the Company.

This Privacy Notice governs the processing of personal data in activities related to recruitment. All affected parties should thoroughly read, understand, and regularly review this Privacy Notice to remain fully informed about how their personal data is processed.

In this Privacy Notice, the following terms shall have the meanings ascribed below:

"Personal Data" means any information relating to a living individual that enables the identification of such person, whether directly or indirectly.

"Sensitive Personal Data" means any personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union membership, genetic data, biometric data, or any other data that may affect the data subject in a similar manner as prescribed by law.

This Privacy Notice applies to job applicants and related persons (including emergency contacts, persons within the Company known to the applicant, and references), collectively referred to in this Privacy Notice as "You" or "your".

If you have any questions or suggestions regarding the Company’s personal data protection practices, or if you wish to exercise your rights under the PDPA, you may contact the Company through the following channels

2. Persons Authorized to Process Your Personal Data

As the Company has the role and duty to determine the purposes and means of processing your personal data in accordance with the PDPA, the Company acts as the Data Controller of your personal data.

3. Personal Data Collected

General Personal Data

Case of Job Applicants:

The Company collects general personal data of job applicants, including but not limited to the following categories of data:

a) Identification Data: Such as name, surname, nickname, national identification number, signature, and photograph.

b) Background Data: Such as gender, weight, height, age, date of birth, nationality, educational history, vehicle driving ability, military status, marital status, history of litigation or court proceedings, and behavioral history.

c) Contact Data: Such as telephone number, email address, and physical address.

d) Employment Data: Such as work history and resume.

e) Other Data: Such as special abilities.

Case of Other Persons (including emergency contacts, persons within the Company known to the applicant, and references):

The Company collects general personal data of other persons, including but not limited to the following:

a) Identification Data: Such as name, surname.

b) Background Data: Such as relationship with the applicant.

c) Contact Data: Such as telephone number, email address, and physical address.

Sensitive Personal Data

Case of Job Applicants:

The Company collects sensitive personal data of job applicants, including but not limited to the following:

a) Health data : Such as underlying diseases.

b) Disability data.

4. How the Company Collects Your Personal Data

Generally, the Company collects personal data directly from job applicants during the recruitment process. For the personal data of related persons, the Company collects such data indirectly through the job applicant.

5. How the Company Uses Your Personal Data

The Company uses your personal data to carry out various operations according to the scope and purposes of the recruitment process. The Company relies on the following legal bases and special conditions to process your personal data. The legal bases and special conditions specified below do not apply to all of your personal data processing. The processing of personal data may rely on one or a combination of several legal bases.

1. Contractual Basis The Company has a duty to process your personal data to carry out duties during the recruitment process. The personal data required for processing under this basis is mostly the data appearing in Section 3. In the event that you do not provide any personal data to the Company for the specified purposes, the Company may not be able to process your job application effectively or successfully.
2. Legitimate Interest Basis In some cases, the Company needs to use your personal data for the legitimate interests of the Company or third parties in the recruitment process. Such legitimate interests must not override your fundamental benefits, rights, and freedoms.
3. Consent Basis In some cases, the Company needs to obtain explicit consent from job applicants to process sensitive personal data for recruitment activities.

6. To Whom Does the Company Disclose or Transfer Your Personal Data?

In this process, the Company may find it necessary to disclose or transfer the job applicant's personal data to relevant affiliated companies for the purpose of processing your personal data.

7. International Transfer of Personal Data

For the purposes specified in this Privacy Notice, the Company will not disclose or transfer your personal data to third parties or servers located in foreign countries.

8. Security Measures for Personal Data Protection

The Company has established technical and administrative measures to prevent the loss, misuse, as well as unauthorized access, disclosure, or alteration of your personal data.

9. Retention Period of Your Personal Data

The Company will retain your personal data for as long as reasonably necessary to fulfill the scope and purposes specified in this Privacy Notice, and to establish, exercise, or defend legal claims. However, the Company may be required to retain your personal data for a longer period if required by any applicable laws.

10. Your Rights Regarding Personal Data

Subject to the provisions and exceptions of applicable laws, your rights regarding your personal data are as follows:

a) Right to Withdraw Consent: In cases where you have provided explicit consent, you have the right to withdraw such explicit consent by sending a notice of consent withdrawal to the Company.

b) Right to Access Personal Data: You may have the right to request a copy of all your personal data that the Company is processing.

c) Right to Data Portability: In cases where the Company has a platform that allows you to access your personal data by automated means:

1. You may have the right to request the Company to transfer your personal data to another organization by automated means.
2. You may have the right to request the Company to transfer your personal data directly to another organization, except where restricted by technological limitations.

d) Right to Object to Personal Data Processing: You may have the right to object to the processing activities of your personal data based on legitimate interests..

