Privacy Policy and Notice on the Processing of Personal Dataof
THE SHIIZU BANK, LTD., BANGKOK REPRESENTATIVE OFFICEThe Shimizu Bank, Ltd. (the “Bank”) gives importance to the protection of personal data and iswell aware of its duties, with respect to the Bank’s personal data processing activities carried out throughits Bangkok Representative Office, under the Thailand’s Personal Data Protection Act B.E. 2562 (as may beamended or supplemented from time to time) including its implementing and/or supplemental rules,
regulations, notifications, and announcements (the “Data Protection Law”). Therefore, the Bank has
prepared this Privacy Policy and Notice on the Processing of Personal Data (“Policy”) and hereby notifies
the Bank’s collection, use and disclosure of personal data through the Bangkok Representative Office aswell as data subjects’ rights as detailed below, to the data subjects, namely, the Company's business
partners, suppliers, service providers, contractual counterparties, shareholders, persons
visiting/contacting the Bank which are individuals and other relevant individuals, and directors, staffs,
employees and personnel, who are individuals, of the Company’s customers and such organizations.
1.

Definitions“Personal Data”:

Any information relating to an individual which enables theidentification of such individual, whether directly or indirectly, but
not including the information of the deceased person in particular.

“data subject(s)”:Any individual person who can be identified, directly or indirectly,
by Personal Data.

“Bank’s customers,
business partners,
suppliers, service
providers, contractual
counterparties, persons
visiting/contacting theCompany, and otherrelevant persons”:

Individuals who are the Company's existing and/or potential
customers, business partners, suppliers, service providers,
contractual counterparties, persons visiting/contacting theCompany and other individuals relevant to the Company, or
relevant directors, staffs, employees and personnel, who areindividuals, of companies/organizations/legal entities which are
the Company's existing and/or potential customers, business
partners, suppliers, service providers, contractual counterparties,
persons visiting/contacting the Company and other persons
relevant to the Company.

2.

Types of Personal Data collected by the Bank

2.1.

In the Bank’s business operation, the Bank must contact, coordinate, and proceed various actions
with the Bank’s customers, business partners, suppliers, service providers, contractual
counterparties, shareholders, persons visiting/contacting the Bank and other relevant persons.
Therefore, the Bank may collect the following Personal Data concerning such persons, including:






name-surname, address, telephone number, e-mail address, department, position, including
business card;
copy of ID card and/or copy of passport, including ID number and/or passport number;contracts/agreements/evidence of transactions with the Bank;
copy of the first page of bank passbook including bank account number; andCCTV records of all visitors in the office area

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

1/7

2.2.

The Bank does not intend to process any sensitive Personal Data, such as religious belief or blood
type on ID card. The Bank will require you to omit, blind or cross out sensitive Personal Data before
providing a copy of ID card or any other documents to the Bank. In the case where such sensitive
Personal Data still appears on the document, we will blind or cross out such sensitive Personal Data.

3.

Sources of Personal Data

3.1.

The Bank may collect Personal Data directly from the data subjects, from the organizations of thedata subjects or other personnel of such organizations, or the information that are alreadyaccessible by the public.

3.2.

The Bank receives Personal Data from the sources set out above both in written, verbal, and/or
electronic forms, through phone calls, emails, posts, or by the Bank’s searches from the internet orother public sources, or other means.

4.

Collection, use and disclosure of Personal Data, and the purposes and the legal basis thereof

4.1.

The Bank will duly collect, use and/or disclose Personal Data on a limited basis pursuant to the
purposes and the lawful basis set out below, and the procedures in accordance with the Data
Protection Law.

4.2.

The Bank collects Personal Data to use and/or disclose for the following purposes:(1)

To verify the identity and address of the Bank’s customers, business partners, suppliers,
service providers, contractual counterparties, persons visiting/contacting the Bank, and otherrelevant persons;(2)

To prepare and enter into contracts/agreements/evidence of transactions between relevant
persons and the Bank, through its Bangkok Representative Office, including for the
performance of such transactions, and to make claims or complaints in the event of nonperformance by other parties;(3)

To comply with applicable laws (e.g. issuing tax invoices, collecting evidence and preparing
other documents in accordance with taxation laws, etc.);(4)

For internal management and business operation of the Bank as necessary and to the extent
permitted to be carried out through the Bangkok Office, including (without limitation to)provisions of information, suggestion, assistance, cooperation and/or coordination to the
Bank’s customers, business partners, suppliers, service providers, contractual counterparties,
and other relevant persons;(5)

For security purposes;(6)

For the Bank’s accounting and audit;(7)

In case of any future business acquisition, merger and acquisition, or business restructuring of
the Bank (or its parent company), to provide sufficient necessary information to theprospective purchaser(s), the person(s) interested in entering into such merger andacquisition transaction including other relevant person(s) for the relevant due diligenceagainst the Bank, for consideration and for the completion of the business acquisition,
merger and acquisition or business restructuring of the Bank (or its parent company) (if any);
and

(8)

To defend the Bank and proceed with litigation and/or arbitration proceedings (ifany/necessary).

