Privacy Policy
Bangkok Mitsubishi HC Capital Company Limited (hereinafter the "Company") focus on enhancing thesystem of internal management such as risk management, compliances, and internal audits as one of themost important issue for businesses. The Company recognizes that it is our social responsibility to handle
customer's personal data appropriately and sets out Privacy Policy as follows. In addition, The Company
management and employees observe this policy, and ensures the protection of personal information.
1.

The purpose of collecting personal information shall be clearly indicated, and the collected

information shall be used and/or provided within the scope of the indicated purpose.
2.

Collected personal information shall be managed accurately and kept up to date to the extent

required for the intended purpose.
3.

Collected personal information shall be managed strictly to prevent illegal access, loss, disposal,modification, and leakage; adequate security measures shall be taken.
4.

Individuals may review and edit their own personal information stored by the information provider

after authenticating personal identification following our predefined procedure to the extent appropriate. If
an error is discovered in the retained information after disclosure, it shall be corrected immediately.
5.

Recognizing the importance of protecting personal information, we shall establish an internal

system for protection of personal information by implementing systematic security measures andcontinuously improve them.

Bangkok Mitsubishi HC Capital Company Limited
Mr. Taro Hasegawa
President

PDPA Privacy Policy
Bangkok Mitsubishi HC Capital Company Limited (hereinafter the "Company" or "we") in connection
with the provision of our service (the "Service") to customers, both our existing customers and prospective
customers, including authorized directors, representatives, contact persons and/or employees of ourcustomers and prospective customers (the "Customers") in the Thailand, the Company shall comply with
the Thailand Personal Data Protection Act (the "PDPA"), any amendment, regulations, rules, notifications,and orders in relation to the PDPA which are currently enforced or to be enforced in the future ("applicablelaws"), and therefore hereby establishes this PDPA Privacy Policy in order to appropriately process thepersonal data of Customers in Thailand.
1.

PROCESSING PERSONAL DATA

(1)Definitions" Personal data" means any information relating to an individual, which enables the identification of suchindividual, whether directly or indirectly, but not including the information of the deceased persons inparticular, including, without limitation, names, addresses, dates of birth, telephone numbers, e-mailaddresses.
" Processing" means any collection, use, disclosure or other operation or set of operations which isperformed on personal data or on sets of personal data, whether or not by automated means, such asrecording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, alignment orcombination, restriction, erasure or destruction.
(2)

Types of personal data to be acquired

The types of personal data to be acquired will be specified prior to the provision of the Service by theCompany.
(3)

Purposes of collection and use of personal data

The Company will collect personal data for the following purposes depending on relationship between youand the Company:•(i) To perform a contract with you or your employer or to take steps at your request before entering
into a contract, including to:-Provide information regarding our Services;-

Assist you and answer your requests;-Evaluate if we can offer you the Services and under which conditions (e.g. our credit analysisprocess); and•

Provide Services to our corporate clients of whom you are an employee or representative;(ii) To comply with legal obligations and to report or disclose information to government
authorities as required by laws, including anti-money laundering and combating financing ofterrorism, laws relating to vehicles, land transport and land traffic, laws relating to commission ofoffences relating to computers, foreign exchange control laws, tax laws, and personal dataprotection laws;•(iii) To develop our Services, to improve our risk management, and to defend our legal rights,including:-Proof of transactions;-Fraud prevention;-IT management, including infrastructure management (e.g. shared platforms), business
continuity and IT security;-

Improving the quality of our Services; and-Advertising Services that match with your situation and profile.

•(iv) To evaluate, improve and develop our Services, marketing activities, and sales promotion;•( v) To survey your satisfaction with our Services including our sales personnel’s service quality
and to analyze your preferences, market research and develop our products and services to meetyour requirements;•( vi) To inform you about product or service information, special privileges, marketing campaign
and activities, and sales promotion, to offer our products or services, and to send activity invitation;•( vii) To communicate with you in case of emergency and other notifications without marketing
purpose;•( viii) To monitor security in our premises by using CCTV to collect images of those who contact
us at our premises.