e) Right to Request Erasure of Personal Data: You may have the right to request the Company to delete your personal data that the Company is processing, or to make such data anonymous, in the following cases:

1. In cases where your personal data is no longer necessary for the purposes of processing.
2. In cases where you have withdrawn your consent and/or explicit consent for the Company to process your personal data and/or sensitive personal data.
3. In cases where you object to the processing of your personal data, which the Company has performed based on legitimate interests, and the Company has no overriding legitimate grounds for processing the personal data.
4. In cases where the personal data processing activity is not in accordance with the law.

f) Right to Request Suspension of Personal Data Processing: You may have the right to request the Company to suspend the processing of your personal data in the following cases:

1. In cases where the Company is verifying your request to exercise your right to rectify your personal data.
2. In cases concerning personal data that you have previously requested the Company to delete, but you have subsequently exercised an additional request for the Company to suspend the processing of your personal data instead.
3. In cases where the personal data processing period has ended, but you have requested the Company to suspend the processing of personal data for legal reasons.
4. In cases where it is under the process of verification regarding an objection to the processing of personal data.

g) Right to Request Correction of Personal Data: You may have the right to correct your personal data so that it is accurate and up-to-date.

Please be informed that the exercise of your rights as specified above is subject to various relevant factors, and the Company may not be able to comply with your request if the Company can cite any legal basis to continue processing your personal data. In the event that you wish to exercise your rights regarding the protection of your personal data, you may contact the Company through the channels specified above, and the Company will process your request rigorously and promptly.

11. Amendment to the Privacy Notice

The Company may amend this Privacy Notice as deemed appropriate to improve the efficiency of processing your personal data. The Company will inform you if such amendments significantly affect the processing of your personal data or if the Company is required to do so by law.

Privacy Notice for Business Partners

1. Purpose and Scope

Cathay Leasing Co., Ltd. (the "Company") is committed to performing its duties in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). This Privacy Notice will help you understand the Company’s practices regarding the protection of your personal data (as defined below), explain the reasons and methods by which the Company collects, uses, discloses, transfers to foreign countries, and/or otherwise processes (collectively referred to as "processes") your personal data, and describe the rights you have regarding your personal data, including the right to protect such personal data.

This Privacy Notice applies to the processing of personal data of business partners with whom the Company communicates and enters into contracts. All related parties should read, understand, and review this Privacy Notice regularly in order to have a thorough understanding of the processing of their personal data.

In this Privacy Notice, "Personal Data" means any information relating to a living individual which can identify that person, either directly or indirectly, and "Sensitive Personal Data" means any personal data relating to race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data that may affect an individual in the same manner as prescribed by law.

This Privacy Notice applies to business partners (including individuals associated with juristic persons that are contracting parties) who communicate and enter into contracts with the Company, collectively referred to in this Privacy Notice as "You" or "your".

If you have any questions or suggestions regarding the Company’s practices in protecting your personal data, or if you wish to exercise your rights under the PDPA, you may contact the Company through the following channels:

2. Persons Authorized to Process Your Personal Data

As the Company has the role and duty to determine the purposes and means of processing your personal data in accordance with the PDPA, the Company acts as the Data Controller of your personal data.

3. Personal Data Collected

The Company collects personal data of business partners (including individuals associated with juristic persons that are contracting parties), including but not limited to the following:

a) Identification data, such as name, surname, signature.

4. How the Company Collects Your Personal Data

Generally, the Company collects your personal data directly when you communicate with the Company. However, in some cases, the Company may collect your personal data indirectly through third parties.

5. How the Company Uses Your Personal Data

The Company uses your Personal Data to carry out various activities within the scope and for the purposes of such activities, including but not limited to:

a) Entering into contracts;

The Company relies on the following legal bases to process your personal data. Note that the legal bases specified below do not apply to all of your personal data processing. The processing may rely on one or a combination of several legal bases.

1. Contractual Basis: The Company has a duty to process your personal data to enter into a contract with you. The personal data required for processing under this basis is mostly the data appearing in Section 3. In the event that you do not provide any personal data to the Company for the specified purposes, the Company may not be able to enter into a contract with you.
2. Legitimate Interest Basis: In some cases, the Company needs to use your personal data for the legitimate interests of the Company, such as communicating with you. Such legitimate interests must not override your fundamental benefits, rights, and freedoms.

6. To Whom Does the Company Disclose or Transfer Your Personal Data?

For the purposes specified in this Privacy Notice, the Company will not disclose or transfer your personal data to third parties.

7. International Transfer of Personal Data

For the purposes specified in this Privacy Notice, the Company may disclose or transfer your personal data to third parties or servers located in foreign countries, which may or may not have personal data protection standards equivalent to those of Thailand. Furthermore, the Company has implemented measures ensuring that your personal data is transferred securely, that the recipients apply appropriate personal data protection standards, and that such transfers of personal data comply with the PDPA.

