Personal Data Protection Policy

"Company" means Phol Dhanya Public Company Limited, including its subsidiaries under its control.

"Company Personnel" means the directors, staff and employees of Phol Dhanya Public Company Limited and its subsidiaries and/or companies under its control.

"Customer" means any individual, organization, company, partnership/juristic person, state enterprise or government agency that purchases products and/or uses services of the Company.

"Business Partner" means any company, partnership/juristic person or individual that buys or sells products or services to or from the Company.

"Visitor" means any external person who contacts, visits or conducts any inspection with the Company for purposes other than the purchase or sale of products and services.

"Personal Data" means any information relating to a person that enables the identification of that person, whether directly or indirectly, but excluding information of deceased persons. Examples of personal data include:

1. (1)
   First name and surname, or nickname
2. (2)
   National ID number, passport number, social security card number, driver's license number, taxpayer identification number, bank account number, credit card number
3. (3)
   Address, email, telephone number
4. (4)
   Device information used for networks or tools, such as IP address, MAC address and Cookie ID
5. (5)
   Biometric data, such as facial images, fingerprints, X-ray films, iris scan data and voice recognition data, as well as genetic data
6. (6)
   Information identifying a person's property, such as vehicle registration and land title deeds
7. (7)
   Information that can be linked to the above information, such as date and place of birth, race, nationality, weight, height, location data, medical data, educational data, financial data and employment data
8. (8)
   Performance appraisal data or an employer's opinions on an employee's work
9. (9)
   Records used to monitor a person's activities, such as log files
10. (10)
    Information that can be used to search for other personal data on the internet

"Data" means anything that conveys the meaning of a matter, fact, information or anything else, whether such meaning is conveyed by the nature of the thing itself or through any means, and whether it is made in the form of a document, file, report, book, diagram, map, photograph, drawing, sound recording, computer recording, electronic means or any other means that enables the recorded matter to be displayed

"Sensitive Personal Data" means a user's personal data relating to race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, genetic data, biometric data, facial image, iris or fingerprint data, trade union data, or any other data designated as sensitive personal data by the Personal Data Protection Committee

"Data Controller" means Phol Dhanya Public Company Limited and its subsidiaries

"Data Processor" means a person who processes data for the benefit of or on behalf of the data controller

"Person" means a natural person who is a data subject under this Policy

"Data Protection Officer (DPO)" means a person assigned to provide advice on and monitor operations, and to coordinate and cooperate with the Office of the Personal Data Protection Committee and other relevant agencies

"Sub-Processor" means a person or juristic person appointed by the data processor to further process data

Collection of personal data refers to access to and use of services in software systems and websites, such as accounting software systems and use of the website with or without registering as a member, which are provided for the purposes of the Company's operations, ordering products and services, making inquiries, filing complaints, submitting suggestions, and other necessary matters for which the data subject must provide personally identifiable data, so that the Company can grant rights or benefits for the use of services under the agreed conditions, as well as improve the quality of products and services, conduct marketing of products or services, organize sales promotions, publicize useful information about products and services, conduct research, analysis and market surveys, and compile statistical data to present new products and services

The Company collects, uses, stores and discloses the personal data of data subjects, placing the utmost importance on the accuracy, completeness and currency of the data by lawful and fair means. The Company stores only the data necessary to provide electronic transaction services and to carry out other operations within the Company's authority and operational objectives, only as required by law. The Company will notify data subjects and request their consent before collecting, using and disclosing such personal data, except where required by law and/or in other cases as specified in this Policy

The Company may collect the personal data of data subjects through various channels, as follows

1.1Collected directly from the data subject, for example

1. (1)
   Collection of personal data through completion of personal data forms in paper and/or online format
2. (2)
   Data that the data subject registers with the Company when making inquiries, creating a user account, ordering products from the website, providing suggestions or feedback on products or services via the website, registering to receive news or participate in activities organized by the Company, including via social media, etc. Examples of registered personal data may include first and last name, gender, age, date of birth, address, email, etc. The Company may use this data to contact the data subject regarding the Company's products and services

1.2. Data from Social Media

Where the data subject contacts the Company via social media, the data collected by the Company may include profile data from the social media used by the data subject to which access has been permitted, such as profile pictures, email addresses and friend lists. You are deemed to have permitted the Company to access, collect and use such social media data in accordance with the terms of this Privacy Policy

1.3. Data from the Data Subject's Usage

When you use the Company's website, the Company may collect usage data such as device ID, IP address, location data, browser data, preferred language, date, time and duration of access, purchase data, preferences and other lifestyle-related data, such as hobbies and favorite sports, in order to analyze and understand usage and to present the Company's website and news in line with your needs (unless the data subject opts out of receiving news from the Company). The Company collects this data from all users, whether or not they have a user account or have entered any information on this website

The Company may receive personal data from other sources if the data subject has consented to the disclosure of such data. This includes data from other commercial sources, such as public databases and data-sourcing agents, as well as data from any other person

Data processing means that the Company will process your personal data through operations such as collection, recording, organization, structuring, storage, alteration or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

2.1Processing of Personal Data

The Company processes personal data under the following legal bases

Contract Whether or not the data subject registers as a member, and when using other services, it is essential that the data subject provide data to the Company so that the Company can process such personal data to provide services under the agreed service conditions, and use it to communicate, follow up, notify benefits relating to products or services, and answer questions. If the data subject does not provide such personal data, the Company will be unable to provide services, grant rights and benefits under the conditions, communicate, verify the capacity to enter into a contract, or verify the identity of the data subject, in accordance with Section 24(3) of the Personal Data Protection Act B.E. 2562 (2019)

Consent Where necessary, the Company may use the data subject's personal data for processing to design or develop products and/or services, to present products or services, or to organize the Company's marketing activities, or may collect, use or disclose the data subject's personal data for direct marketing purposes. If the data subject does not wish to consent to this, the data subject may withdraw consent through the Company's contact channels.

Legitimate Interest Where necessary, the Company may use the data subject's personal data for processing for the management and preparation of necessary internal reports, system maintenance to uphold or improve service standards, internal risk management, and internal control and audit, which are necessary for the legitimate interests of the data controller and for use by the data processor, in accordance with Section 24(5) of the Personal Data Protection Act B.E. 2562 (2019).

Legal Obligation Where necessary, the Company may use the data subject's data for processing to comply with the law, such as the Accounting Act B.E. 2543 (2000), the Public Limited Companies Act B.E. 2535 (1992), and other laws under which the Company is required to submit personal data, such as the Civil and Commercial Code, which empowers the courts to order parties to submit documents or information in legal proceedings, in accordance with Section 24(6) of the Personal Data Protection Act B.E. 2562 (2019).

