Privacy Policy and Notice on the Processing of Personal Dataof
THAI SHINMAYWA CO., LTD.
Thai ShinMaywa Co., Ltd. (the “Company”) gives importance to the protection of personal data andthe Company is well aware of its duties under the Thailand’s Personal Data Protection Act B.E. 2562 (as may
be amended or supplemented from time to time) including its implementing and/or supplemental rules,
regulations, notifications, and announcements (the “Data Protection Law”). Therefore, the Company has
prepared this Privacy Policy and Notice on the Processing of Personal Data (“Policy”) and hereby notifies
the Company’s collection, use, and disclosure of personal data as well as data subject’s rights as detailed
below, to the data subjects, namely, the Company's individual customers, manufacturers, suppliers,
vendors, business partners, service providers, contractual counterparties, shareholders, persons
visiting/contacting the Company, and directors, staffs, employees and personnel, who are individuals, ofsuch organizations, and other relevant individuals.
1.

Definitions
Personal Data:

Any information relating to an individual which enables theidentification of such individual, whether directly or indirectly, but notincluding the information of the deceased person in particular.

Data subject(s):Any individual person who can be identified, directly or indirectly, by
Personal Data.

Company’s customers,
manufacturers,
suppliers, vendors,
business partners,
service providers,
contractual
counterparties,
shareholders, persons
visiting/contacting theCompany, and otherrelevant persons

Any individuals who are the Company's existing and/or potential
customers, manufacturers, suppliers, vendors, business partners,
service providers, contractual counterparties, shareholders, persons
visiting/contacting the Company, and other individuals relevant to theCompany, or any relevant directors, staffs, employees, and/or
personnel, who are individuals, of companies/organizations/legal
entities which are the Company's existing and/or potential customers,
manufacturers, suppliers, vendors, business partners, service
providers, contractual counterparties, shareholders, persons
visiting/contacting the Company, and other persons relevant to theCompany.

2.

Types of Personal Data collected by the Company

2.1.

In the Company’s business operation, the Company must contact, coordinate, and proceed various
actions with the Company’s customers, manufacturers, suppliers, vendors, business partners, service
providers, contractual counterparties, shareholders, persons visiting/contacting the Company, andother relevant persons. Therefore, the Company may collect (and/or, by itself, prepare) the following
Personal Data concerning such persons, including:






name-surname, company, department, position, address, telephone number, e-mail address,
photos, including business card;
purchase orders, sales activities, and works;
inquiries made through the Company’s website;
copy of ID card, tax identification card, and/or copy of passport, including ID number, tax
identification number, and/or passport number;contracts/evidence of engagement/hiring, sale and purchase of goods/services, and/or othertransactions with the Company;

Privacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

1/7





copy of the first page of bank passbook including bank account number;income tax returns and withholding tax certificates; andCCTV records via CCTV surveillance cameras installed around and within the Company.

3.

Sources of Personal Data

3.1.

The Company may collect Personal Data from the following sources:(1)

From the data subjects directly;(2)

From the organizations of the data subjects or other personnel of such organizations;(3)

From the information that are already accessible by the public;(4)

By the Company’s preparation by itself (e.g. withholding tax certificates, etc.);(5)

By automated means (e.g. CCTV records, etc.).

3.2.

The Company receives Personal Data from the sources set out above in written and verbal forms,
through phone calls or emails or posts, by the relevant data subject submitting or providing to theCompany, or by the Company’s searches from the internet or other public sources, or otherwise.

4.

Collection, use and disclosure of Personal Data, and the purposes and lawful basis thereof

4.1.

The Company will duly collect, use and/or disclose Personal Data on a limited basis pursuant to the
purposes and the lawful basis set out below, and the procedures pursuant to the Data Protection
Law.

4.2.

The Company collects Personal Data to use and/or disclose for the following purposes:

4.3.

