EXTERNAL DATA PROTECTION POLICY

We at Thai CC Innovation Co., Ltd. (the “Company”) take our responsibilities under the Personal Data
Protection Act B.E. 2562 (2019) (the “PDPA”) and other applicable Personal Data (as defined below)
protection laws and regulations (collectively, the “Law”) seriously. We also recognize the importanceof the Personal Data you have entrusted to us and believe that it is our responsibility to properly
manage, protect and process your Personal Data.
This External Data Protection Policy (this “Policy”) is designed to assist you in understanding how wecollect, use and/or disclose the Personal Data you have provided to us, as well as to assist you in making
an informed decision before providing us with any of your Personal Data.
This Policy shall be effective as of 26, December 2022 and is subject to further changes or revisions(which shall be notified to you.) The Company shall continue to review the effectiveness of this Policy
from time to time.
This Policy applies to the processing of Personal Data by the Company within Thailand and elsewherein the world or processed in the context of our affiliated companies in Thailand. Any breach of the Lawor this Policy will be taken very seriously.
If you, at any time, have any queries on this Policy or any other queries in relation to how we may
manage, protect and/or process your Personal Data, please do not hesitate to contact us at:Thai CC Innovation Co., Ltd.

Email: bangkok@hokkokubank.co.th

TEL: +66(0)2-163-2870

1

INTRODUCTION TO THE LAW

1.1“Personal Data” is defined under the Law to mean data, whether true or not, about anindividual who can be identified from that data, or from that data and other information towhich an organization has or is likely to have access. Common examples of Personal Data that
we collect from you could include names, national ID number, contact information, date ofbirth, nationality, passport number, driver’s license, tax ID number, business card,
occupation/title, place of work, photographs and video images. Please note that the examples
are not exhaustive.

1.2

We will collect your Personal Data in accordance with the Law. In general, before we collectany Personal Data from you, we will notify you of the purposes for which your Personal Data
may be collected, used and/or disclosed, as well as obtain your consent, if necessary, for thecollection, use and/or disclosure of your Personal Data.

1.3

Your rights under the Law are as follows:(a)to access your Personal Data;(b)

to learn of the source of collection of your Personal Data;(c)to revoke consent you have given to us;(d)to request to delete, destroy, or anonymize your Personal Data;(e)to request to suspend use of your Personal Data by us;

1(f)to request for a copy of your Personal Data;(g)to object to collection, use, and disclosure of your Personal Data;(h)to access records of communication with the Company regarding your Personal Data;(i)to lodge complaint to the Company regarding processing of your Personal Data; and(j)to lodge complaint to the overseeing authority for any reason.

2PURPOSES FOR COLLECTION, USE & DISCLOSURE OF PERSONAL DATA

2.1

The Personal Data which we collect from you may be collected, used and/or disclosed for thefollowing purposes:(a)provide consultation service on management strategy, business planning, and othergeneral management issues;(b)provide consultation service on information technology and information systems;(c)provide consultation service on personnel, labor, welfare, education, and training;(d)provide consultation service on establishing a new company and general company’s
operation;(e)

conduct investment and capital contribution review;(f)conduct research and study on economy and business industry;(g)

conduct general work related to the above topics in relation to business, economy,and development;(h)maintain security on data protection;(i)manage enquiries and instructions from you;(j)

conduct customer due diligence and personal identification in accordance with laws,regulations and policies including our internal policies;(k)update you on news and events in relation to the Company’s business;(l)conduct overseas market research and data analysis;(m)report and share your information with our Japanese Head Office, affiliates, andrelated corporations;(n)collect and retain personal data for the purpose of the respective transaction,
registration, license, permission, certification, authorization, acknowledgement,
taxation or any other action to which the government official sign their signature or
execute their authority for or related to the Company;(o)maintain contact records of business partners;(p)enter into a project agreement with business partners to launch new projects andoperate businesses; and(q)make disclosures of your information as permitted or required by applicable law,such as disclosures in connection with investigations, to enforce our rights or fulfil
contractual or statutory obligations.

(collectively, the “Purposes.”) Please note that the list above is not exhaustive, although wehave afforded our utmost ability to provide as complete a list as possible.
2.2

In order to conduct our business operations more smoothly, we may also be disclosing thePersonal Data you have provided to us to our third party service providers, agents, and/or our2

affiliates or related corporations, which may be sited in Thailand, or to relevant government
authorities when there is legal obligation or legitimate interest to do so, for one or more of theabove-stated Purposes. This is because such third party service providers, agents and/oraffiliates or related corporations, or relevant government authorities would be processing your
Personal Data on our behalf for one or more of the above-stated Purposes. We will rely on thesame basis as notified or consented by you for these domestic transfer and processing activities.
In such cases, we will ensure a standard of protection for the Personal Data so transferred thatis comparable to the protection under the Law and our standards.
2.3

In order to conduct our business operations more smoothly, we may also be disclosing thePersonal Data you have provided to us to our third party service providers, agents, and/or ouraffiliates or related corporations, which may be sited outside of Thailand, or to relevant
government authorities when there is legal obligation or legitimate interest to do so, for one ormore of the above-stated Purposes. This is because such third party service providers, agents
and/or affiliates or related corporations, or relevant government authorities would beprocessing your Personal Data on our behalf for one or more of the above-stated Purposes. If
we have contract basis for any such processing, we will rely on such for offshore transfer orprocessing. However, for non-contract basis transfer or processing, we will rely on yourconsent as given in your respective Consent Form. In such cases, we will ensure a standard ofprotection for the Personal Data so transferred that is comparable to the protection under theLaw and our standards.

