Personal Data Policy Statement - Thailand
Data Protection Policy
1. Introduction
The objective of this Data Protection Policy (“Policy”) is to provide you with information with respect
to how CLSA Securities (Thailand) Limited (“CLSA”) (as well as its representatives, Affiliates and/oragents) collects and processes personal information and sensitive personal information in accordancewith applicable laws and regulations on data privacy, including the Personal Data Protection Act B.E.
2562 (2019) (“PDPA”). “Affiliates of CLSA” shall mean any legal entities at any time directly or
indirectly controlling, controlled by or under common control with CLSA, including but not limited toCITIC Securities International Company Limited and CITIC Securities Co. Ltd. References in thisPolicy to “we”, “us” and “our” mean CLSA and, where the context requires, will also include anycompany in the CLSA Group, or persons connected with the CLSA Group. For this purpose, “CLSAGroup” shall mean CLSA together with all Affiliates of CLSA.
We ask that you read this Policy carefully as it contains important information regarding the collection,use, disclosure and transfer (within or outside relevant jurisdiction) of Personal Data (as defined below).
In addition, this Policy is intended to provide you with sufficient information to enable you to notify
and obtain consent from any natural person (a “Relevant Person”) whose Personal Data may have been
provided or may be provided by you or your agent to us from time to time. As used in this Policy, a“data subject” refers to a natural person whose personal, sensitive personal, or privileged information
is processed.
This Policy supplements but does not supersede or replace any other consents you may have previouslyprovided to us in respect of your Personal Data, and your consents herein are additional to any rights
which we may have at law to collect, use or disclose your Personal Data.
2. Personal Data
In this Policy, “Personal Data” refers to any data (including any sensitive personal data) about you or a
Relevant Person, which would identify you or such natural person (as the case may be), or from whichsuch identity can be reasonably and directly ascertained when put together with other information, but
not including the information or data of the deceased natural persona in particular.
Examples of such Personal Data you may provide us include your name, license details, passport orother identification number, telephone number(s), age, marital status, mailing address, email address
and any other information relating to you or any Relevant Person which you have provided or will
provide to us in any forms you may have submitted to us, or via any other form of interaction with you.
3. Purposes for the Collection, Use and Disclosure of Personal Data
Generally, we collect, use, disclose and/or process Personal Data for the following purposes:a)processing applications for account opening, account closing, account maintenance andoperations relating to your account(s);b)

processing your applications or requests for services and/or products;c)providing broker-dealer services and/or products to you, including the services andproducts of external providers;

Personal Data Policy Statement - Thailand Version February 20221d)managing your relationship with us and/or administration of your account with us
including (where you act as agent for another party) those of your underlying
principals;e)carrying out your instructions or responding to your enquiries or feedback;f)conducting identity and/or credit checks, and carrying out customer due diligence andother checks and screenings and ongoing monitoring that may be required under RA
9160 (Anti-Money Laundering Act of 2001), US Foreign Account Tax ComplianceAct (FATCA) or any applicable law, regulation or directive or internal policies andprocedures of CLSA or its Affiliates (including but not limited to those designed tocombat bribery and corrupt practices, money laundering, terrorist financing andfinancial crime);g)

preventing, detecting and investigating fraud, misconduct or any unlawful activities,
whether or not requested by any relevant governmental or regulatory authority, andanalysing and managing commercial risks;h)complying with all applicable laws, regulations, rules, directives, orders, instructions
and requests from any governmental, tax, law enforcement, exchanges, clearing houses
or other authorities (whether local or foreign or whether or not it has judicial or legalauthority);i)managing our infrastructure, business operations and employees, and complying with
our policies and procedures that may be required by applicable laws and regulations
including those relating to risk control, compliance, security, audit, finance andaccounting, human resources, systems and business continuity;j)addressing or investigating any complaints, claims or disputes;k)developing new services and/or products and updating you on our products and services
from time to time;l)unless you have indicated your preference to opt out, providing you with marketing,advertising and promotional information, materials and/or documents relating tobanking, investment, credit and/or financial products and/or services that we may beselling, marketing, offering or promoting, whether such products or services exist now
or are created in the future;m)carrying out research, planning and statistical analysis;n)organizing promotional events, conferences, seminars, and company visits; ando)

enforcing our legal and/or contractual rights against you including, but not limited to,recovering any and all amounts owed to us,(collectively, the “Purposes”)
We may collect Personal Data for the above mentioned Purposes directly from you or indirectly fromother sources (e.g. social media, third party’s online platforms, and other publicly available sources)
and through our Affiliates, service providers, business partners, official authorities, or third parties (e.g.
third-party custodians, sub-custodians, and partner brokers).

Personal Data Policy Statement - Thailand Version February 2022
2

4. Consent
By interacting with us and submitting information to us, or signing up for any products or services
offered by us, you represent and agree that:a)

we shall collect, use, disclose and share Personal Data for the Purposes stated in thisPolicy;b)

we shall be authorised to disclose such Personal Data to our authorised service
providers and relevant third parties in the manner set forth in this Policy and in thePDPA; andc)

each Relevant Person has consented to our collection, use, disclosure and/or process of
his/her Personal Data for the Purposes stated above, and such Relevant Person has been
informed of and has accepted this Policy.