(1)

To verify the identity and address of the Company’s customers, business partners,
manufacturers, suppliers, vendors, service providers, contractual counterparties,
shareholders, persons visiting/contacting the Company, and other relevant persons;(2)

For the Company’s security purpose and crime prevention;(3)

To address the inquiries made through the Company’s website;(4)

To prepare marketing materials and conduct marketing activities;(5)

To enter into and prepare contracts/evidence of the sale of goods and/or services and/or othertransaction agreements/contracts between the relevant persons and the Company, including
for the performance of contracts/agreements, and to make claims or complaints in the eventof non-performance of contracts/agreements;(6)

To comply with applicable laws (e.g. preparing meeting invitation notices, convening
shareholders’ meetings, preparing the minutes of shareholders' meetings, preparing theshareholder register book, and submitting the list of shareholders to the Registrar inaccordance with the Civil and Commercial Code, and issuing tax invoices, collecting evidence
and preparing withholding tax certificates and other documents in accordance with taxation
laws, etc.);(7)

For internal administration and management and business operation of the Company and theCompany’s parent company, including (without limitation to) provisions of suggestion,
assistance, cooperation, and/or coordination to the Company’s customers, manufacturers,
suppliers, vendors, business partners, service providers, contractual counterparties,
shareholders, persons visiting/contacting the Company, and other relevant persons, andconducting satisfaction surveys; and(8)

For the Company’s accounting and audit.

The Company relies on the following lawful basis under the Data Protection Law to collect, use and/or
disclose Personal Data;

Privacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

2/7

(1)

The processing is necessary for the performance of a contract/agreement between the
Company and Company’s customers, manufacturers, suppliers, vendors, business partners,
service providers, contractual counterparties, shareholders, and other relevant persons, or forproceeding with a request of such person before entering into such contract/agreement;(2)

The processing is for compliance with the legal obligations to which the Company is subject;(3)

The processing is necessary for the purposes of the legitimate interests pursued by theCompany or other persons, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subjects;(4)

The data subject has given consent to the processing of his or her Personal Data for one ormore specific purposes; and/or(5)

The processing is necessary in order to protect the vital interests of any person.

4.4.

In addition, it is necessary for the Company to obtain certain Personal Data (e.g. name-surname of
the contractual counterparty or the name-surname of the authorized director(s) or attorney(ies) of
the contractual counterparty organization, etc.) in order to enter into relevant
contract(s)/agreement(s) with the relevant party(ies). Otherwise, the Company may be unable toenter into such contract(s)/agreement(s).

5.

Retention of Personal Data

5.1.

Retention of Personal Data
The Company retains Personal Data in both hard copy form and electronic/soft copy form. Hardcopies will be kept in locked cabinets at the relevant departments. Electronic/soft copies will be
stored in the Company’s internal computer system and internal server owned by the Company’s
parent company, ShinMaywa Industries, Ltd., with its server located in Japan, both with password
requirement for access.
Persons who have access to Personal Data

Only the staffs/employees in the relevant section and the Management of the Company would
have access to Personal Data.

The Company may internally share certain Personal Data within the Company’s relevant departments
on a need-to know basis and on a case-by-case basis for reasonable purposes/reasons related to theCompany's business operations, and the Company may disclose Personal Data to third parties as
specified in paragraph 6 below.
5.2.

Retention periods for Personal Data

5.2.1. The Company will retain Personal Data and documents containing such data for the following periods:
No.

Type of Data / Document

Retention Period

1.

Satisfaction survey (for existing customers)

2.

Account and documents supporting accounting 10 years from account closing date (or untildelivery of account and document to theChief Accounting Inspector in case theCompany ceases its business operation
without liquidation).

3.

CCTV records

Privacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

3 years after completion.

1 week from the date of record.

3/7

No.

Type of Data / Document

Retention Period

4.

Documents submitted to the Revenue 10 years from submission date.
Department (e.g. information on withholding
tax with ID number and name of relevant
persons, etc.), documents submitted to othergovernment agencies and officials

5.

Contact details, name card, name, address, Permanent
telephone number, ID card number, tax ID card
number, and picture of existing customers

6.

Contact details of potential customers

1 year after completion of marketing
campaign

7.