2.2Purposes of Personal Data Processing

The Company defines the purposes of personal data processing as follows:

2.2.1Personal Data of Customers, Business Partners or Visitors

The Company collects and retains such data and will use it for the following purposes:

1. (1)
   Presenting information on products and services, organizing prize competitions and sales promotions, and providing news and information that the data subject has requested to receive
2. (2)
   Responding to inquiries and providing consultation
3. (3)
   Analyzing the effectiveness of advertising media, competitions and sales promotions
4. (4)
   Improving and customizing the website to meet requirements, including evaluating website visit statistics, such as time spent visiting the store, whether or not the data subject has visited before, as well as visits to the Company's branches
5. (5)
   Making the website easier to use, including tailoring the website and products to interests and needs
6. (6)
   Improving the quality of the Company's products and services based on market data and survey results
7. (7)
   Providing product support and maintenance
8. (8)
   Issuing service certificates under product warranties
9. (9)
   Providing membership services
10. (10)
    Providing information services and compiling statistical data
11. (11)
    Reviewing for the purpose of developing and improving products and business strategies
12. (12)
    Performance of contracts

2.2.2Personal Data Relating to Personnel of the Company, Business Partners and Third Parties

The Company will use such data for the following purposes:

1. (1)
   Communication and/or business negotiations
2. (2)
   Data management and processing, such as data on income, receipts, disbursements and payments
3. (3)
   Work relating to contracts and assigned tasks

2.2.3Personal Data of Shareholders

The Company will use such data for the following purposes:

1. (1)
   Treatment of shareholders in accordance with applicable laws and regulations

2.2.4Personal Data Relating to the Employment and Resignation of Company Personnel and Job Applicants

1. (1)
   To establish databases and maintain records (including internships)
2. (2)
   To verify identity and check educational and employment history
3. (3)
   To provide employee benefits
4. (4)
   For the purpose of claiming tax allowances
5. (5)
   For communication, evaluation and relationship management
6. (6)
   For the administration and management of related risks
7. (7)
   For compliance with laws and regulations, as well as the guidelines or requirements of the authorities supervising the Company's operations
8. (8)
   For compliance with the Company's internal operating regulations
9. (9)
   For monitoring, auditing and evaluating the Company's services and managing the Company's relationships

The Company will process personal data in accordance with the Company's policy, such as the data subject's first name, last name, address, contact location, mobile phone number, email and other service usage information.

The Company collects personal data for one or more of the purposes specified in this policy. The Company will retain the data until such purposes have been fulfilled and will not retain the data once the purposes have been achieved, unless the Company is required to do so for legal reasons.

The Company may collect and process the following categories of personal data of the data subject:

Identification data, such as first and last name, national identification number, passport number, date of birth, nationality, gender, photograph and signature

Contact data, such as address, telephone number, email and electronic contact channels

Employment and business data, such as job title, employment history, business partner information, contract information and payment information

Technical and system usage data, such as IP address, log files, system access data and closed-circuit television (CCTV) footage

Sensitive personal data, such as health data, biometric data (facial images, fingerprints) and criminal records. The Company will process such data only where there is a legal basis to do so and will apply a high level of protective measures.

The Company may disclose your personal data to parties such as the Company's auditors, the Company's external inspectors and government agencies as required by law.

The data subject may exercise their legal rights subject to the provisions of the law and the policies currently in effect or as may be amended in the future, as well as the criteria established by the Company. If the data subject is under 20 years of age or is legally restricted in their capacity to perform juristic acts, you may exercise your rights through your father and mother, a person exercising parental authority or an authorized representative, who shall submit the request on your behalf. Your rights are as follows:

5.1Right to Withdraw Consent

The data subject may withdraw consent to the processing of personal data previously given to the Company at any time while the Company holds such personal data.

5.2Right of Access to Personal Data

The data subject may request that the Company provide a copy of such personal data and may request that the Company disclose how it obtained any personal data for which the data subject did not give consent.

5.3Right to Rectification of Personal Data

The data subject may request that the Company correct inaccurate data or complete incomplete data.

5.4Right to Erasure of Personal Data

The data subject may request that the Company erase the data on certain grounds.

5.5Right to Restrict the Use of Personal Data

The data subject has the right to restrict the use of personal data on certain grounds.

5.6Right to Data Portability

The data subject has the right, on certain grounds, to have the personal data provided to the Company transferred to another data controller or to the data subject themselves.

5.7Right to Object to the Processing of Personal Data

The data subject has the right, on certain grounds, to object to the processing of personal data.

5.8Right to Lodge a Complaint with the Competent Authority under Applicable Law

The data subject may exercise this right if the data subject believes that the collection, use and/or disclosure of data has been carried out in a manner that violates or fails to comply with applicable law.

The data subject may submit a request to exercise their rights in writing or through channels designated by the Company. The Company will verify the requester's identity and consider the request within the period prescribed by law. The procedures, methods and forms shall be in accordance with the Company's “Data Subject Access Request Procedure (DSAR Procedure)”.

The exercise of the data subject rights described above may be limited under applicable law, and in certain cases there may be necessary grounds on which the Company may refuse or be unable to fulfill such requests, for example, where required to comply with the law or a court order, for the public interest, or where the exercise of rights may infringe the rights and freedoms of others. If the Company refuses any such request, the Company will also inform the data subject of the reasons for the refusal.

Any request under the above shall be made by the data subject in writing, and the Company will use its best efforts to act on it within a reasonable period, not exceeding the period prescribed by law. The Company will comply with the legal requirements relating to the rights of the data subject.

Limitations on services: where the data subject requests the Company to delete, destroy, restrict or transfer data, objects to processing, requests anonymization of data, or withdraws consent, this may in some cases limit the Company's ability to conduct transactions with or provide services to the data subject, subject to the terms and conditions of consent for the relevant services and/or as prescribed by law.

7.1Technological measures are in place to prevent unauthorized access to computer systems.

7.2Personal data is securely destroyed when it is no longer necessary for legal and business purposes. If the data subject has reason to believe that their personal data has been breached by the Company, please contact the Company through the contact channels specified in these terms and conditions.

The data subject's password is important for their service account. Please use a combination of different numbers, letters or symbols, and do not share your password with others. If the password is shared with others, the data subject shall be responsible for all actions taken in their name or through their service account and for the consequences thereof. Failure to maintain control of the password may result in loss of control over personal data or other information submitted to the Company, and the data subject may be bound by any juristic act performed in their name. Therefore, if the password is disclosed or ceases to be confidential for any reason, or there is reason to believe that it has been disclosed or is no longer confidential, the data subject should contact the Company to change the password. In addition, please log off from the service account and close the browser every time a public computer is used.

7.3Personal data in paper form is stored in lockable filing cabinets accessible only to authorized persons.

7.4Personal data stored on computer devices or information systems must be password-protected, with the password known only to the custodian.

7.5Persons accessing personal data may add data but may not arbitrarily delete, modify or remove it without approval from the data controller.

The Company discloses details of personal data only upon request by the data subject, their successors, heirs, statutory representatives or legal guardians, who may submit requests in accordance with the rights of the data subject. The Company will complete such requests within a reasonable period, not exceeding the period prescribed by law.

Where the data subject, their successors, heirs, statutory representatives or legal guardians object to the collection, accuracy or any action concerning personal data, such as a request to update, correct or delete personal data, the Company will record such objection as evidence.

The Company does not disclose personal data to third parties. However, personal data may be shared, to the extent consented to by the data subject, with trusted third parties, who may be located in Thailand or abroad, as follows:

9.1The Company's advertising, marketing or sales promotion agents, for analyzing the effectiveness of advertising, marketing and sales promotion, including the Company's subsidiaries, branches and business partners in Thailand and abroad.

9.2Third parties responsible for delivering products or providing services, such as delivery of goods or parcels ordered through any online channel.

9.3Third parties to whom the Company has obtained the data subject's consent to disclose data.

9.4Law enforcement authorities or government agencies with the authority to request disclosure of data.

9.5Website analytics providers, such as Google.

The data controller may send or transfer the data subject's data abroad in the following cases:

10.1The destination country or international organization receiving the personal data has adequate personal data protection standards in accordance with the laws, rules and regulations on personal data protection.

10.2. Consent has been obtained from the data subject, who has been informed of and acknowledges the personal data protection standards of the destination country or international organization receiving the data

10.3. It is for compliance with the law

10.4. It is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the request of the data subject prior to entering into such contract

10.5. It is for the performance of a contract between the data controller and another person for the benefit of the data subject

10.6. It is to prevent or suppress a danger to the life, body or health of the data subject or any other person when the data subject is incapable of giving consent at that time

10.7. It is necessary for carrying out a task in the substantial public interest

11.1. The Company shall engage personal data processors under a Data Processing Agreement (DPA) that clearly sets out their duties, liabilities and data protection measures.