If you do not wish for us to continue to use your Personal Data or the Personal Data provided by you tous for any of the Purposes at any time in the future, you must notify us to withdraw your consent (seeSection 12). Depending on the circumstances, your withdrawal of consent may result in our inability toprovide you with the services and/or products that we have been offering to you, and consequently, may
result in the termination of your relationship and/or accounts with us. The withdrawal of consent will
not affect the lawfulness of the collection, use, and disclosure of your Personal Data based on yourconsent before it was withdrawn.
Where the personal data protection laws of the relevant jurisdictions permit us to collect, use or disclose
the Personal Data without your or the Relevant Person’s consent, such permission granted by law willcontinue to apply.
5. Disclosure, Sharing and Transfer of Personal Data Overseas
Subject to the provisions of any applicable law, Personal Data may be disclosed or transferred to, sharedwith or kept by the following entities, wherever located, for any of the Purposes or for processing for
any of the Purposes:a)other members of the CLSA Group;b)

any third party service providers, including archival management service providers,subject to the provisions of the PDPA; (Upon request by you we may provide you(where available) with the privacy policies of third parties to whom we provide yourPersonal Data.)c)our professional advisers (including lawyers) and agents or third parties necessary for
us performing/providing services to you (including our executing brokers, clearing
houses and settlement agents);d)our auditors (internal and external);e)

any person to whom disclosure is permitted or required by law or any court order;f)

any local or foreign government agencies, regulatory authorities and statutory bodies
having jurisdiction over us; andPersonal Data Policy Statement - Thailand Version February 20223g)

any of their respective successors and assigns.

To the extent that we may need to transfer Personal Data outside the relevant jurisdiction, we shall doso in accordance with the personal data protection law of that jurisdiction to ensure that we provide astandard of protection to the Personal Data so transferred that is comparable to the protection under thatjurisdiction.
6. Retention
Personal Data will be held for as long as it is necessary to fulfil the purpose for which it was collectedor as required or permitted by applicable laws. We shall cease to retain Personal Data, or remove themeans by which the Personal Data can be associated with particular individuals, as soon as it isreasonable to conclude that the purpose for which that Personal Data was collected is no longer being
served by retention of the Personal Data and retention is no longer necessary for legal, regulatory or
business purposes.
7. Data Security
We have taken and will continue to take reasonable efforts to protect Personal Data in our possession
or control by making reasonable security arrangements to prevent unauthorised access, collection, use,disclosure, copying, modification, disposal or similar risks.
While we strive to protect your Personal Data, we cannot ensure the security of any Personal Data which
you may have transmitted to us via methods using an unsecure browser, and we urge you to take every
precaution to protect your Personal Data and use a secure browser.
8. Updates to the Data Protection Policy
We may update this Policy to ensure that it is consistent with our future developments, industry trends
and/or any changes in legal or regulatory requirements. Such changes will be posted on our website.
Such changes to our Policy shall apply from the time that we post the same on this website
https://www.clsa.com/terms-of-business/ . Your continued use of our service will be taken as
acceptance of and consent to the updated Policy.
9. Cookies
A cookie is an alphanumeric identifier which we transfer to your hard drive through your web browser
when you visit our website. It enables our own system to recognise you when you visit our website
again and improve our service to you. The information is used to track visitor use of the website and tocompile statistical reports on website activity. For further information about cookies visit
www.aboutcookies.org or www.allaboutcookies.org. Cookies may also be used to compile aggregate
information about areas of our website that are visited most frequently. This traffic information can beused to enhance the content of our website and make your use of it easier. If you wish to reject ourcookie, you can configure your browser to do so. However, in a few cases some of our website features
may not function if you remove cookies from your browser.
10. Third Party Websites
We have not reviewed any of the websites linked by our website. We will be not responsible for thecontent of any other websites or pages linked to or linking to our website and usage of any of such
linked websites or pages. Such links are provided solely for your convenience and information.
Following links to any other websites or pages shall be at your own risk.
Personal Data Policy Statement - Thailand Version February 20224

11. Rights of the Data Subjects
Under the PDPA, you have the right to: withdraw consent; access the Personal Data and request a copy of Personal Data; request the disclosure of the acquisition of Personal Data that have been obtained without yourconsent; data portability;
 object to the collection, use, or disclosure of his/her Personal Data; restrict to the collection, use, or disclosure of his/her Personal Data; be informed whether Personal Data are being, or have been processed;
 rectification of his/her Personal Data; erasure of his/her Personal Data;
If you would like to exercise any of these rights, you may contact us at the address set out in Section 12
below referencing ‘Data Protection Policy’.
12. Contacting Us
For any queries, clarifications, questions or comments about the collection, use or disclosure of your
Personal Data or this Policy, you may contact us at the address below referencing ‘Data Protection
Policy’:
CLSA Securities (Thailand) Limited
16/F, M Thai Tower All Seasons Place
87 Wireless Rd, Pathumwan, Bangkok
Email: pdpabkk@clsa.com
Telephone: 02-257-4600

Personal Data Policy Statement - Thailand Version February 20225