Contact details of contractor/supplier

Until the end of the relationship with thecontractor/supplier5.2.2. Notwithstanding the Personal Data retention periods set out in paragraph 5.2.1 above, if any law withwhich the Company must comply requires the Company to retain any Personal Data or any document
containing such data for a longer period than the relevant period set out in paragraph 5.2.1 above,
the Company will retain such Personal Data or document for the period required by law.
5.2.3. If the Company considers that certain Personal Data and/or documents containing such data may benecessary or important for the Company’s establishment of a right of claim under the law, compliancewith, or exercise of a right of claim under, the law, or raising of a defense under the law, or may help
the Company in any potential dispute, claim and/or litigation in any form, the Company may retain
such data and/or document for a longer period than the relevant period set out in paragraph 5.2.1 orparagraph 5.2.2.
5.2.4. The Company will ensure to erase or destroy or anonymize Personal Data upon the end of therelevant retention period set out above, or erase or destroy or anonymize the Personal Data that isirrelevant or unnecessary as per the purpose of collection of such Personal Data or as requested by
the relevant data subject who is entitled to such request, or erase or destroy or anonymize the
Personal Data for which the relevant data subject has withdrawn his/her consent (only in case thecollection of relevant Personal Data requires consent).
6.

Transfer and/or disclosure of Personal Data

6.1.

The Company may disclose Personal Data to the following persons and agencies for the following
reasons:(1)

Government agencies and officials such as the Revenue Department, the Department of
Business Development, the Ministry of Commerce, or other competent government
agencies/officials in order to comply with applicable laws, lawful orders of government
agencies or court’s orders to which the Company is subject.

(2)Bank in order to process payments to relevant persons.

(3)

Customers In the Company’s business operation, the Company has customers to whom theCompany provides advice, assistance, cooperation, coordination, sale of products and services,
and/or enter into agreements/contracts with; therefore, the Company may have to disclose
certain Personal Data to its customers.

Privacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

4/7

(4)

Business partners, manufacturers, suppliers, vendors, and service providers The Company has
business partners, manufacturers, suppliers, vendors and service providers (e.g. advertising
companies, event agencies and event coordinators of promotional events to which theCompany invites potential and existing customers, etc.) to whom the Company necessarily
hires or engages, and/or provides advice, assistance, cooperation, coordination, and/or enter
into agreements/contracts with, in the Company’s business operation. Therefore, theCompany may have to disclose certain Personal Data to such persons.

(5)

Professional advisor(s) The Company may engage professional advisor(s) e.g. legal advisor,
financial advisor, etc. Therefore, the Company may have to disclose certain Personal Data asnecessary for such professional advisor(s) to perform their duties as per the agreements they
have with the Company.

(6)

Auditor As the Company has an independent auditor who audits the Company’s account, theCompany must disclose certain Personal Data to the auditor for such purpose.

(7)

Public The Company may sometimes promote itself and its products and services through social
media. In doing so, it may disclose photos of its events and activities (which may include photosof participants) to the public.

(8)

Other person(s) for compliance with the laws and as permitted by the Data Protection Law.

6.2.

In addition, for internal administration and record, the Company may disclose names-surnames,business cards, contact details, address, telephone number, ID card number, Tax ID card number,
picture and positions of the Company’s individual customers or the directors, staffs, employees, andpersonnel of the Company’s customers which are companies, entities, and organizations, to theCompany’s parent company being ShinMaywa Industries, Ltd. which is incorporated under the lawof Japan and located in Japan.

6.3.

The disclosure mentioned above will be made on a limited basis and the Company will disclose only
the Personal Data that are necessary to achieve the lawful purpose of the disclosure, and theCompany will, to the extent practicable, ensure that the persons to which the Personal Data aredisclosed by the Company will comply with the Data Protection Law.

6.4.

In the event that the Company must obtain consent from the relevant data subject pursuant to the
Data Protection Law for disclosing any Personal Data to any person(s) set out above, the Company
will request for such consent and must duly obtain such consent from the relevant data subject before
disclosure.

7.

Security measures with respect to Personal Data
The Company will implement appropriate measures to secure Personal Data to prevent unauthorized
or undue loss, access, use, change, amendment, or disclosure of Personal Data by using technologies
and other methods including the followings:(1)

The Company will classify the types of Personal Data and clearly define who has the right toaccess each type of such data.

(2)

The Company will store Personal Data securely.