11.2. The appointment of a Sub-Processor requires the Company's written approval, and the data processor shall be liable for the acts of the Sub-Processor as if they were its own acts.

11.3. Audit or assessment of compliance with data protection measures: the Company has the right to audit or assess the compliance of data processors and Sub-Processors with data protection measures at appropriate intervals.

11.4. The procedures and methods for selecting, overseeing and assessing data processors shall be in accordance with the Company's “Processor & Sub-Processor Management Procedure.”

The Company has established the following principles and governance framework for handling personal data breaches in accordance with the Personal Data Protection Act B.E. 2562 (2019) and the guidelines of the Office of the Personal Data Protection Committee:

12.1. Detection and Assessment of Incidents

Upon any incident or suspicion of unlawful access to, use, disclosure, loss, alteration or destruction of personal data, the Company shall, without delay, investigate the facts and assess the nature of the incident, the scope of the affected data and the level of risk to the rights and freedoms of data subjects.

12.2. Notification to the Office of the Personal Data Protection Committee

Where a personal data breach poses a risk to the rights and freedoms of data subjects, the Company shall notify the Office of the Personal Data Protection Committee (PDPC Office) without delay and within seventy-two (72) hours of becoming aware of the breach, providing at least the following details: (1) the nature of the breach; (2) the categories and volume of the affected data; (3) the potential impact; and (4) the measures taken or to be taken to remedy the breach and prevent recurrence.

12.3. Notification to Data Subjects

Where a personal data breach poses a high risk to the rights and freedoms of data subjects, the Company shall notify the data subjects without delay through appropriate channels that allow direct contact, such as telephone, email, SMS, registered mail, the Company's website or other communication channels the Company normally uses to contact data subjects. The notification shall specify the nature of the breach, the potential risks, measures to prevent or mitigate damage, and the contact details of the Company or the Data Protection Officer (DPO).

12.4. Oversight and Review

The Company shall require executives and relevant units to regularly oversee, monitor and review the personal data breach response plans and measures to ensure consistency with the law and the guidelines of the Office of the Personal Data Protection Committee. The procedures, methods and forms used for receiving reports, investigating, assessing risks, notifying the Office of the Personal Data Protection Committee within 72 hours and notifying data subjects shall be in accordance with the Company's “Incident Response Procedure.”

13.1. Deletion or Destruction of Data

The Company shall delete or destroy personal data using appropriate and secure methods to prevent unauthorized access, recovery or reuse of the data.

13.2. Anonymization of Data

Where personal data can no longer identify the data subject, or where the Company needs to retain data for statistical analysis, research or system development, the Company may anonymize the data so that it can no longer be linked back to the data subject.

13.3. Recordkeeping

Any deletion, destruction or anonymization of data shall be recorded as evidence and shall comply with the retention periods specified in the Record of Processing Activities (ROPA) and the Company's “Data Retention and Disposal Procedure.”

To ensure that personal data protection is carried out systematically, effectively and verifiably, the Company has prepared guidelines and procedures separate from this Policy that set out detailed steps, methods and operating processes, comprising at least the following documents:

1. (1)
   Procedure for the Exercise of Data Subject Rights (DSAR Procedure)
2. (2)
   Personal Data Breach Response Procedure (Incident Response Procedure)
3. (3)
   Processor & Sub-Processor Management Procedure
4. (4)
   Data Retention and Disposal Procedure
5. (5)
   Cross-Border Personal Data Transfer Procedure
6. (6)
   Data Protection Impact Assessment Procedure (DPIA Procedure)

The above procedures shall be deemed internal documents of the Company and form part of its personal data protection governance framework. Company personnel, data processors and sub-processors must strictly comply with them. In the event of any discrepancy or conflict between this Policy and the procedures, this Policy shall prevail, and the procedures shall be interpreted in accordance with this Policy and the personal data protection laws.

The Company reserves the right to amend this Personal Data Protection Policy as necessary and appropriate, or at least once a year, to ensure consistency with applicable guidelines, regulations and other relevant laws. Any amendments will be announced and disclosed on the Company's website or by other appropriate means.

Personal data is retained for the duration of the data subject's status as Company personnel, a business partner, customer, visitor or other relevant third party, member or contracting party, and for no longer than 10 years for those who have provided data to the Company for their own benefit.

If data subjects have any suggestions or inquiries regarding the collection, use and/or disclosure of personal data, including requests to exercise their rights under this Policy, they may contact the Company through the following channels:

Data Controller and/or Data Protection Officer (DPO) Phol Dhanya Public Company Limited, 1/11 Lam Luk Ka Road, Lat Sawai Subdistrict, Lam Luk Ka District, Pathum Thani 12150 Tel: 02-791-0111 E-mail: dpo@pdgth.com Business hours: 08:00-17:30 (excluding Saturdays, Sundays, government holidays and public holidays)

This Personal Data Protection Policy has been prepared in accordance with the Personal Data Protection Act B.E. 2562 (2019) and was approved by the Board of Directors on 19 September 2026.

The Company needs to collect the following personal data from you:

Personal information, such as first name, surname, age, date of birth, photograph, nationality, occupation, national ID number, passport and position.

Contact information, such as address, telephone number, email, social media account details and workplace.

Account information, such as user accounts and usage history.

Information used as supporting evidence when applying for the Company's services, such as copies of national ID cards, copies of passports and copies of company certificates.

Transaction and financial information, such as purchase history of the Company's products and/or services, bank account details, credit card numbers, and the front and back of credit cards.

Technical information, such as IP Address, Cookie ID and website activity history (Activity Log).

Sensitive personal data that the Company may collect, such as health data, genetic data and biometric data, including sensitive personal data appearing on identification documents, namely religion and physical appearance. The Company will process sensitive personal data only with your explicit consent, unless otherwise permitted by law.

The Company collects and receives personal data through the following channels:

Personal data provided directly by the data subject to the Company: The Company collects and receives personal data, which may be in the form of documents or electronic data, entered on forms or on online platforms designated by the Company, as well as through entering into contracts and submitting documents containing your personal data to the Company.

Personal data automatically collected by the Company from data subjects: The Company may automatically collect your personal data through various channels, such as cookies or other similar technologies. For further details, please refer to the Cookie Policy.

Personal data received by the Company from external parties: The Company may receive your personal data from third parties and/or any other persons acting as data controllers or data processors, where the Company believes in good faith that such persons are entitled to process the personal data and to disclose it to the Company. This may include, but is not limited to, data received through the following channels:

Social networks, social media sources or other public sources, and third-party online platforms

Government agencies, including any persons acting on behalf of such agencies

Information obtained through telephone and email interactions, participation in Company activities, and information obtained from or related to the Company's service registration process

The Company collects, uses or discloses your personal data on the basis of legal obligation, contract and legitimate interest for the following purposes:

• To support contracts, agreements and conditions
• To perform contracts, agreements and conditions (Terms and Conditions)
• For the Company's legitimate interests in improving its products, services or user experience
• For the Company's internal administration and management
• For marketing and sales promotion
• For after-sales service
• To collect feedback
• To make payments for products or services
• To comply with the laws and regulations of government authorities

The Company will retain your personal data for as long as reasonably necessary for the purposes of collecting, using or disclosing personal data as specified in Section 3. The criteria used to determine the retention period include the period during which the Company maintains a relationship with you or continues to provide benefits to you. The Company may further retain the data for such period as necessary to comply with the law or the applicable statute of limitations, for the establishment, compliance with or exercise of legal claims, or the defense of legal claims, or for other reasons in accordance with the Company's internal policies and requirements.

