Privacy Notice
For Customers, Business Partners, Contacts, and External Individuals

    Charter Square Holding Company Limited (the Company) recognizes the importance and strictly respects the rights and privacy of personal data owners, including customers, business partners, contacts, and external individuals. This applies to the methods of collecting, using, and/or disclosing data (collectively referred to as “data processing”) to comply with the Personal Data Protection Act B.E. 2562 (2019). The purpose of collecting, using, and disclosing your data provided to the Company is to deliver products and services tailored to your specific needs, to conduct joint business operations, and to maintain security in business management. This privacy notice also applies to the Company’s website, mobile applications, social media channels, and online communication channels where your personal data is collected. However, please read this privacy notice together with the terms and conditions for the specific services you use.
Personal Data
“Personal Data” means information about a living individual which can directly or indirectly identify that person. “Sensitive Data” means personal data relating to race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disabilities, union membership, genetic data, biometric data such as facial recognition, iris scan, or fingerprint data.

1. Personal Data Collected, Used, or Disclosed by the Company
   1.1 Personal Information including title, name, surname, age, date of birth, gender, nationality, photograph, educational qualifications, insurance information, house registration, occupational details (such as job position, workplace), government-issued ID information (such as ID card number, passport number), signature, licenses, or other identity documents.
   1.2 Contact Information including phone numbers, fax numbers, LINE ID, address, country of residence, email, contact persons, and other contact details, including the names of employees associated with you.
   1.3 Vehicle-related Information including driving licenses, vehicle registration, and related vehicle details.
   1.4 Financial Information including bank accounts, passbooks, bank statements, credit card numbers, bank guarantees, and other financial data.
   1.5 Financial Status Information related to your risk profile as a business partner, credit rating and solvency, and contract information appearing in correspondence such as letters from the Company.
   1.6 Other data collected, used, or disclosed relating to the relationship between the Company and business partners, such as data provided in contracts and forms. If you provide personal data of third parties (e.g., name and phone number) for emergency contact, the Company assumes you have obtained their consent and have the right to provide such data to the Company. If any claims arise regarding rights violations, you shall be solely responsible, and the Company shall not be liable.

2. Sensitive Personal Data
The Company may need to collect sensitive data such as religion, race, biometric data (fingerprints), or medical data. The Company will obtain your consent before collecting, using, and/or disclosing such data, except:
   2.1 To prevent or mitigate harm to life, body, or health of individuals.
   2.2 Data publicly disclosed with the explicit consent of the data owner.
   2.3 Necessary for compliance with laws for the purposes of:
     2.3.1 Public health benefits, such as prevention of dangerous communicable diseases or epidemics.
     2.3.2 Scientific, historical, or statistical research or other public benefits.

3. Purpose of Collecting, Using, or Disclosing Your Personal Data
Your personal data is collected, used, and disclosed for lawful purposes including to perform or comply with contracts, for public interest, for obtaining permissions, or as permitted by law, which may include:
   3.1 Business communication including sales operations, communication with partners regarding products, services, or projects, responding to inquiries or requests, and providing progress updates or results.
   3.2 Business partner selection including due diligence, risk assessment, credit rating analysis, compliance with government lists, evaluation of suitability and qualifications, quotation or bidding invitations, and contract compliance.
   3.3 Managing business partner data including maintaining and updating partner records (including your personal data) and storing related contracts or documents.
   3.4 Security and surveillance including identity verification, access control, recording entry/exit, surveillance systems, equipment use, CCTV, internet systems, security information systems, crime prevention and resolution, risk management, and fraud prevention.
   3.5 Investigations, complaints, and/or prevention of crime or fraud.
   3.6 Marketing purposes including informing you of news, announcements, promotions, events, new services, and conducting surveys or research.
   3.7 Business administration including normal management and record-keeping of company business, correspondence related to our relationship with you, or legal obligations related to your personal data, contract execution, or binding agreements. Failure to provide requested data may affect achieving these purposes. For cases requiring your explicit consent, the Company will notify and obtain such consent separately.

4. Third Parties to Whom Your Personal Data May Be Disclosed
   4.1 Service Providers of the Company The Company may hire other companies, agents, or contractors to provide services on behalf of the Company or to facilitate business relations with you. This may include (1) infrastructure, software, website developers, and IT service providers; (2) payment service providers; (3) research agencies; (4) data analytics providers; (5) survey or claims negotiation agents; (6) auditors or financial consultants; (7) communication, advertising, and marketing agencies; (8) payment and identity verification service providers; (9) outsourced management providers; (10) data storage and cloud service providers. These service providers may need access to your personal data, but the Company will only disclose necessary information and require them not to use your data for other purposes.
   4.2 In certain cases, disclosure may be necessary to comply with laws or regulations, including law enforcement, courts, government officials, or other external parties when legally required or to protect the Company’s rights, others’ rights, safety, or to detect, prevent, or manage fraud or security issues.

5. Protection of Your Personal Data
The Company will implement appropriate technical and administrative measures to protect and secure personal data, and restrict access only to authorized personnel, for data stored in both physical and electronic forms.

6. Retention Period of Your Personal Data
Your personal data will be retained only as long as reasonably necessary to fulfill the purposes for which it was collected and to comply with legal obligations. However, the Company may retain your data longer if required by applicable laws.

7. Changes to this Privacy Notice
The Company reserves the right to amend this privacy notice from time to time. Please review this notice regularly. Any changes will take effect immediately upon publication on the Company’s website or applications.

8. Rights of Personal Data Owners
Subject to applicable laws and exceptions, you may have the following rights:

   8.1 The right to access and obtain a copy of your personal data. The Company may request proof of identity before providing such information.
   8.2 The right to withdraw your consent at any time. Withdrawal will not affect lawful processing prior to withdrawal. Upon withdrawal, the Company will only use your data as legally permitted.
   8.3 The right to request correction or amendment of inaccurate data.
   8.4 The right to request deletion or anonymization of your data unless retention is legally required.
   8.5 The right to data portability, i.e., transfer your data to another data controller when consented or for contract performance.
   8.6 The right to request suspension of data use as provided by law.
   8.7 The right to object to data collection, use, or disclosure, e.g., direct marketing.
   8.8 The right to file complaints regarding violations of data use inconsistent with applicable laws.

9. Contact Information of the Company
If you, as a personal data owner related to the Company, wish to exercise your rights or have questions regarding your personal data under this privacy notice, you may contact the Company through the following:

Charter Square Holding Company Limited
Address: 152 Charter Square Building, North Sathorn Road, Silom Subdistrict, Bang Rak District, Bangkok 10500
Phone: 02-637-8000
Email: cts_pdpa@charteredsquare.com

This notice is hereby announced for general acknowledgement.
Announced on June 1, 2022