Bussiness Partners Privacy Notice

1. Application to this Notice

This Business Partners Privacy Notice (hereinafter referred to “Privacy Notice”) informs you about how and for which purposes we will process your personal data and explains your rights under applicable data protection law. We, Sojitz (Thailand) Co., Ltd. (hereinafter referred to as “Company”, “we”, or “us”) collect provide information on the processing of personal data in the context of activities in connection with our relationship with existing and potential trading companies, third-party service providers, goods and service suppliers, agents, advisors, outside auditors, business customers and other persons with whom the Company or any of its group company maintains or is considering to create a business relationship with (each a “Business Partner” or “you”) pursuant to Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and relevant laws. The Company will be the responsible controller for any personal data you provide to us in connection with our business relationship.

By submitting your personal data to us, you acknowledge that:

1. You have read and understood this Privacy Notice and agree to the use of your personal data as setout herein.
2. You are not required to provide any requested personal data to us but failing to do so may prevent or delay the fulfillment of our obligations under the law or the contract.
3. Your personal data may be transferred and processed outside Thailand, including countries that may not be deemed to provide the same level of data protection as Thailand, for the purpose and in the manner specified in this Privacy Notice.
4. All of your representations are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature. Providing any inaccurate information may make you ineligible for Business Partner.
5. This Privacy Notice shall not form part of any agreement or other contracts to provide services.

2. Types of personal data we collect

The Company may collect and process the various types of your personal data as follows:

1. Information necessary to manage and administer our business relationship with you, your employer or representative
2. Information necessary to purchase products and services
3. Information necessary to provide the Company’s services, for example, to fulfil orders
4. Information necessary to provide support for the Company’s products or services
5. Information about what you do in your business concerning our customers, the Company’s products and services
6. Information you provide us in agreements, forms, questionnaires or surveys
7. Information about your visit to our offices, outlets and events
8. Information you give us in calls you make to us or emails you send to us
9. Information necessary to verify your identity and authority to act on behalf of your employer, if applicable

3. Collection of your personal data

The Company may collect personal data directly from you when you interact with the Company, for example,

when you sign a contract with us, communicate with the Company in relation to our products and services,

submit an order, or participate in our questionnaires or surveys. We may acquire your personal data from

third parties such as your employer, your representatives or publicly available sources such as your

company’s website.

4. Legal grounds and purposes of personal data processing

Depending on the nature of our relationship with you or your employer, we may use information about you or your employer for the following purposes:

1. Communicating with you about the Company’s products and services, e.g. by responding to inquiries or requests about our products, services or offers, entering into or executing transactions for products or services, providing support and to process sales orders and administer accounts, and sale related services records;
2. Communicating with you about your products and services;
3. Purchasing products or services from you or your employer, including contacting you to manage our relationship, obtain sale-related services and to pay you for goods, services, and expenses where appropriate;
4. Offering our products or services to you, including fulfilling your orders, processing your payments, dealing with your inquiries and requests, and providing warranty services;
5. Provide the necessary support to you;
6. Informing you of updates, events and manage related aspects of our relationship, including product improvement;
7. Conducting analytics for the purposes of business and product development, market research or services and marketing and promotional activities;
8. Planning, performing and managing the business relationship with you;
9. Conducting security and system monitoring to ensure appropriate use of internet and email facilities;
10. Undertaking business-related questionnaire and managing our contractual relationship with you or your employer;
11. Retaining and using your records in relation to any anticipated disputes for the purposes of obtaining advices from our legal counsels and other advisors;
12. Investigating of reported allegations of misconducts;
13. Solving disputes, enforcing agreements and/or to establish, exercise or defend legal claims; and
14. Complying with applicable laws and regulations, including cooperating with relevant authorities and regulators.

In processing your personal data in connection with the purposes set out above, the Company may rely on one of the following legal grounds, depending on the circumstances:

1. To establish a contractual obligation with you and to perform our obligation under a contract; or
2. To comply with our legal or regulatory obligation; or
3. To meet our legitimate interest provided that our legitimate interest does not override your interest or fundamental rights and freedom; or
4. we have obtained your prior consent. In case we rely on your consent as a legal ground for processing, your personal data, you may withdraw your consent at any time.

If you do not provide us with your personal data, the Company will be unable to provide you with the

requested products or services.