Subject to the provisions of the law and the relevant legal exceptions, you have the following rights and may request to exercise them through the channels specified by the Company in Section 12. Details of your rights are as follows:

Right to Withdraw Consent

Where you have given consent to the Company to process your personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into force, you have the right to withdraw your consent at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits you.

Right to Access and Obtain a Copy of Personal Data

You have the right to access and/or obtain a copy of your personal data under the Company's responsibility, and to request disclosure of the source of any personal data collected by the Company without your consent. The Company, however, reserves the right to refuse your request on legal grounds or pursuant to a court order, or where the exercise of your right may adversely affect the rights and freedoms of others.

Right to Data Portability

You have the right to receive your personal data from the Company and to request that the Company send or transfer such data to another data controller. The exercise of this right is subject to the conditions prescribed by law.

Right to Object to the Processing of Personal Data

You have the right to object to the collection, use or disclosure of personal data relating to you, unless the Company has lawful grounds to refuse your request.

Right to Erasure or Destruction of Personal Data

You have the right to request that the Company erase or destroy your personal data, or anonymize it so that it can no longer identify you as the data subject. The exercise of this right is subject to the conditions prescribed by law.

Right to Restrict Processing of Personal Data

You have the right to request that the Company restrict the use of your data in the following cases:

• During the period in which the Company is verifying a request from the data subject to rectify personal data so that it is accurate, complete and up to date.
• Your personal data has been collected, used or disclosed unlawfully.
• When your personal data is no longer necessary to retain for the purposes notified by the Company, but you wish the Company to continue retaining it for the exercise of your legal rights.
• During the period in which the Company is establishing the lawful grounds for collecting your personal data, or verifying the necessity of collecting, using or disclosing personal data in the public interest, as a result of your exercise of the right to object to the collection, use or disclosure of personal data.

Right to Rectification of Personal Data

If you find that your personal data is inaccurate, incomplete or out of date, you have the right to request that it be rectified so that it is accurate, up to date, complete and not misleading.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Personal Data Protection Committee or the competent officials under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with said Act. However, we kindly ask that you first contact the Company so that the Company has the opportunity to learn the facts, clarify any issues and address your concerns at the earliest opportunity.

The Company may disclose your personal data, for the specified purposes, to others with your consent or as permitted by law, to the following persons and entities:

• Telecommunications regulatory authorities, namely the Office of the National Broadcasting and Telecommunications Commission (Office of the NBTC)
• Government agencies, such as the Revenue Department and the Anti-Money Laundering Office
• Other external entities or third parties (in Thailand or elsewhere) in connection with subpoenas, court orders, or other legal processes or requirements under Thai law
• Executives and employees, only to the extent relevant and necessary
• Service providers and personal data processors assigned or engaged by the Company to manage or process personal data on the Company's behalf in providing various services, including those acting on behalf of or jointly with the Company to carry out the relevant purposes specified in this notice, who need to receive your personal data, such as information technology services, data recording services, or any other services that may benefit you or relate to the Company's business operations, where disclosure of your personal data is reasonably necessary to achieve the Company's business objectives
• Any other persons or entities to which you have consented to the disclosure of your personal data

The Company will require recipients of the data to have appropriate measures to protect your data, to process such personal data only to the extent necessary, and to take steps to prevent unauthorized or unlawful use or disclosure of personal data. Processing will be carried out only for the purposes set out in this policy or other purposes permitted by law. Where the law requires the consent of the data subject, the Company will obtain such consent from the data subject in advance.

The Company has put in place appropriate personal data security measures, covering administrative, technical and physical safeguards for access to and access control of personal data, in order to maintain the confidentiality, integrity and availability of personal data and to prevent the loss, unauthorized or unlawful access, use, alteration, modification or disclosure of personal data. The Company will review such measures when necessary or when technology changes to ensure effective and appropriate security, in accordance with applicable law.

Where the Company sends or transfers your personal data abroad, the Company will take steps to ensure that the destination country, international organization or overseas recipient has adequate personal data protection standards, or that the sending or transfer of personal data complies with the criteria prescribed by the PDPA. In some cases, the Company may request the data subject's consent for such sending or transfer of personal data abroad.

The Company's website may display third-party advertisements to facilitate the Company's services, such as Google AdSense and BuySellAds. These third parties may access your personal data solely to perform these activities and are obligated not to disclose or use it for any other purpose.

The Company will not use automated decision-making without human oversight, including profiling, in a manner that significantly affects you.

The Company may send information or newsletters to your email address to offer content that may interest you. If you no longer wish to receive communications from the Company by email, you may click “Unsubscribe” in the email link or contact the Company by email.

To make your user experience more complete and efficient, the Company may use cookies or similar technologies to improve access to products or services, deliver relevant advertising and track your usage. The Company may use cookies to identify and track website users and their access to the Company's website. Where the Company uses cookies and you do not wish to have cookies on your computer, you may set your browser to refuse cookies before using the Company's website.

If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach and the remedial measures without undue delay through channels such as its website, text message (SMS), email, telephone, or letter.

If you have questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or wish to make a complaint, please contact the Company or its Data Protection Officer (DPO) as follows:

Data Controller / Data Protection Officer (DPO) Phol Dhanya Public Company Limited Telephone: 02-791-0111 Email: dpo@pdgth.com

The Company needs to collect the following personal data from you:

Personal information, such as first name, surname, age, date of birth, photograph, nationality, occupation, national ID number, passport and position.

Contact information, such as address, telephone number, email, social media account details and workplace.

Account information, such as user accounts and usage history.

Information used as supporting evidence when applying for the Company's services, such as copies of national ID cards, copies of passports and copies of company certificates.

Transaction and financial information, such as purchase history of the Company's products and/or services, bank account details, credit card numbers, and the front and back of credit cards.

Technical information, such as IP Address, Cookie ID and website activity history (Activity Log).

Sensitive personal data that the Company may collect, such as health data, genetic data and biometric data, including sensitive personal data appearing on identification documents, namely religion and physical appearance. The Company will process sensitive personal data only with your explicit consent, unless otherwise permitted by law.

The Company collects and receives personal data through the following channels:

Personal data provided directly by the data subject to the Company: The Company collects and receives personal data, which may be in the form of documents or electronic data, entered on forms or on online platforms designated by the Company, as well as through entering into contracts and submitting documents containing your personal data to the Company.

Personal data automatically collected by the Company from data subjects: The Company may automatically collect your personal data through various channels, such as cookies or other similar technologies. For further details, please refer to the Cookie Policy.

Personal data received by the Company from external parties: The Company may receive your personal data from third parties and/or any other persons acting as data controllers or data processors, where the Company believes in good faith that such persons are entitled to process the personal data and to disclose it to the Company. This may include, but is not limited to, data received through the following channels:

Social networks, social media sources or other public sources, and third-party online platforms

Government agencies, including any persons acting on behalf of such agencies

Information obtained through telephone and email interactions, participation in Company activities, and information obtained from or related to the Company's service registration process

The Company collects, uses or discloses your personal data on the basis of legal obligation, contract and legitimate interest for the following purposes:

• To support contracts, agreements and conditions
• To perform contracts, agreements and conditions (Terms and Conditions)
• For the Company's legitimate interests in improving its products, services or user experience
• For the Company's internal administration and management
• For marketing and sales promotion
• For after-sales service
• To collect feedback
• To make payments for products or services
• To comply with the laws and regulations of government authorities

The Company will retain your personal data for as long as reasonably necessary for the purposes of collection, use, or disclosure specified in Section 3. The retention period is determined by factors including the duration of the Company’s relationship with you or the period during which the Company provides you with benefits. The Company may retain the data for a further period as necessary to comply with the law or applicable limitation periods; to establish, exercise, or defend legal claims; or for other reasons under the Company’s internal policies and requirements.

