Privacy Policy

PRIVACY NOTICE of TOA Paint (Thailand) Public Company Limited And Group companies

Preamble

TOA Paint (Thailand) Public Company Limited (the "Company") and group companies recognize the importance of protecting the personal data of all Participants. The Company has created a personal data protection policy (the "Policy").

This Policy describes the type of personal data that will be used, collected, disclosed and receipt of your personal data, the purpose of collection of personal data, the rights of the owner (data subject) of the personal data and the length of collection, as well as other information related to the management of personal data of the Company.

Objective

1. To comply with the law, such as corporate administration (e.g., incorporation, capital increase/reduction, business restructuring, changes to registered particulars), shareholder and/or board of directors meetings, director nomination and appointment, board of directors meetings, management of shareholder or debenture holder rights and obligations, dividend payments, debenture interest payments, accounting and reporting, auditing, statutory documentation, and the delivery of various documents or notices, as well as fulfilling legal obligations applicable to a private limited company, a public limited company, or a company listed on the Stock Exchange of Thailand (as the case may be).
2. To carry out actions under the application membership agreement and benefits program for you, enabling you to receive privileges, news regarding promotions and benefits, and to participate in membership activities, as well as to manage your user account within the relevant application.
3. For the legitimate interests of the Company or other persons, such as corporate administration, recording images or audio of meetings, security, organizing activities, or sending news or offers for the benefit of shareholders, debenture holders, or directors, including the exercise of legal claims.
4. To prevent or suppress danger to your life, body, or health, or that of others, such as emergency contact or the control of communicable diseases.

Scope

This policy is applicable to all operations. including executives and all employees of the Company and subsidiaries.

Personal data Collected

1. The Company collects personal data of shareholders and debenture holders, as well as their authorized representatives or proxies, when you subscribe for securities or hold shares or debentures. Such data is collected directly from you and through securities brokers or securities registrars. Collected data includes, for example: name, surname, address, telephone number, email, contact channels, nationality, occupation, date of birth, tax identification number, national identification number, juristic person registration number, bank account details, and shareholding quantity.
2. If you apply for membership or are offered membership in the Company’s application and associated privilege programs, the Company collects additional personal data, such as health history, preferences, information regarding accompanying persons, airline membership numbers, and details of your family members. You are responsible for informing such individuals about this Privacy Notice.
3. The Company collects personal data of directors and director nominees. Such data is collected directly from you, as well as from government agencies, regulatory bodies, and publicly available sources, as follows:
• During the recruitment process, the Company collects personal data from national identification cards or other government-issued identity verification documents, such as name, surname, gender, national identification number, passport number, photograph, date of birth, nationality, place of birth, and height.
• For incumbent directors, the Company collects additional personal data, such as details regarding remuneration, training, activities, marital status, information about a spouse or partner (cohabiting as husband and wife), children, parents, siblings, blood type, bank account number, email, educational background, occupation, work history, directorships or positions held in other companies or business entities, attendance records for board, sub-committee, or shareholder meetings, and director remuneration. Information regarding securities holdings, the name of the securities company, the performance of directors, and other information as required by law or good corporate governance principles.
4. When you participate in any of the Company’s activities, the Company may collect additional personal data, subject to obtaining your consent on a case-by-case basis.
5. The Company may need to collect and process sensitive personal data as defined by personal data protection laws—such as health information, food allergies, or drug allergies—in order to facilitate the meetings or activities in which you participate. In such instances, the Company will seek your explicit consent on a case-by-case basis and will make every reasonable effort to implement adequate security measures to protect your sensitive personal data.

Use of Cookies

The Company uses cookies to collect personal data as specified in the Cookie Policy.

Requesting consent and possible consequences of withdrawing consent

1. In the case that the company collect and process personal data based on your consent. You have the right to withdraw your consent to the Company at any time. The withdrawal of this consent will not affect the collection, use, disclosure, or processing of personal data to which you have already given consent.
2. If you withdraw the consent you gave to the company. or refuse to provide certain information It may resolt in the company failed to achieve some or all of the purposes set out in this privacy notice.
3. If you are not yet 20 years of age, before giving consent, please inform the company of the details of the person exercising parental authority. Know so that the company Can proceed with requesting consent from the person exercising parental power as well.