8. Security Measures for Personal Data Protection

The Company has established technical and administrative measures to prevent the loss, misuse, as well as unauthorized access, disclosure, or alteration of your personal data. Third parties must also process your personal data in accordance with the Company's security policy.

9. Retention Period of Your Personal Data

The Company will retain your personal data for as long as reasonably necessary to fulfill the scope and purposes specified in this Privacy Notice, and to establish, exercise, or defend legal claims. However, the Company may be required to retain your personal data for a longer period if required by any applicable laws.

10. Your Rights Regarding Personal Data

Subject to the provisions and exceptions of applicable laws, your rights regarding your personal data are as follows:

a) Right to Access Personal Data: You may have the right to request a copy of all your personal data that the Company is processing.

b) Right to Data Portability: In cases where the Company has a platform that allows you to access your personal data by automated means:

1. You may have the right to request the Company to transfer your personal data to another organization by automated means.
2. You may have the right to request the Company to transfer your personal data directly to another organization, except where restricted by technological limitations.

c) Right to Object to Personal Data Processing: You may have the right to object to the processing activities of your personal data based on legitimate interests.

d) Right to Request Erasure of Personal Data: You may have the right to request the Company to delete your personal data that the Company is processing, or to make such data anonymous, in the following cases:

1. In cases where your personal data is no longer necessary for the purposes of processing.
2. In cases where you have withdrawn your consent for the Company to process your personal data.
3. In cases where you object to the processing of your personal data, which the Company has performed based on legitimate interests, and the Company has no overriding legitimate grounds for processing the personal data.
4. In cases where the personal data processing activity is not in accordance with the law.

e) Right to Request Suspension of Personal Data Processing: You may have the right to request the Company to suspend the processing of your personal data in the following cases:

1. In cases where the Company is verifying your request to exercise your right to rectify your personal data.
2. In cases concerning personal data that you have previously requested the Company to delete, but you have subsequently exercised an additional request for the Company to suspend the processing of your personal data instead.
3. In cases where the personal data processing period has ended, but you have requested the Company to suspend the processing of personal data for legal reasons.
4. In cases where it is under the process of verification regarding an objection to the processing of personal data.

f) Right to Request Correction of Personal Data: You may have the right to correct your personal data so that it is accurate and up-to-date.

Please be informed that the exercise of your rights as specified above is subject to various relevant factors, and the Company may not be able to comply with your request if the Company can cite any legal basis to continue processing your personal data.

In the event that you wish to exercise your rights regarding the protection of your personal data, you may contact the Company through the channels specified above, and the Company will process your request rigorously and promptly.

11. Amendment to the Privacy Notice

The Company may amend this Privacy Notice as deemed appropriate to improve the efficiency of processing your personal data. The Company will inform you if such amendments significantly affect the processing of your personal data or if the Company is required to do so by law.

Privacy Notice for Vendors and Service Providers

1. Purpose and Scope

Cathay Leasing Co., Ltd. (the "Company") is committed to performing its duties in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). This Privacy Notice will help you understand the Company’s practices regarding the protection of your personal data (as defined below), explain the reasons and methods by which the Company collects, uses, discloses, transfers to foreign countries, and/or otherwise processes (collectively referred to as "processes") your personal data, and describe the rights you have regarding your personal data, including the right to protect such personal data.

This Privacy Notice applies to the processing of personal data of business partners with whom the Company communicates and enters into contracts. All related parties should read, understand, and review this Privacy Notice regularly in order to have a thorough understanding of the processing of their personal data.

In this Privacy Notice, "Personal Data" means any information relating to a living individual which can identify that person, either directly or indirectly, and "Sensitive Personal Data" means any personal data relating to race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data that may affect an individual in the same manner as prescribed by law.

This Privacy Notice applies to all vendors and service providers (including directors, shareholders, employees, contact persons, or witnesses of vendors and service providers) who communicate and enter into contracts with the Company, collectively referred to in this Privacy Notice as "You" or "your".

If you have any questions or suggestions regarding the Company’s practices in protecting your personal data, or if you wish to exercise your rights under the PDPA, you may contact the Company through the following channels:

2. Persons Authorized to Process Your Personal Data

As the Company has the role and duty to determine the purposes and means of processing your personal data in accordance with the PDPA, the Company acts as the Data Controller of your personal data.

3. Personal Data Collected

General Personal Data:

The Company collects general personal data of vendors and service providers (including directors, shareholders, employees, contact persons, or witnesses of vendors and service providers), including but not limited to the following:

a) Identification Data: Such as name, surname, signature, national identification number, copy of national ID card, electricity user number, photograph.

b) Background Data: Such as gender, date of birth, nationality

c) Contact Data: Such as address, telephone number, social media accounts, copy of house registration.

d) Financial Data: Such as bank account number, copy of bank account.

e) Asset identification Data: Such as land title deeds.