(3)

The Company will set up a system to check and erase, destroy, or anonymize Personal Data as
specified in paragraph 5.2.4 above by appropriate means.

(4)

The Company will ensure that its personnel must enter their individual username and/or
password before accessing and using the Company's computer system and that such
usernames and passwords are kept strictly confidential.

(5)

The Company will take steps to prevent other persons to whom the Company disclose Personal
Data from using or disclosing such data without authorization or wrongly.

Privacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

5/7

(6)

8.

The Company will notify any data breach incident with respect to Personal Data to the Officeof the Personal Data Protection Committee without delay within the period specified by the
Data Protection Law. If such data breach has a high risk of affecting the rights and freedoms ofan individual, the Company will promptly notify the data subject of the incident with a plan toremedy the damage resulting therefrom without delay.

Data Subject’s Rights
A data subject is entitled to the rights in relation to the Personal Data concerning him/her asprescribed in the Personal Data Protection Law as follows:(1)

Right to Withdraw Consent In case the Company relies only on a data subject’s consent as its
lawful basis to collect, use and/or disclose Personal Data, the data subject may, at any time,
withdraw his/her consent. The Company will notify such data subject withdrawing his/her
consent of the effects that may occur as a result of his/her consent withdrawal at the time ofwithdrawal.

(2)

Right of Access A data subject has the right to access and request a copy of Personal Data
concerning him/her which are under the responsibility of the Company or request theCompany to disclose its acquisition of such Personal Data for which he/she did not giveconsent.

(3)

Right to Data Portability A data subject has the right to receive Personal Data concerning
him/her from the Company in case the Company has made such Personal Data in the format
that is commonly used and readable by automatic machine and can be used and disclosed byautomatic means. A data subject also has the right to request the Company to send or transfer
the Personal Data in such format to other data controller(s) if it can be done by automaticmeans and/or request to obtain the Personal Data in such format that the Company sends ortransfers to other data controller(s), unless it is technically unfeasible.

(4)

Right to Object A data subject has the right to, at any time, object to the collection, the use or
the disclosure of Personal Data concerning him/her under certain circumstances prescribedunder the Data Protection Law.

(5)

Right to Erasure A data subject has the right to request the Company to erase or destroy oranonymize Personal Data concerning him/her under certain circumstances prescribed under
the Data Protection Law.

(6)

Right to Restriction of Processing A data subject has the right to request the Company for
restriction of its use of Personal Data concerning him/her under certain circumstancesprescribed under the Data Protection Law.

(7)

Right to Rectification A data subject has the right to request the Company to rectify inaccurate
Personal Data concerning him/her and ensure that the Personal Data concerning him/her is
up-to-date, complete and not misleading.

(8)

Right to Lodge Complaint A data subject has the right to lodge a complaint with the competentauthority or committee under the Data Protection Law in the event that the Company including
its personnel or contractor(s)/service provider(s) violate or fail to comply with the Data
Protection Law.

The data subject can contact the Company in order to exercise any right under subparagraphs (1) –(7) above as per the details set out in paragraph 10 below.
9.

Modification of Policy
The Company may review and revise this Policy on a regular basis as to ensure its consistency withthe relevant guidelines and the Data Protection Law. The Company will notify the data subjects ofPrivacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

6/7

such changes to this Policy by publicizing the updated Policy on the Company’s website as soon as
possible.
10.

Information about the Company and contact details
If a data subject has any question or suggestion in relation to the Company’s protection of Personal
Data or wishes to exercise a right as data subject, please contact the Company’s Personnel andGeneral Affairs Section (or the section in charge of general affairs and personnel of the Company) as
per the following contact details:
Company’s Name:

Thai ShinMaywa Co., Ltd.

Address:

199, 199/1 Moo 12, Soi Petchakasem 120, Petchakasem Road, Om
Noi, Krathum Baen, Samutsakorn Province 74130, THAILAND

Contact Channels:

Tel.: 0-2420-0089 ext.26
Email: tsmc@shinmaywa.co.jp

Website:https://www.shinmaywa.co.jp/thai/english/index.html
This Policy is last updated in March 2023.

Privacy Policy and Notice on the Processing of Personal Data
Thai ShinMaywa Co., Ltd.

7/7