3SPECIFIC ISSUES FOR THE DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

3.1

We respect the confidentiality of the Personal Data you have provided to us.

3.2

In that regard, we will not disclose any of your Personal Data to any third parties without firstobtaining your express consent permitting us to do so. However, please note that we may
disclose your Personal Data to third parties without first obtaining your consent in certain
situations, including, without limitation, the following:(a)

as a general principle, cases in which disclosure under any other proper basis ispossible;(b)cases in which the disclosure is required based on the applicable laws and/orregulations;(c)cases in which the disclosure is necessary to respond to an emergency that threatens
the life, health or safety of yourself or another individual;(d)cases in which there are reasonable grounds to believe that the health or safety ofyourself or another individual will be seriously affected and consent for the disclosureof the data cannot be obtained in a timely way, provided that we shall, as soon as may
be practicable, notify you of the disclosure and the purposes of the disclosure;(e)cases in which the disclosure is necessary for any investigation or proceedings;(f)cases in which the Personal Data is disclosed to any officer of a prescribed law
enforcement agency, upon production of written authorization signed by the head ordirector of that law enforcement agency or a person of a similar rank, certifying that3the Personal Data is necessary for the purposes of the functions or duties of the officer;
and/or(g)cases in which the disclosure is to a public agency and such disclosure is necessary in
the public interest.

(h)cases in which the disclosure is necessary for the performance of a contract to which
you are a party, or in order to take steps at your request prior to entering the contract.

(i)cases in which the disclosure is necessary for legitimate interests of the Company or
any other juristic persons other than the Company, except where such interests areoverridden by your fundamental rights on your Personal Data.

3.3

The instances listed above are not intended to be exhaustive. For an exhaustive list of
exceptions, you are encouraged to peruse the PDPA.

3.4

In all other instances of disclosure of Personal Data to third parties with your express consent,
we will endeavor to provide adequate supervision over the handling and administration ofyour Personal Data by such third parties, as well as to provide for adequate forms of protection
over such Personal Data.

4REQUEST FOR ACCESS AND/OR CORRECTION OF PERSONAL DATA

4.1

You may request to access and/or correct the Personal Data currently in our possession at any
time by submitting your request through the following methods:
Thai CC Innovation Co., Ltd.
Email: bangkok@hokkokubank.co.th TEL: +66(0)2-163-2870

4.2

For a request to access Personal Data, we will provide you with the relevant Personal Data
within a reasonable time from such a request being made.

4.3

For a request to correct Personal Data, we will undertake the following:(a)

we will correct your Personal Data as soon as practicable after the request has beenmade; and(b)subject to paragraph 4.4, we will use reasonable effort to send the corrected Personal
Data to every other organization to which the Personal Data was disclosed by theorganization within a year before the date the correction was made, unless that otherorganization does not need the corrected Personal Data for any legal or businesspurpose.

4.4

Notwithstanding paragraph 4.3(b), we may, if you so consent, send the corrected Personal Data
only to specific organizations to which the Personal Data was disclosed by us within a year
before the date the correction was made.

4

5REQUEST TO WITHDRAW CONSENT

5.1

You may withdraw your consent for the collection, use and/or disclosure of your Personal Datain our possession or under our control at any time by submitting your request through thefollowing methods:
Thai CC Innovation Co., Ltd.
Email: bangkok@hokkokubank.co.th TEL: +66(0)2-163-2870

5.2

We will process your request within a reasonable time from such a request for withdrawal ofconsent being made, and will thereafter refrain from collecting, using and/or disclosing yourPersonal Data in the manner stated in your request.

5.3

Please note that there may be consequences of withdrawing the consent, which the Company
will determine and notify to you before the withdrawal or as soon as possible after thewithdrawal.

6ADMINISTRATION AND MANAGEMENT OF PERSONAL DATA

6.1

We will take appropriate measures to keep your Personal Data accurate, complete, andupdated.

6.2

We will also take commercially reasonable efforts to take appropriate precautions andpreventive measures to ensure that your Personal Data is adequately protected and secured.
Appropriate security arrangements will be taken to prevent any unauthorized access,collection, use, disclosure, copying, modification, leakage, loss, damage and/or alteration ofyour Personal Data. However, we cannot assume responsibility for any unauthorized use ofyour Personal Data by third parties which are wholly attributable to factors beyond our control.

6.3

We will also take commercially reasonably efforts to ensure that the Personal Data in ourpossession or under our control is destroyed and/or anonymized as soon as it is reasonable toassume that (i) the purpose for which that Personal Data was collected is no longer being servedby the retention of such Personal Data; and (ii) retention is no longer necessary for any otherlegal or business purposes. Our current policy is to generally retain your certain Personal Datafor up to ten years after they cease to be employed, subject to the applicable anonymization
procedures and at all times in accordance with our document retention and disposal policy,
and applicable laws and regulations.

Last Updated on 26, December 20225