Subject to the provisions of the law and the relevant legal exceptions, you have the following rights and may request to exercise them through the channels specified by the Company in Section 12. Details of your rights are as follows:

Right to Withdraw Consent

Where you have given consent to the Company to process your personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into force, you have the right to withdraw your consent at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits you.

Right to Access and Obtain a Copy of Personal Data

You have the right to access and/or obtain a copy of your personal data under the Company's responsibility, and to request disclosure of the source of any personal data collected by the Company without your consent. The Company, however, reserves the right to refuse your request on legal grounds or pursuant to a court order, or where the exercise of your right may adversely affect the rights and freedoms of others.

Right to Data Portability

You have the right to receive your personal data from the Company and to request that the Company send or transfer such data to another data controller. The exercise of this right is subject to the conditions prescribed by law.

Right to Object to the Processing of Personal Data

You have the right to object to the collection, use or disclosure of personal data relating to you, unless the Company has lawful grounds to refuse your request.

Right to Erasure or Destruction of Personal Data

You have the right to request that the Company erase or destroy your personal data, or anonymize it so that it can no longer identify you as the data subject. The exercise of this right is subject to the conditions prescribed by law.

Right to Restrict Processing of Personal Data

You have the right to request that the Company restrict the use of your data in the following cases:

• During the period in which the Company is verifying a request from the data subject to rectify personal data so that it is accurate, complete and up to date.
• Your personal data has been collected, used or disclosed unlawfully.
• When your personal data is no longer necessary to retain for the purposes notified by the Company, but you wish the Company to continue retaining it for the exercise of your legal rights.
• During the period in which the Company is establishing the lawful grounds for collecting your personal data, or verifying the necessity of collecting, using or disclosing personal data in the public interest, as a result of your exercise of the right to object to the collection, use or disclosure of personal data.

Right to Rectification of Personal Data

If you find that your personal data is inaccurate, incomplete or out of date, you have the right to request that it be rectified so that it is accurate, up to date, complete and not misleading.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Personal Data Protection Committee or the competent officials under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with said Act. However, we kindly ask that you first contact the Company so that the Company has the opportunity to learn the facts, clarify any issues and address your concerns at the earliest opportunity.

The Company may disclose your personal data, for the specified purposes, to others with your consent or as permitted by law, to the following persons and entities:

• Telecommunications regulatory authorities, namely the Office of the National Broadcasting and Telecommunications Commission (Office of the NBTC)
• Government agencies, such as the Revenue Department and the Anti-Money Laundering Office
• Other external entities or third parties (in Thailand or elsewhere) in connection with subpoenas, court orders, or other legal processes or requirements under Thai law
• Executives and employees, only to the extent relevant and necessary
• Service providers and personal data processors assigned or engaged by the Company to manage or process personal data on the Company's behalf in providing various services, including those acting on behalf of or jointly with the Company to carry out the relevant purposes specified in this notice, who need to receive your personal data, such as information technology services, data recording services, or any other services that may benefit you or relate to the Company's business operations, where disclosure of your personal data is reasonably necessary to achieve the Company's business objectives
• Any other persons or entities to which you have consented to the disclosure of your personal data

The Company will require recipients of the data to have appropriate measures to protect your data, to process such personal data only to the extent necessary, and to take steps to prevent unauthorized or unlawful use or disclosure of personal data. Processing will be carried out only for the purposes set out in this policy or other purposes permitted by law. Where the law requires the consent of the data subject, the Company will obtain such consent from the data subject in advance.

The Company has put in place appropriate personal data security measures, covering administrative, technical and physical safeguards for access to and access control of personal data, in order to maintain the confidentiality, integrity and availability of personal data and to prevent the loss, unauthorized or unlawful access, use, alteration, modification or disclosure of personal data. The Company will review such measures when necessary or when technology changes to ensure effective and appropriate security, in accordance with applicable law.

Where the Company sends or transfers your personal data abroad, the Company will take steps to ensure that the destination country, international organization or overseas recipient has adequate personal data protection standards, or that the sending or transfer of personal data complies with the criteria prescribed by the PDPA. In some cases, the Company may request the data subject's consent for such sending or transfer of personal data abroad.

The Company's website may display third-party advertisements to facilitate the Company's services, such as Google AdSense and BuySellAds. These third parties may access your personal data solely to perform these activities and are obligated not to disclose or use it for any other purpose.

The Company will not use automated decision-making without human oversight, including profiling, in a manner that significantly affects you.

The Company may send information or newsletters to your email address to offer content that may interest you. If you no longer wish to receive communications from the Company by email, you may click “Unsubscribe” in the email link or contact the Company by email.

To make your user experience more complete and efficient, the Company may use cookies or similar technologies to improve access to products or services, deliver relevant advertising and track your usage. The Company may use cookies to identify and track website users and their access to the Company's website. Where the Company uses cookies and you do not wish to have cookies on your computer, you may set your browser to refuse cookies before using the Company's website.

If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach and the remedial measures without undue delay through channels such as its website, text message (SMS), email, telephone, or letter.

If you have questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or wish to make a complaint, please contact the Company or its Data Protection Officer (DPO) as follows:

Data Controller / Data Protection Officer (DPO) Phol Dhanya Public Company Limited Telephone: 02-791-0111 Email: dpo@pdgth.com

The Company collects personal data by requesting it from you directly. In some cases, the Company may collect your data from other sources. The Company collects your personal data as follows:

General Personal Data

Identification information, such as first name, last name, national ID card number, passport number, date of birth, gender, age, nationality, marital status, signature, and photograph

Contact information, such as address, telephone number, and email address

Financial information, such as bank account number and salary

Information about related persons, such as the first names, last names, and national ID card numbers of parents, spouse, children, children’s spouses, and siblings; positions held; and shareholding details

Opinions or suggestions

Visual or audio recordings made during work, such as CCTV footage

Information about participation in activities, such as photographs and video and/or audio recordings

Information on securities holdings of directors, the most senior executives, and persons related to them, in the Company and/or its subsidiaries

Information about your use of the Company’s electronic systems; information you enter or provide in those systems; application usage data; and website browsing information, such as browsing history and IP address

Other personal information, such as educational qualifications, employment history, positions held, training history, CCTV footage, and audio recordings of meetings

The Company does not intend to collect or use information about your religion or blood type appearing on a copy of your national ID card for any specific purpose. If you provide the Company with a copy of your national ID card, please redact this information. If you do not do so, you will be deemed to have authorized the Company to redact it, and the redacted document will be deemed fully valid and legally enforceable. If technical limitations prevent the Company from redacting the information, the Company will collect and use it only as part of your identity verification documents.

However, if the Company needs to collect sensitive personal data for a purpose for which it cannot rely on a legal basis for processing, it will obtain your explicit consent beforehand. The Company may process the following sensitive personal data:

Religious information

Criminal records

Health information, such as medical history, food allergies, drug allergies, and blood type

Race

Biometric data, such as facial templates and fingerprints

The Company collects and receives personal data through the following channels:

Personal data you provide to us directly: The Company collects and receives your personal data in documents or electronic form, through verbal communications, agreements entered into with the Company, business cards, and information provided to the Company in the course of work, among other means.

Personal data the Company receives from third parties: The Company may receive your personal data from affiliated companies, people who refer you to the Company, and public sources such as websites, social media, government agencies, and other third parties.