Sensitive Personal Data:

The Company collects sensitive personal data of vendors and service providers (including directors, shareholders, employees, contact persons, or witnesses of vendors and service providers), including but not limited to the following:

a) Religious data.

b) Health data : Such as blood type.

4. How the Company Collects Your Personal Data

Generally, the Company collects your personal data directly when you communicate with the Company. However, in some cases, the Company may collect your personal data indirectly through contact persons.

5. How the Company Uses Your Personal Data

The Company uses your personal data to carry out various activities, including but not limited to:

a) Communication, entering into contracts, and performing related contractual obligations for the benefit of the head office and branches.

b) Employee training.

The Company relies on the following legal bases to process your personal data. Note that the legal bases and special conditions specified below do not apply to all of your personal data processing. The processing may rely on one or a combination of several legal bases.

1. Contractual Basis: The Company has a duty to process your personal data to communicate or enter into a contract with you. The personal data required for processing under this basis is mostly the data appearing in Section 3. In the event that you do not provide any personal data to the Company for the specified purposes, the Company may not be able to communicate or enter into a contract with you.
2. Legitimate Interest Basis: In some cases, the Company needs to use your personal data for the Company's legitimate interests, such as communicating with you. Such legitimate interests must not override your fundamental benefits, rights, and freedoms.
3. Legal Obligation Basis: The Company has a duty to process your personal data in accordance with any laws related to the Company's operations. If you do not provide any personal data to the Company for the specified purposes, there may be legal consequences.

6. To Whom Does the Company Disclose or Transfer Your Personal Data?

The Company may find it necessary to disclose or transfer your personal data to third parties for the purpose of processing your personal data. Such persons may include:

a) Relevant affiliated companies.

b) Relevant government agencies.

c) Insurance companies.

d) The Company's service providers, such as garages, document storage companies.

7. International Transfer of Personal Data

For the purposes specified in this Privacy Notice, the Company will not disclose or transfer your personal data to third parties or servers located in foreign countries.

8. Security Measures for Personal Data Protection

The Company has established technical and administrative measures to prevent the loss, misuse, as well as unauthorized access, disclosure, or alteration of your personal data. Third parties must also process your personal data in accordance with the Company's security policy.

9. Retention Period of Your Personal Data

The Company will retain your personal data for as long as reasonably necessary to fulfill the scope and purposes specified in this Privacy Notice, and to establish, exercise, or defend legal claims. However, the Company may be required to retain your personal data for a longer period if required by any applicable laws.

10. Your Rights Regarding Personal Data

Subject to the provisions and exceptions of applicable laws, your rights regarding your personal data are as follows:

a) Right to Access Personal Data: You may have the right to request a copy of all your personal data that the Company is processing.

b) Right to Data Portability: In cases where the Company has a platform that allows you to access your personal data by automated means:

1. You may have the right to request the Company to transfer your personal data to another organization by automated means.
2. You may have the right to request the Company to transfer your personal data directly to another organization, except where restricted by technological limitations.

c) Right to Object to Personal Data Processing: You may have the right to object to the processing activities of your personal data based on legitimate interests.

d) Right to Request Erasure of Personal Data: You may have the right to request the Company to delete your personal data that the Company is processing, or to make such data anonymous, in the following cases:

1. In cases where your personal data is no longer necessary for the purposes of processing.
2. In cases where you have withdrawn your consent for the Company to process your personal data.
3. In cases where you object to the processing of your personal data, which the Company has performed based on legitimate interests, and the Company has no overriding legitimate grounds for processing the personal data.
4. In cases where the personal data processing activity is not in accordance with the law.

e) Right to Request Suspension of Personal Data Processing: You may have the right to request the Company to suspend the processing of your personal data in the following cases:

1. In cases where the Company is verifying your request to exercise your right to rectify your personal data.
2. In cases concerning personal data that you have previously requested the Company to delete, but you have subsequently exercised an additional request for the Company to suspend the processing of your personal data instead.
3. In cases where the personal data processing period has ended, but you have requested the Company to suspend the processing of personal data for legal reasons.
4. In cases where it is under the process of verification regarding an objection to the processing of personal data.

f) Right to Request Correction of Personal Data: You may have the right to correct your personal data so that it is accurate and up-to-date.

Please be informed that the exercise of your rights as specified above is subject to various relevant factors, and the Company may not be able to comply with your request if the Company can cite any legal basis to continue processing your personal data. In the event that you wish to exercise your rights regarding the protection of your personal data, you may contact the Company through the channels specified above, and the Company will process your request rigorously and promptly.

11. Amendment to the Privacy Notice

The Company may amend this Privacy Notice as deemed appropriate to improve the efficiency of processing your personal data. The Company will inform you if such amendments significantly affect the processing of your personal data or if the Company is required to do so by law.