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

2/7

4.3.

The Bank relies on the following lawful basis under the Data Protection Law to collect, use and/or
disclose Personal Data;(1)

The processing is necessary for the performance of a contract/agreement between the Bankand its customer, business partner, supplier, service provider, contractual counterparty,
shareholder, or other relevant person, or for proceeding with a request of such person before
entering into such contract/agreement;(2)

The processing is for compliance with the legal obligations to which the Bank is subject;(3)

The processing is necessary in order to protect the vital interests of the Personnel or any
other natural person; and(4)

The processing is necessary for the purposes of the legitimate interests pursued by the Bankor other persons, except where such interests are overridden by the interests or fundamental
rights and freedoms of the data subjects.

4.4.

In addition, it is necessary for the Bank to obtain certain Personal Data (e.g. name-surname of thecontractual counterparty or the name-surname of the authorized director(s) or attorney(ies) of thecontractual counterparty organization, etc.) in order to enter into relevant contract(s)/agreement(s)with the relevant party(ies). Otherwise, the Bank may be unable to enter into suchcontract(s)/agreement(s).

5.

Retention of Personal Data

5.1.

Retention of Personal Data
The Bank retains Personal Data concerning Personnel in both hard copy form and electronic/soft
copy form. Hard copies will be kept in locked cabinets at the Bangkok Representative Office.
Electronic/soft copies will be stored in the Bank’s internal computer system and cloud services
contracted by the Bank with its server located in Japan, with password requirement for access.
Persons who have access to Personal Data••

Only the responsible staffs/employees in the Bank’s headquarter and the Bank’s Bangkok
Representative Office would have access to the contracts/agreements/evidence oftransactions between the Bank through its Bangkok Representative Office and its customers,
and Personal Data concerning the Bank’s customers.

•

Only the responsible staffs/employees in the Bank’s headquarter and the Bank’s Bangkok
Representative Office would have access to the supplier contracts/agreements and theservice agreements/contracts made through the Bank’s Bangkok Representative Office, andPersonal Data concerning the Bank’s suppliers and service providers.

•

Only the responsible staffs/employees in the Bank’s headquarters, branches, and the Bank’s
Bangkok Representative Office would have access to Personal Data concerning business
partners of the Bank’s Bangkok Representative Office.

•

Only the responsible staffs/employees in the Bank’s headquarter and the Bank’s Bangkok
Representative Office would have access to Personal Data concerning other contractual
counterparties of the Bank’s Bangkok Representative Office, persons visiting/contacting theBank’s Bangkok Representative Office, and other relevant persons.

•

Only the responsible staffs/employees in the Bank’s headquarter and the Chief
Representative of the Bank’s Bangkok Representative Office would have access to the CCTV
records.

The Bank may internally share Personal Data within the relevant departments/units of the Bank’s
Bangkok Representative Office on a need-to know basis and on a case-by-case basis for reasonable

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

3/7

purposes/reasons related to the Bank's business operations, and the Bank may disclose Personal
Data to third parties as specified in paragraph 6 below.
5.2.

Retention period for Personal Data

5.2.1. The Bank will retain Personal Data and documents containing Personal Data for the following
periods:
No.

Type of Data / Document

Period1.

Personal
Data
concerning
customers,
contracts/agreements/evidence of transactions
Forever.
between the Bank, through its Bangkok
Representative Office, and its customers.

2.

Contracts/evidence of other transactions
between the Bank, through its Bangkok Throughout the term of the relevant
Representative Office, and its business partners, contract/agreement and another 10
suppliers,
serviceproviders,
contractual years thereafter.
counterparties, and/or other relevant persons.

3.

Account and documents supporting accounting.

4.

Documents submitted to the Revenue
Department (e.g. information on withholding tax
which may contain ID numbers and names of 10 years from submission date.
relevant persons, etc.) and documents submitted
to other government agencies and officials.

5.

CCTV records

6 ～12months from the collection date.

6.

Other Personal Data concerning the Bank’s
customers, business partners, suppliers, service
providers, contractual counterparties, and otherrelevant persons, and other documents
containing such data.