The Company collects, uses or discloses your personal data on the basis of legal obligation, contract and legitimate interest for the following purposes:

The Company will retain your personal data for as long as reasonably necessary for the purposes of collection, use, or disclosure specified in Section 3. The retention period is determined by factors including the duration of the Company’s relationship with you or the period during which the Company provides you with benefits. The Company may retain the data for a further period as necessary to comply with the law or applicable limitation periods; to establish, exercise, or defend legal claims; or for other reasons under the Company’s internal policies and requirements.

Subject to applicable legal provisions and exceptions, you have the following rights and may exercise them through the channels specified by the Company in Section 10:

Right to Withdraw Consent

Where you have given consent to the Company to process your personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into force, you have the right to withdraw your consent at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits you.

Right to Access and Obtain a Copy of Personal Data

You have the right to access and/or obtain a copy of your personal data under the Company's responsibility, and to request disclosure of the source of any personal data collected by the Company without your consent. The Company, however, reserves the right to refuse your request on legal grounds or pursuant to a court order, or where the exercise of your right may adversely affect the rights and freedoms of others.

Right to Data Portability

You have the right to receive your personal data from the Company and to request that the Company send or transfer such data to another data controller. The exercise of this right is subject to the conditions prescribed by law.

Right to Object to the Processing of Personal Data

You have the right to object to the collection, use or disclosure of personal data relating to you, unless the Company has lawful grounds to refuse your request.

Right to Erasure or Destruction of Personal Data

You have the right to request that the Company erase or destroy your personal data, or anonymize it so that it can no longer identify you as the data subject. The exercise of this right is subject to the conditions prescribed by law.

Right to Restrict Processing of Personal Data

You have the right to request that the Company restrict the use of your data in the following cases:

• During the period in which the Company is verifying a request from the data subject to rectify personal data so that it is accurate, complete and up to date.
• Your personal data has been collected, used or disclosed unlawfully.
• When your personal data is no longer necessary to retain for the purposes notified by the Company, but you wish the Company to continue retaining it for the exercise of your legal rights.
• During the period in which the Company is establishing the lawful grounds for collecting your personal data, or verifying the necessity of collecting, using or disclosing personal data in the public interest, as a result of your exercise of the right to object to the collection, use or disclosure of personal data.

Right to Rectification of Personal Data

If you find that your personal data is inaccurate, incomplete or out of date, you have the right to request that it be rectified so that it is accurate, up to date, complete and not misleading.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Personal Data Protection Committee or the competent officials under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with said Act. However, we kindly ask that you first contact the Company so that the Company has the opportunity to learn the facts, clarify any issues and address your concerns at the earliest opportunity.

The Company may disclose information, including your personal data, in connection with a corporate restructuring, merger, sale of the business, or other transfer of assets. The receiving party must handle your information in accordance with this policy and personal data protection laws. The Company may disclose your personal data for the specified purposes, with your consent, or as required by law, to the following persons and entities:

• Executives and employees, only to the extent relevant and necessary
• Government agencies, regulatory authorities or other agencies as required by law, including officials exercising legal powers, such as the Department of Business Development, the Securities and Exchange Commission (SEC), the Stock Exchange of Thailand (SET), the State Enterprise Policy Office (SEPO), the Office of the National Anti-Corruption Commission (Office of the NACC), the National Anti-Corruption Commission, the Thai Institute of Directors (IOD), courts and the police
• Agents, contractors/subcontractors and/or service providers performing any work for the Company, such as auditors, lawyers, legal advisers and banks with which the Company conducts financial or investment transactions
• Any other person or organization to whom you have consented to the disclosure of your personal data

The Company has put in place appropriate personal data security measures, covering administrative, technical and physical safeguards for access to and access control of personal data, in order to maintain the confidentiality, integrity and availability of personal data and to prevent the loss, unauthorized or unlawful access, use, alteration, modification or disclosure of personal data. The Company will review such measures when necessary or when technology changes to ensure effective and appropriate security, in accordance with applicable law.

Where the Company sends or transfers your personal data abroad, the Company will take steps to ensure that the destination country, international organization or overseas recipient has adequate personal data protection standards, or that the sending or transfer of personal data complies with the criteria prescribed by the PDPA. In some cases, the Company may request the data subject's consent for such sending or transfer of personal data abroad.

If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach and the remedial measures without undue delay through channels such as its website, text message (SMS), email, telephone, or letter.

If you have questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or wish to make a complaint, please contact the Company or its Data Protection Officer (DPO) as follows:

Data Controller / Data Protection Officer (DPO) Phol Dhanya Public Company Limited Telephone: 02-791-0111 Email: dpo@pdgth.com

The Company needs to collect the following personal data about you and/or your representative:

Identification data, such as first and last name, gender, nationality, date of birth, signature, name-change details, marital status, photograph, national identification number, passport details or details of similar cards issued by a government agency, and securities holder registration number

Contact information, such as address, telephone number and email address

Financial information, such as bank account number (used to receive dividend payments, principal and/or interest) and number of shares/bonds (units)

Information about participation in Company activities, such as photographs or video recordings

Other personal data, such as occupation

Reservation of rights: Where the Company needs to request a copy of your national identification card, which may contain sensitive personal data such as religion, blood type or race, the Company does not wish to collect such data and asks you, as the data subject, to redact it. If you do not redact the sensitive data yourself, the Company reserves the right to do so on your behalf. This will not constitute collection of your sensitive data, and the redacted document will be deemed fully valid and legally enforceable.

The Company will collect personal data about you and/or your representative directly from you, for example, by asking you to complete a Company form, answer questions or provide documents containing your personal data. In some cases, however, the Company may collect your personal data from other sources to fulfill the purposes stated above, such as the securities register or Thailand Securities Depository (TSD).

The Company collects, uses or discloses your personal data on the basis of legal obligation, contract and legitimate interest for the following purposes:

The personal data collected by the Company for paying dividends to shareholders, paying principal and interest to bondholders, managing shareholder and bondholder registers, and handling proxy appointments is necessary for the Company to perform contracts or comply with the terms and conditions governing the rights and obligations of the bond issuer and bondholders, as well as applicable laws, including laws governing public limited companies and securities and the stock exchange. If you do not provide the necessary personal data, the Company may be unable to administer or manage shareholder and bondholder agreements (if any).

The Company will retain your personal data for as long as reasonably necessary for the purposes of collection, use, or disclosure specified in Section 3. The retention period is determined by factors including the duration of the Company’s relationship with you or the period during which the Company provides you with benefits. The Company may retain the data for a further period as necessary to comply with the law or applicable limitation periods; to establish, exercise, or defend legal claims; or for other reasons under the Company’s internal policies and requirements.

Subject to applicable legal provisions and exceptions, you have the following rights and may exercise them through the channels specified by the Company in Section 10:

Right to Withdraw Consent

Where you have given consent to the Company to process your personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into force, you have the right to withdraw your consent at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits you.

Right to Access and Obtain a Copy of Personal Data

You have the right to access and/or obtain a copy of your personal data under the Company's responsibility, and to request disclosure of the source of any personal data collected by the Company without your consent. The Company, however, reserves the right to refuse your request on legal grounds or pursuant to a court order, or where the exercise of your right may adversely affect the rights and freedoms of others.

Right to Data Portability

You have the right to receive your personal data from the Company and to request that the Company send or transfer such data to another data controller. The exercise of this right is subject to the conditions prescribed by law.

Right to Object to the Processing of Personal Data

You have the right to object to the collection, use or disclosure of personal data relating to you, unless the Company has lawful grounds to refuse your request.

Right to Erasure or Destruction of Personal Data

You have the right to request that the Company erase or destroy your personal data, or anonymize it so that it can no longer identify you as the data subject. The exercise of this right is subject to the conditions prescribed by law.