5. Sharing your personal data

For the purposes of data processing indicated in section 4 above, the Company may disclose personal data to the following recipients or categories of recipients:

5.1 Directors, supervisory board members, senior advisors, advisors, executive officers, fellows, executive counsellors, employees (including employees undergoing their probationary employment period), temporary employees, and any persons who correspond to such positions (“Staffs”) of the Company;

5.2 External advisors such as attorneys, accountants and tax advisors (“Advisors”) of the Company;

5.3 Group companies of the Company and their staff and advisors with whom the Company needs to share the data for the purpose of processing;

5.4 Other Business Partners and their staffs and advisors with whom the Company needs to share the data for the purpose of processing;

5.5 Governmental agencies, boards, commissions, officers, officials or entities exercising legislative, judicial, regulatory or administrative functions.

5.6 Third party that purchases, or to which the Company transfer all or substantially of the assets and

business.

6. Data Transferred outside Thailand

Recipients of personal data may be located in countries and areas outside Thailand (“Third Countries”). For example, the Company may disclose personal data to our related companies within Sojitz Corporation Group in Japan and Singapore. We will transfer personal data to external recipients in Third Countries only in case that the transferring is following regulations under the PDPA and relevant laws.

7. Retention Period

The Company will hold your personal data as long as required to provide the services, products or information you have requested and to administer your business relationship with us. If you have asked the Company not to communicate with you, the Company will hold your personal data as long as required to comply with your request. We are also required to keep certain of your personal data (e.g. relating to business transactions) for certain retention periods under applicable law. Your personal data will be promptly deleted when it is no longer required for these purposes or you have requested to cancel the storage of personal data.

8. Protecting your personal data

We are aware of the requirement to ensure your personal data is protected against accidental loss or disclosure, data destruction and abuse. To prevent problems, we have implemented the following processes and measures:

1. We have a measure restricting access to your personal data , which only employees, agents, contractors and other third parties that need to access to fulfill the mission and duties related to the service can access your personal data.
2. All service providers are permitted to process your personal data based on our instructions, they are subject to a duty of confidentiality, and they are required to be compliant and demonstrate compliance with our policy and the law.
3. Our IT systems are protected against unauthorized access with various levels of controlled and password protected access rights.
4. We have measures to share your personal data with third parties, with our written instructions to ensure that your personal data is processed safely and in accordance with the PDPA. Third parties must use appropriate technical and organizational measures to ensure the security of your personal
5. data.

9. Your privacy rights

Under certain circumstance pursuant to the PDPA, you have rights to:

1. Request access to your personal data

This enables you to receive a copy of the personal data we hold about you and to check that we are

processing it lawfully.

1. Request correction of the personal data that we hold about you

This enables you to have any incomplete or inaccurate personal data that we hold about you corrected.

1. Request correction of the personal data that we hold about you

This enables you to have any incomplete or inaccurate personal data that we hold about you corrected.

1. Request erasure of your personal data.

This enables you to ask us to delete or remove personal data where there is no legal ground for us to continue to process it. You also have right to ask us to delete or remove your personal data where you have exercised your right to object to processing.

1. Object to processing of your personal data

This enables you to ask us to object to processing your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

1. Request the restriction of processing of your personal data.

This enables you to ask us to suspend the process of personal data about you, for example if you want us to establish personal data accuracy or the reason for its processing.

1. Request the data portability of your personal data to another party.
2. Request withdraw the consent.

In circumstances where you have provided your consent to the processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. However, in some cases, we may continue to process the personal data where so permitted by having another legal ground for doing so.

10. Making a Complaint

The supervisory authority in the Thailand for data protection matters is the Office of the Personal Data Protection Committee (“PDPC Office”). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the PDPC Office.

11. Change of personal data

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your business relationship with us.

12. Effective date and change to privacy notice

This Privacy Notice shall be effective on 1st June 2021and we reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates.

13. Contact us about this privacy notice

If you have questions or comments about this Privacy Notice, you may contact our Data Protection Officer

by email at [email protected], or by post to:

Sojitz (Thailand) Co., Ltd.

Floor 19th, Q.House Lumpini Building

1 South Sathorn Road, Tungmahamek

Sathorn, Bangkok 10120

Thailand