The Company will process the personal data only within the scope of the purposes of collection and useabove.
In the case of processing the Customers' personal data for purposes other than the above, the Company will
notify and obtain consent from you as the data subject under the applicable laws in advance of such new
purposes of use and other matters as required by applicable laws.
By manifesting their intention to consent for any processing activity which relies on consent basis,
Customers will be deemed to have consented to the processing of their personal data by the Company within
the scope of the relevant purposes, and the Company will process the Customers' personal data based onsuch Customers' consent; provided, however, that Customers may withdraw such consent at any time. Evenin that case, this will not affect any legitimate processing performed pursuant to consent before theCustomers' withdrawal thereof.
The personal data that Customers are to provide is necessary in order for the Company to provide theService to the Customers and in some situations, to enable the Company to comply with applicable legal
obligations, and there may be cases in which Customers who have not provided such data will be unable touse Service.
(4)

Retention Period

The Company will retain the Customers' personal data as long as the Company requires such data forachieving the purposes of use specified in this Privacy Policy and will promptly delete the same in the casethat such data is no longer necessary. The criteria used to determine our retention periods include: we retain
the personal data for the duration we have an ongoing relationship with you; or we may retain the personal
data for a longer period as necessary to comply with applicable laws, or to be in accordance with legal
prescription, or to establish, comply with or exercise the rights to legal claims or defend against the rights
to legal claims, or to be comply with, for any other cause, our internal policies and regulations.
(5)Disclosure of personal data

The Company may disclose your personal data in certain circumstances, for the purposes set out in thisPrivacy Policy, to the following third parties:•( i) Subsidiaries, affiliates and any related companies (i.e. (a) a company that holds shares in theCompany and/or a company whose shares are held by the Company, and/or (b) a company whoseshares are held by the company/companies indicated in (a) herein above whether directly orindirectly) for business purposes, internal management, fraud prevention and detection, andundertaking any other activity as set out in this Privacy Policy;•( ii) Government authorities, supervisory authorities or other authorities as stipulated by laws,
including competent official, e.g. courts, police officers, revenue department, department of landtransport and other competent authorities;•(iii) Agencies, contractors/sub-contractors, banks/financial institutions, and/or service providers inrelation to operations of business of the Company, including:-Carriers, document storage and destruction service providers, printing house, marketing
agency, IT development and maintenance companies.

-Auditors, lawyers, tax and legal advisers and any consultants.

-Call Center service companies.

•( iv) Business partners of the Company or other third parties as per your consent or contractual
requirements or legal requirements, as the case may be;(6)

Transfer of personal data outside ThailandThe Company may provide the Customers' personal data to third parties such as the subsidiaries andaffiliates of the Company, cloud vendors and outside contractors of the Company, etc., to implement thepurposes of collection, use and disclosure specified above. Countries located outside Thailand (including,
without limitation, Japan, Singapore, Hong Kong, the same shall apply hereafter) are among the third parties
to whom the Company will disclose the Customers' personal data, and in such case, the Company shallcomply with the requirements under the applicable laws for the purpose of the transfer hereunder, including
the following matters;•(a) In the case that the country in which the third party is located is outside Thailand, such country
does not have the same data protection laws as Thailand, i.e., many of the rights provided to data
subjects in Thailand are not given;•(b) The Customers' personal data will be provided and processed for the purposes specified in 1(3)and 1(5) above by third parties outside Thailand; and•(c) The Customers' personal data will be provided to third parties located outside Thailand.

In addition to the above, in the case that the Company provides the Customers' personal data to a third party
located in a country outside Thailand, the Company will ensure that adequate measures are taken
concerning the protection of the Customers' personal data as required under the applicable laws.
(7)

Rights of Customers

The Customers may request from the Company access to, rectification or erasure of, and restriction ofprocessing of their personal data, may object to the processing of the Customers' personal data, and may
request data portability. Where the Company requests for the Customers’ consent, the Customers may alsowithdraw consent given to the Company for processing of their personal data at any time according to theapplicable laws. The Company accepts such Customers' requests at the contact point set forth in "2. Contact"
below.
The Company may refuse the Customers' requests if the Company deems that there is no basis for such
Customers' requests or if they are deemed excessive. The Customers may raise objections or file a complaint
with the competent official under the applicable laws with regard to the processing of their personal data.

2.

CONTACTIn the event of Customers having any questions or concerns regarding this Privacy Policy or the processingof personal data by the Company, or having any requests concerning the access to, rectification of, erasureof, or restriction of processing of personal data, or regarding data portability, please contact the Company
at the following contact information:
Data Protection Officer
Bangkok Mitsubishi HC Capital Company Limited
26th Fl., Asia Centre Tower 173/35 South Sathorn Road, Thungmahamek, Sathorn, Bangkok 10120
Tel: (0) 2163 6400 ext. 232
Email: dpo@th.mitsubishi-hc-capital.com
3.

UPDATE TO THIS PRIVACY POLICYThe Company regularly reviews and, if appropriate, updates this Privacy Policy from time to time to ensurethat Customers’ personal data is properly protected. In case of any update to this Privacy Policy, theCompany

will

informtheCustomers

through

theCompany's

website.

Pleasevisit

https://www.th.mitsubishi-hc-capital.com from time to time for the updated Privacy Policy.

Published on 25 April 2022.