Right to Restrict Processing of Personal Data

You have the right to request that the Company restrict the use of your data in the following cases:

• During the period in which the Company is verifying a request from the data subject to rectify personal data so that it is accurate, complete and up to date.
• Your personal data has been collected, used or disclosed unlawfully.
• When your personal data is no longer necessary to retain for the purposes notified by the Company, but you wish the Company to continue retaining it for the exercise of your legal rights.
• During the period in which the Company is establishing the lawful grounds for collecting your personal data, or verifying the necessity of collecting, using or disclosing personal data in the public interest, as a result of your exercise of the right to object to the collection, use or disclosure of personal data.

Right to Rectification of Personal Data

If you find that your personal data is inaccurate, incomplete or out of date, you have the right to request that it be rectified so that it is accurate, up to date, complete and not misleading.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Personal Data Protection Committee or the competent officials under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with said Act. However, we kindly ask that you first contact the Company so that the Company has the opportunity to learn the facts, clarify any issues and address your concerns at the earliest opportunity.

To fulfill the purposes specified in this Notice, the Company may disclose your personal data to the following persons:

Subsidiaries, affiliates and group companies, to assist in fulfilling the purposes specified above

Government agencies, law enforcement agencies, courts, and regulators (such as the Ministry of Commerce, the Securities and Exchange Commission, the Stock Exchange of Thailand, Thailand Securities Depository Co., Ltd., or persons involved in legal proceedings), or other persons where the Company reasonably believes disclosure is necessary to comply with the law; protect the rights of the Company, the rights of third parties, or personal safety; or carry out any necessary assignment or acceptance of the Company's rights and/or obligations

Relevant service providers, such as event organizers and providers of facilities for shareholders, bondholders and their representatives; auditors; financial institutions; insurers and their agents or brokers; securities companies; business partners and suppliers; advisers; professional service providers; and other persons necessary to fulfill the purposes for collecting and processing personal data specified in this Privacy Notice

Electronic and print media, for publishing meeting reports and publicizing meetings

Personal Data Processors

The Company has put in place appropriate personal data security measures, covering administrative, technical and physical safeguards for access to and access control of personal data, in order to maintain the confidentiality, integrity and availability of personal data and to prevent the loss, unauthorized or unlawful access, use, alteration, modification or disclosure of personal data. The Company will review such measures when necessary or when technology changes to ensure effective and appropriate security, in accordance with applicable law.

The Company may store your data on the computer servers or cloud systems of service providers located overseas, and the data may be processed using off-the-shelf software or applications provided by overseas service providers. In all cases where your data is sent or transferred overseas, the Company will comply with the Personal Data Protection Act B.E. 2562 (2019).

If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach and the remedial measures without undue delay through channels such as its website, text message (SMS), email, telephone, or letter.

If you have questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or wish to make a complaint, please contact the Company or its Data Protection Officer (DPO) as follows:

Data Controller / Data Protection Officer (DPO) Phol Dhanya Public Company Limited Telephone: 02-791-0111 Email: dpo@pdgth.com

The Company needs to collect the following personal data from you:

Personal data, such as first name, last name, age, date of birth, nationality, national identification number, passport, and position

Contact information, such as address, telephone number, email address, and workplace

Sensitive personal data that the Company may collect, such as health screening history during an outbreak of a communicable disease

The Company will collect and receive personal data directly from you through the following channels:

Personal data you provide directly to us: The Company collects and receives your personal data in documentary or electronic form. You may enter your information in visitor records or on an online platform designated by us, or submit documents containing your personal data to us. This also includes images captured by our closed-circuit television cameras, to which our CCTV Privacy Notice applies.

Personal data received by the Company from external parties: The Company may receive your personal data from third parties and/or any other persons acting as data controllers or data processors who the Company believes in good faith are entitled to process the personal data and disclose it to the Company. Sources may include, without limitation, search engines, social media, government agencies and other external parties.

The Company collects, uses or discloses your personal data on the basis of legal obligation, contract and legitimate interest for the following purposes:

• To take steps at your request before entering into a contract, or to perform a contract to which you and the Company are parties, such as when you contact the Company and request that it take any action
• To control access to buildings, areas within buildings, and the internet
• For security, crime prevention and detection, and use as evidence in investigations relating to both the Company's internal measures and actions by government agencies or other organizations involved in legal proceedings
• To prevent or suppress danger to your or another person's life, body, or health, such as for emergency contact and the control and prevention of communicable diseases
• To comply with the law, including legal provisions, regulations, and orders issued by persons with lawful authority and government officials

The Company will retain your personal data for as long as reasonably necessary for the purposes of collection, use, or disclosure specified in Section 3. The retention period is determined by factors including the duration of the Company’s relationship with you or the period during which the Company provides you with benefits. The Company may retain the data for a further period as necessary to comply with the law or applicable limitation periods; to establish, exercise, or defend legal claims; or for other reasons under the Company’s internal policies and requirements.

Subject to applicable legal provisions and exceptions, you have the following rights and may exercise them through the channels specified by the Company in Section 10:

Right to Withdraw Consent

Where you have given consent to the Company to process your personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into force, you have the right to withdraw your consent at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits you.

Right to Access and Obtain a Copy of Personal Data

You have the right to access and/or obtain a copy of your personal data under the Company's responsibility, and to request disclosure of the source of any personal data collected by the Company without your consent. The Company, however, reserves the right to refuse your request on legal grounds or pursuant to a court order, or where the exercise of your right may adversely affect the rights and freedoms of others.

Right to Data Portability

You have the right to receive your personal data from the Company and to request that the Company send or transfer such data to another data controller. The exercise of this right is subject to the conditions prescribed by law.

Right to Object to the Processing of Personal Data

You have the right to object to the collection, use or disclosure of personal data relating to you, unless the Company has lawful grounds to refuse your request.

Right to Erasure or Destruction of Personal Data

You have the right to request that the Company erase or destroy your personal data, or anonymize it so that it can no longer identify you as the data subject. The exercise of this right is subject to the conditions prescribed by law.

Right to Restrict Processing of Personal Data

You have the right to request that the Company restrict the use of your data in the following cases:

• During the period in which the Company is verifying a request from the data subject to rectify personal data so that it is accurate, complete and up to date.
• Your personal data has been collected, used or disclosed unlawfully.
• When your personal data is no longer necessary to retain for the purposes notified by the Company, but you wish the Company to continue retaining it for the exercise of your legal rights.
• During the period in which the Company is establishing the lawful grounds for collecting your personal data, or verifying the necessity of collecting, using or disclosing personal data in the public interest, as a result of your exercise of the right to object to the collection, use or disclosure of personal data.

Right to Rectification of Personal Data

If you find that your personal data is inaccurate, incomplete or out of date, you have the right to request that it be rectified so that it is accurate, up to date, complete and not misleading.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Personal Data Protection Committee or the competent officials under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with said Act. However, we kindly ask that you first contact the Company so that the Company has the opportunity to learn the facts, clarify any issues and address your concerns at the earliest opportunity.

The Company may disclose information, including your personal data, in connection with a corporate restructuring, merger, sale of the business, or other transfer of assets. The receiving party must handle your information in accordance with this policy and personal data protection laws. The Company may disclose your personal data for the specified purposes, with your consent, or as required by law, to the following persons and entities:

• Executives and employees, only to the extent relevant and necessary
• Service providers and personal data processors appointed or engaged by the Company to administer, manage, or process personal data for the Company in connection with various services, including persons acting on behalf of or jointly with the Company to fulfill the purposes for processing personal data under this Privacy Notice, such as CCTV service providers, auditors, government agencies, and other persons necessary for us to carry out activities for those purposes
• Any other person or organization to whom you have consented to the disclosure of your personal data

The Company has put in place appropriate personal data security measures, covering administrative, technical and physical safeguards for access to and access control of personal data, in order to maintain the confidentiality, integrity and availability of personal data and to prevent the loss, unauthorized or unlawful access, use, alteration, modification or disclosure of personal data. The Company will review such measures when necessary or when technology changes to ensure effective and appropriate security, in accordance with applicable law.