For so long as the data subject
continues to have a relationship with
the Bank and another 10 years
thereafter.

10 years from account closing date.

5.2.2. If any law with which the Bank must comply requires the Bank to retain any Personal Data or any
document containing such data for a longer period than the relevant period set out in paragraph5.2.1 above, the Bank will retain such Personal Data or document for the period required by law.
5.2.3. If the Bank considers that certain Personal Data and/or documents containing such data may benecessary or important for the Bank’s establishment of a right of claim under the law, compliancewith, or exercise of a right of claim under, the law, or raising of a defense under the law, or may
help the Bank in any potential dispute, claim and/or litigation in any form, the Bank may retain suchdata and/or document for a longer period than the relevant period set out in paragraph 5.2.1 orparagraph 5.2.2.
5.2.4. The Bank will ensure to erase or destroy or anonymize the Personal Data upon the end of therelevant retention period set out above or erase or destroy or anonymize the Personal Data that are
irrelevant or unnecessary as per the purpose of collection of such Personal Data or as requested by
the data subject who is entitled to such request.

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

4/7

6.

Disclosure of Personal Data

6.1.

The Bank may disclose Personal Data to the following persons and entities for the following
reasons:(1)

Government agencies and officials such as the Revenue Department, police offices, or othercompetent government agencies/officials, in order for the Bank to comply with applicablelaws, lawful orders of government agencies or court’s orders to which the Bank is subject, as
well as for investigations of suspicious persons and events.

(2)

Bank in order to make payment of remunerations/compensations to relevant
parties/persons.

(3)Business partners The Bank has business partners who the Bank necessarily provides advice,assistance, cooperation and/or coordination to, and/or enters into contracts/agreements
with, in the Bank’s business operation. Therefore, the Bank may have to disclose certain
Personal Data to the Bank’s business partners.

(4)

Customers In the Bank’s business operation, the Bank has customers who the Bank
necessarily provides advice, assistance, cooperation, coordination, and/or enters into
contracts/agreements with. Therefore, the Bank may have to disclose certain Personal Data
to the Bank’s customers.

(5)

Professional advisor(s) and/or service provider(s) The Bank engages professional advisor(s)and/or service provider(s) e.g. legal advisor, financial advisor, external messengers, etc.
Therefore, the Bank may have to disclose certain Personal Data to such persons, to the extent
necessary for such persons to perform their duties as per the agreements that they have with
the Bank.

(6)

Auditor As the Bank has an independent auditor who audits the Bank’s account, the Bank
must disclose certain Personal Data to the auditor for such purpose.

(7)

Prospective purchaser(s) of the business of the Bank or its parent company, the person(s)interested in entering into the merger and acquisition transaction with the Bank or its parent
company, other person(s) relevant to the future business sale and purchase transaction,
merger and acquisition transaction or business restructuring of the Bank or its parent
company (including their advisor(s) in relation to the relevant transaction) In the future,shareholders, investors, and/or the parent company of the Bank may consider selling theshares in the Bank or the Bank’s business to other person(s) or may consider entering into amerger and acquisition with other person. In the said event, the Bank may have to disclose
certain Personal Data to the prospective purchaser(s), the person(s) interested in entering
into the merger and acquisition transaction, or other person(s) relevant to the futurebusiness sale and purchase transaction, merger and acquisition transaction or businessrestructuring of the Bank or its parent company (including their advisor(s) in relation to therelevant transaction) in order to provide sufficient information for their consideration and forthe completion of the transaction.

(8)

Other person(s) for compliance with the laws and/or as permitted by the Data Protection
Law.

6.2.

In addition, for internal administration purpose, the Bank may have to disclose name-surname,phone number, email address, address, and titles of individual customers and/or of directors, staffs,
employees and personnel of companies/organizations/legal entities which are the Bank's existing
and/or potential customers to the Bank’s headquarter being The Shimizu Bank, Ltd. which is acommercial bank incorporated under the law of Japan and located in Japan.

6.3.

The disclosure of Personal Data mentioned above will be made on a limited basis and the Bank will
disclose the Personal Data and/or documents only to the extent necessary to achieve the lawful

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

5/7

purpose of the disclosure. The Bank will, to the extent practicable, ensure that the persons to which
the Personal Data are disclosed by the Bank will comply with the Data Protection Law.
7.

Personal Data Security Measures
The Bank will implement appropriate measures to secure Personal Data to prevent unauthorized orundue loss, access, use, change, amendment, or disclosure of Personal Data by using technologies
and other methods including the followings:

8.

(1)

The Bank will store Personal Data securely and will classify the types of Personal Data andclearly establish on who has the right to access each type of such data.

