Privacy Notice

PRIVACY NOTICE
1.

Introduction and Scope

This Privacy Notice (this “Notice”) explains how Daiwa Securities Co., Ltd. Bangkok Representative
Office (hereinafter referred to as the “Company,” “we,” “our,” or “us”) processes the Personal Data(as defined below) of different categories of identifiable persons, such as our clients, suppliers,distributors, contractors, sub-contractors, vendors, service providers of our various services (including,but not limited to, their directors and contact persons), and other persons who contact the Company inthe course of our business.
We recognize the importance of Personal Data protection and are committed to ensuring that yourPersonal Data is processed in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the“PDPA”) based on this Notice.
In this Notice, “Personal Data” means any information relating to a natural person (the “DataSubject”) that enables the identification of such person, directly or indirectly, not including
information of deceased persons.
2.

Acquisition of Personal Data

The Company may obtain your Personal Data directly from you or another source, including, but notlimited to the following:(a) Provided directly by you when we establish a business relationship with you, including
information obtained by business card exchange and provided by you in various documents,
products or services;(b) Provided when you make any contract or agreement for business purpose; and/or(c) Provided when you communicate with us through phone calls, post, emails, and/or othercorrespondence.
In the event that you provide any Personal Data to the Company on behalf of other persons, it is yourresponsibility to confirm that such other persons have consented to the processing and transfer of their
Personal Data in accordance with this Notice (if necessary), and you shall be authorized to receive any
privacy notices and other related information on their behalf. In the event that you provide a minor’s
Personal Data, you shall obtain consent from his/her parent(s) or legal guardian(s).
We do not knowingly collect Personal Data from minors under the age of 20 without the consent of
his/her parent(s) or guardian(s). If we learn that Personal Data of any Data Subject less than 20 yearsof age has been collected, we will obtain the consent of his/her parent(s) or guardian(s), or takereasonable measures, including, but not limited to, to promptly delete such Personal Data from ourrecords.
3.

Personal Data Processed

The Company may collect, use, and disclose Personal Data solely to the extent necessary to conduct
its business activities and only within the scope of the purposes indicated when the Personal Data isobtained. The Personal Data that the Company processes may include the following:
Order(1)Categories of Data
Subjects
Ourclients,suppliers,distributors, contractors, subcontractors, vendors, andPersonal Data Processed
Name, telephone number, email address, job position, address,
passport number and type of VISA (if necessary), credit card
details and any other information you provide us in the course
1Privacy Noticeservice providers (including
their directors and contact
persons)(2)

4.

Other personsof business activities, internet protocol (IP) address, yourlogin data, browser type and version, time zone setting andlocation, browser plug-in types and versions, operating systemand platform and other technology on the devices you use toaccess this website including their usage data.
Name, address, telephone number, email address, internetprotocol (IP) address, your login data, browser type andversion, time zone setting and location, browser plug-in types
and versions, operating system and platform and othertechnology on the devices you use to access this website
including their usage data, etc.

Purposes of Processing

The Personal Data of the following categories of Data Subjects may be processed for the following
purposes:
Order
(1)

(2)

5.

Categories of Data
Subjects
Ourclients,
suppliers,distributors, contractors, subcontractors, vendors, andservice providers (including
their directors and contactpersons)

Other persons

Purpose of Processing(a) to keep customer information and vendor and corporatecompany’s data(b) to provide follow-up services(c) to communicate and respond to inquiries(d) to set up the meeting for corporate and investor(e) to fill in visa letter of invitation form(f) for tax related procedures(g) for contract and dispute management(h) for accounting and financing audit(i) for room booking(j) to manage the payment, fees, and charges(k) to receive goods or services(l) to notify you about changes of our Privacy Notice(m) To use data analytics to improve our website,
products/services,
customer
relationships
andexperiences(a) to conduct ordinary business activities(b) To use data analytics to improve our website,
products/services,
customer
relationships
andexperiences

Legal Grounds for Processing

Your Personal Data shall be processed for the aforementioned purposes in accordance with the PDPA.
In principle, the Company processes your Personal Data only when:(a) the processing is necessary for legitimate interests pursued by the Company as a data controller
or interests of a third party other than the data controller, except where the fundamental rights
and freedoms of the Data Subject regarding the protection of his or her Personal Data override
these interests.
Other than where justified by the legitimate interests above, the Company will usually process
Personal Data where necessary for:(b) the performance of a contract to which the Data Subject is a party or in order to take steps at the2Privacy Notice