Period of retention of personal data

1. The Company will retain your Personal Data for the period necessary to achieve the objectives of each type of personal data unless the law permits a longer retention period. In the event that the retention period cannot be clearly specified. The Company will retain the information for a period of time that may be expected in accordance with the standards of collection (e.g. a maximum of 10 years of general legal validity).
2. The Company provides an audit system to process the deletion or destruction of personal data when the retention period is overdue or irrelevant or exceeds the need for the purpose of which such personal data is collected.

Disclosure of personal data to other people

1. The Company discloses and shares your personal information with Companies in the TOA group, subsidiaries and companies in the alliance group and
2. Other individuals and legal entities that are not companies in the Company's group. (“Other parties”) to achieve the purposes of collecting and processing personal data as specified in this privacy notice, such as related service providers (such as CCTV camera service providers, event organizers and organizers, Providing technology services (such as cloud systems, blockchain systems, SMS sending services, data analytics services), providers of various IT programs and systems, auditors, government agencies and other persons necessary for the Company Various actions can be taken according to the purposes of collecting and processing personal data as specified in this privacy notice.
3. The Company will require those who receive information to have appropriate measures to protect your information and process such personal information only as necessary and take action to prevent the unlawful use or disclosure of personal information without authority.

Transferring personal data abroad

1. The Company may send or transfer your personal data to affiliates or other persons abroad if necessary for the fulfillment of the contract in which you are a party, or as a contractual act between the Company and other persons or entities for your benefit or for use in the processing of your request prior to entering into a contract or to prevent or suppress life hazards. To comply with the law or to carry out important public interest missions.
2. The Company may store your information on computers, servers or clouds provided by other parties, and may use other parties' programs or applications in the form of ready-made software services and a form of service of the ready-made platform to process your personal data. However, the Company will not allow unrelated persons access to personal data and will require them to have appropriate security measures in place.
3. In the event that your personal data is sent abroad , the Company will comply with personal data protection laws and take appropriate measures to ensure that your personal data is protected and that you can legally exercise the rights relating to your personal data, and the Company will require the person who receives it to take appropriate measures to protect your data and process it only as necessary and take steps to prevent others from unlawfully using or disclosing personal data.

Security measures for personal data

1. The security of your personal data is important to the Company and the Company has adopted appropriate technical and administrative security standards to protect personal data from loss, unauthorized access, to use or disclosure, abuse, modifications and destruction by using security technologies and procedures such as encryption and access restrictions ensure that only authorized persons, access your personal data and that they are trained on the importance of protecting personal data.
2. The Company provides appropriate safe and secure measures. To prevent loss, access, use, change, modify, disclose personal data without unlawful authority, and will provide a review of such measures when necessary or as technology changes to ensure appropriate security.

Rights regarding your personal data

1. You have the right to the laws of personal data protection as follows:
   • Withdraw the consent that the Participants has given to the Company to process the personal data of the Participants.
   • Request to view and copy Participants personal data or request the disclosure of the source of Participants's personal data.
   • Send or transfer personal data in electronic form as required by personal data protection law to other personal data controllers.
   • Object to the collection, use or disclosure of personal data relegated to Participantss.
   • Delete or destroy or make Participants personal data anonymous Suppress the use of Participants personal data
   • Correct Participants's personal data to be accurate, up to date, complete and un misleading.
   • Complain to the Personal Data Protection Commission In the event that the Company or the Processor of Personal Data, including Participantss or contractors of the Company, or the Personal Data Processor violates or fails to comply with personal data protection laws.
2. The Company will consider and inform the results of the consideration according to the request for exercise of the rights of the Participants as soon as 30 days from the date that the Company receives such request, and the rights mentioned above are as required by the Personal Data Protection Law.
3. You can exercise your legal rights by contacting us at 02-335-5555 or e-mail: Data.Privacy@toagroup.com

Information about personal data controllers and personal data protection officers

1. Data Controller: TOA Paint (Thailand) Public Company Limited
   Contact Location: 31/2 3 Bangna-Trad Road, Bangsaothong, Bangsaothong, Samutprakarn 10570
2. If you have any inquiries regarding personal data protection, please contact 02-335-5555 / 02-335-5777 or e-mail: Data.Privacy@toagroup.com

In the event that changes to this Privacy Notice are amended, the Company will announce a new Privacy Notice through this website, where you should check the changes to the Privacy Notice from time to time. The new Privacy Notice will be effective immediately on the date of the announcement.