(2)

The Bank will set up a system to check and erase, destroy, or anonymize Personal Data as
specified in paragraph 5.2.4 above by appropriate means.

(3)

The Bank will ensure that the Bank’s personnel must enter their individual username and/or
password before accessing and using the Bank's computer system and that such usernames
and passwords are kept strictly confidential.

(4)

The Bank will take steps to prevent other persons to whom the Bank disclose Personal Data
from unauthorized or undue use or disclosure of such data.

(5)

The Bank will notify any data breach incident with respect to Personal Data to the Office of
the Personal Data Protection Committee without delay within the period specified by the
Data Protection Law. If such data breach has a high risk of affecting the rights and freedomsof an individual, the Bank will promptly notify the relevant data subject(s) of the incident witha plan to remedy the damage resulting therefrom without delay.

Data Subject’s Rights
A data subject is entitled to the rights in relation to the Personal Data concerning him/her asprescribed in the Personal Data Protection Law as follows:(1)

Right to Withdraw Consent In case the Bank relies only on a data subject’s consent as its
lawful basis to collect, use and/or disclose Personal Data, the data subject may, at any time,
withdraw his/her consent. The Bank will notify such data subject withdrawing his/her consent
of the effects that may occur as a result of his/her consent withdrawal at the time ofwithdrawal.

(2)

Right of Access A data subject has the right to access and request a copy of Personal Data
concerning him/her which are under the responsibility of the Bank or request the Bank todisclose its acquisition of such Personal Data for which he/she did not give consent.

(3)

Right to Data Portability A data subject has the right to receive Personal Data concerning
him/her from the Bank in case the Bank has made such Personal Data in the format that iscommonly used and readable by automatic machine and can be used and disclosed byautomatic means. A data subject also has the right to request the Bank to send or transfer
the Personal Data in such format to other data controller(s) if it can be done by automaticmeans and/or request to obtain the Personal Data in such format that the Bank sends ortransfers to other data controller(s), unless it is technically unfeasible.

(4)

Right to Object A data subject has the right to, at any time, object to the collection, the use or
the disclosure of Personal Data concerning him/her under certain circumstances prescribedunder the Data Protection Law.

(5)

Right to Erasure A data subject has the right to request the Bank to erase or destroy oranonymize Personal Data concerning him/her under certain circumstances prescribed under
the Data Protection Law.

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

6/7

(6)

Right to Restriction of Processing A data subject has the right to request the Bank for
restriction of its use of Personal Data concerning him/her under certain circumstancesprescribed under the Data Protection Law.

(7)

Right to Rectification A data subject has the right to request the Bank to rectify inaccurate
Personal Data concerning him/her and ensure that the Personal Data concerning him/her is
up-to-date, complete and not misleading.

(8)

Right to Lodge Complaint A data subject has the right to lodge a complaint with thecompetent authority or committee under the Data Protection Law in the event that the Bank
including its employee(s) or contractor(s)/service provider(s) violate or fail to comply with theData Protection Law.

The data subject can contact of the Bank’s Bangkok Representative Office in order to exercise any
right under subparagraphs (1) – (7) above as per the details set out in paragraph 10 below.
9.

Modification of Policy
The Bank may review and revise this Policy on a regular basis as to ensure its consistency with therelevant guidelines and the Data Protection Law and the Bank’s policies. The Bank will notify thedata subjects of such changes to this Policy by publicizing the updated Policy on the Bank’s
website(https://www.shimizubank.co.jp) as soon as possible.

10.

Information about the Bank and contact details
If a data subject has any question or suggestion in relation to the Bank’s protection of Personal Dataor wishes to exercise a right as data subject, please contact the Bank’s Bangkok Representative
Office as per the following contact details:
Bangkok Representative OfficeName:

The Shimizu Bank, Ltd., Bangkok Representative Office.

Address:

13th Floor, Ramaland Building, no.952 RamaⅣ road, Khwaeng
Suriyawongse, Khet Bangrak,Bangkok10500 Thailand

Contact Channels:

Tel: +66(0)2-233-7591
Email: bangkok-rep@shimizubank.jp

Website:https://www.shimizubank.co.jp/

Headquarter
Name:

The Shimizu Bank, Ltd.

Address:

2-1 Fujimicho,Shimizu-ku,Shizuoka-shi,Shizuoka 424-0941 Japan

Website:https://www.shimizubank.co.jp/

This Policy is last updated on June.2023.

Privacy Policy and Notice on the Processing of Personal Data
The Shimizu Bank, Ltd., Bangkok Representative Office

7/7