request of the Data Subject prior to entering into a contract;(c) compliance with a legal obligation imposed upon the Company;(d) preventing or suppressing a danger to a person’s life, body, or health;(e) the performance of a task carried out in the public interest or in the exercise of official authority
vested in the Company;(f)the achievement of purposes relating to the preparation of historical documents or archives forthe public interest or for purposes relating to research or statistics in which suitable measures tosafeguard the Data Subject’s rights and freedoms are taken; and/or(g) processing based on the Data Subject’s consent. Before or at the time the Personal Data iscollected, the Company shall inform the person concerned about the purpose for which consent
is required, what Personal Data will be collected for processing, the right to revoke consent, thepossible consequences for the Data Subject in automated individual decision-making andprofiling, and the possible transfer to third countries.
Some categories of Personal Data are of sensitive nature, and data protection legislation has imposeda stricter regime for these special categories of Personal Data (“Sensitive Personal Data”). This data
concerns race; ethnic origin; political opinions; cult, religious, or philosophical beliefs; sexual
behavior; criminal records; health data; disability; trade union information; genetic data; biometricdata; and any data that may affect the Data Subject in the same manner. In principle, the processing ofSensitive Personal Data is forbidden unless the Company can refer to an exception. In the limited
number of cases, in which the Company processes Sensitive Personal Data, the Data Subject will be
informed in advance. For more information about the Company’s handling of Sensitive Personal Data,
please refer to “11. Contact Details of the Data Controller.”
6.

Provision of Personal Data to Third Parties

For the purposes stated in “4. Purposes of Processing,” the Company may disclose your Personal Data:(a) to companies and entities within its group, including the foreign entities;(b) to third-party agents/suppliers or contractors bound by obligations of confidentiality, inconnection with the processing of your Personal Data for the purposes described in this Notice(this may include, without limitation, leasing companies, sub-contractors, customers, systemengineer service providers, financial organizations, business advisors, law firms, and otherservice providers); and/or(c) to the extent required by laws, regulations, or court orders (for example, if we are under a duty todisclose your Personal Data in order to comply with a legal obligation).
The Company may transfer your Personal Data to countries outside of Thailand, such as Japan,
European Economic Area (EEA), or the United States. For some countries outside of Thailand that
may not have Personal Data protection laws as comprehensive as those that exist in Thailand, and thesame level of protection as that set forth in the PDPA may not necessarily be guaranteed. In such case,
the Company shall implement the necessary safety management measures pursuant to therequirements of the PDPA.
7.

Data Storage and Retention PeriodYour Personal Data will be stored securely in the Company’s data server or in a third party’s data3

Privacy Noticeserver. The Company will strictly control access to Personal Data and will review such access control
from time to time.
The Company will not keep your Personal Data for longer than is required (i) for the purpose for which
it has been collected or processed, in accordance with the applicable laws, or (ii) to allow the Company
to protect its legitimate rights and interests or those of third parties. To determine the appropriate
retention period for the Personal Data, we shall consider the amount, nature, and sensitivity of the
Personal Data; the potential risk of harm from unauthorized use or disclosure of the Personal Data; thepurposes for which we process the Personal Data and whether we can achieve those purposes throughother means; and the applicable legal requirements.
8.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set oraccess cookies. If you disable or refuse cookies, please note that some parts of this website may
become inaccessible or not function properly.
9.

Security management of personal data

The Company has put in place appropriate security measures to prevent your personal data from being
accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, theCompany has put in place procedures to deal with any suspected personal data breach and shall notify
you and any applicable regulator of a breach where we are legally required to do so.
10.

Rights of Data Subjects

You have the right to access, request the correction or deletion of, request the limitation of processingof, object to the processing of, withdraw consent regarding, and request the data portability of your
Personal Data retained by us. Any request for any of these rights should be submitted to the data
controller specified in “11. Contact Details of the Data Controller.” When we receive a request basedon such rights, we will conduct all necessary investigations without undue delay and provide you or anominated third party with the relevant Personal Data or otherwise respond to such request without
undue delay. If you have given your consent for a specific processing purpose to the Company, you
can withdraw this consent at any time. However, the withdrawal of such consent shall not affect theprocessing of Personal Data for which you have already legally given consent to the Company.
You also have the right to lodge a complaint with the Personal Data Protection Committee if you haveany complaint regarding our processing of your Personal Data.
11.

Contact Details of the Data Controller

To exercise your rights specified in “10. Rights of Data Subjects” or to submit inquiries concerning
this Notice, you can contact the following persons/departments:
Daiwa Securities Co., Ltd. Bangkok Representative Office
Responsible Person:[Tunyalux Hongnoi]
Telephone Number:[02-252-5650 Ext.101]
Email Address:[tunyalux@th.daiwacm.com]

4