Where the Company sends or transfers your personal data abroad, the Company will take steps to ensure that the destination country, international organization or overseas recipient has adequate personal data protection standards, or that the sending or transfer of personal data complies with the criteria prescribed by the PDPA. In some cases, the Company may request the data subject's consent for such sending or transfer of personal data abroad.

If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach and the remedial measures without undue delay through channels such as its website, text message (SMS), email, telephone, or letter.

If you have questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or wish to make a complaint, please contact the Company or its Data Protection Officer (DPO) as follows:

Data Controller / Data Protection Officer (DPO) Phol Dhanya Public Company Limited Telephone: 02-791-0111 Email: dpo@pdgth.com

The Company collects your personal data through CCTV systems installed in visible locations. Warning signs indicating the use of CCTV will be posted to inform you that your personal data is collected when you enter the premises, as follows:

Still images

Moving images

Images of your property, such as vehicles, bags, hats, and clothing

We will not install CCTV cameras in areas where doing so could unreasonably infringe your fundamental rights, such as bedrooms, restrooms, shower rooms, or employee rest areas. CCTV cameras will record moving and still images of all persons entering areas under surveillance, both inside and around the Company's premises.

The Company installs and uses closed-circuit television (CCTV) cameras to record images inside and around buildings and premises in order to protect the security of the premises, property, health, and life. The Company collects the personal data of employees, officers, workers, customers, staff, contractors, visitors, and any persons entering areas monitored by CCTV. The Company will begin recording images through its CCTV systems from 28 November 2025 onward, or from the date on which the system is actually installed and activated in each area. Recording will operate continuously for 24 hours or only during designated periods, as appropriate for each location.

Collection, Use, Disclosure, or Processing of Personal Data: The Company will collect, use, disclose, or process your personal data for purposes including, without limitation, the following:

• To protect against or suppress danger to life, body, health, personal safety, and property
• To safeguard and protect premises, facilities, and property against damage, interference, destruction, and other crimes
• To support law enforcement agencies in preventing, investigating, and prosecuting crimes, and in taking action to deter crime
• To assist in resolving disputes effectively when they arise in disciplinary or grievance proceedings
• To assist in investigations or proceedings relating to whistleblowing reports
• For employee work activities
• For employee work activities
• Vital Interests Basis: The collection, use, disclosure, or processing of personal data is necessary to prevent or suppress danger to a person's life, body, or health
• Legitimate Interests Basis: The collection, use, disclosure, or processing of your personal data is carried out for legitimate interests in order to fulfill one or more of the purposes specified above
• Legal Obligation Basis: The Company is required to comply with applicable laws, including but not limited to workplace safety and environmental laws. The use of CCTV is an important measure that helps the Company fulfill these obligations

The Company will retain CCTV footage for no more than 90 days from the recording date, unless it is necessary to retain it for a longer period in the circumstances specified in Section 3.2

The Company may need to retain your personal data for as long as necessary to manage any disputes or legal proceedings that may arise

When it is no longer necessary to retain your personal data, the Company may destroy, delete, remove from its systems, or anonymize it so that the data subject can no longer be identified

Upon expiry of the retention period, or when the data is no longer required for the notified purposes, the Company will delete, destroy, or anonymize the personal data using secure and irreversible methods, such as automatic deletion from the video recording system or destruction of storage media in accordance with information security standards

Subject to applicable legal provisions and exceptions, you have the following rights and may exercise them through the channels specified by the Company in Section 10:

Right to Withdraw Consent

Where you have given consent to the Company to process your personal data, whether such consent was given before or after the Personal Data Protection Act B.E. 2562 (2019) came into force, you have the right to withdraw your consent at any time, unless the withdrawal of consent is restricted by law or by a contract that benefits you.

Right to Access and Obtain a Copy of Personal Data

You have the right to access and/or obtain a copy of your personal data under the Company's responsibility, and to request disclosure of the source of any personal data collected by the Company without your consent. The Company, however, reserves the right to refuse your request on legal grounds or pursuant to a court order, or where the exercise of your right may adversely affect the rights and freedoms of others.

Right to Data Portability

You have the right to receive your personal data from the Company and to request that the Company send or transfer such data to another data controller. The exercise of this right is subject to the conditions prescribed by law.

Right to Object to the Processing of Personal Data

You have the right to object to the collection, use or disclosure of personal data relating to you, unless the Company has lawful grounds to refuse your request.

Right to Erasure or Destruction of Personal Data

You have the right to request that the Company erase or destroy your personal data, or anonymize it so that it can no longer identify you as the data subject. The exercise of this right is subject to the conditions prescribed by law.

Right to Restrict Processing of Personal Data

You have the right to request that the Company restrict the use of your data in the following cases:

• During the period in which the Company is verifying a request from the data subject to rectify personal data so that it is accurate, complete and up to date.
• Your personal data has been collected, used or disclosed unlawfully.
• When your personal data is no longer necessary to retain for the purposes notified by the Company, but you wish the Company to continue retaining it for the exercise of your legal rights.
• During the period in which the Company is establishing the lawful grounds for collecting your personal data, or verifying the necessity of collecting, using or disclosing personal data in the public interest, as a result of your exercise of the right to object to the collection, use or disclosure of personal data.

Right to Rectification of Personal Data

If you find that your personal data is inaccurate, incomplete or out of date, you have the right to request that it be rectified so that it is accurate, up to date, complete and not misleading.

Right to Lodge a Complaint

You have the right to lodge a complaint with the Personal Data Protection Committee or the competent officials under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with said Act. However, we kindly ask that you first contact the Company so that the Company has the opportunity to learn the facts, clarify any issues and address your concerns at the earliest opportunity.

The Company may disclose your personal data, for the specified purposes, to others with your consent or as permitted by law, to the following persons and entities:

• The Company will keep your personal data in its CCTV systems confidential. However, the Company may disclose or transfer such personal data to subsidiaries or affiliates, or disclose your personal data to third parties and/or third-party service providers where such disclosure is necessary for the purposes specified above
• The Company may disclose your personal data to law enforcement agencies where disclosure is necessary to fulfill legal obligations and to support or assist those agencies in preventing, investigating, and prosecuting crimes

The Company has put in place appropriate personal data security measures, covering administrative, technical and physical safeguards for access to and access control of personal data, in order to maintain the confidentiality, integrity and availability of personal data and to prevent the loss, unauthorized or unlawful access, use, alteration, modification or disclosure of personal data. The Company will review such measures when necessary or when technology changes to ensure effective and appropriate security, in accordance with applicable law.

Where the Company sends or transfers your personal data abroad, the Company will take steps to ensure that the destination country, international organization or overseas recipient has adequate personal data protection standards, or that the sending or transfer of personal data complies with the criteria prescribed by the PDPA. In some cases, the Company may request the data subject's consent for such sending or transfer of personal data abroad.

If a personal data breach occurs, the Company will notify the Office of the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach and the remedial measures without undue delay through channels such as its website, text message (SMS), email, telephone, or letter.

If you have questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or wish to make a complaint, please contact the Company or its Data Protection Officer (DPO) as follows:

Data Controller / Data Protection Officer (DPO) Phol Dhanya Public Company Limited Telephone: 02-791-0111 Email: dpo@pdgth.com