Recruitment Privacy Notice

This Recruitment Privacy Notice (hereinafter referred to "Privacy Notice') sets out the basis upon which Soitz (Thailand) Co. Ltd. (hereinafter referred to "Company", "we" or "us") may collect. use, disclose or othervise process (hereinafter referred to "process, processing, processed") personal data of job applicants in accordance with Thailand Personal Data Protection Act B.E. 2562019) (hereinafter refemed to "PDPA"). This Privacy Notice describes how we handle and protect your personal data in connection with the Company's recruiting processes.

1. Application of this Privacy Notice

This Privacy Notice applies to the personal data of all persons who have applied for jobs in any position with us, and'or potential candidates through alternative channels such as recruiting agencies (hereinafter referred to "Job Applicants" or "you").

By submuitting your personal data to us, you acknowledge that:

1. You have read and understood this Privacy Notice and agree to the use of your personal data as set out herein.
2. You are not required to provide any requested data to us but failing to do so may result in not being able to contime your candidacy for the job for which you have applied.
3. Your personal data may be transferred and processed outside Thailand, including countries that may not be deemed to provide the same level of data protection as Thailand, for the purpose and in the manner speciffed in this Privacy Notice.
4. All of your representations are true and correct to the best of your knowledge and belief, and you have not knowing onnitted any related data of an adverse nature. Providing any inaccurate data may take you ineligible for employment.
5. This Privacy Notice does not form part of any agreement of employment offered to Job Applicants hired by the Company.
6. The Company reserves the right to amend or modify this Privacy Notice from time to time.

2. Types of personal data we collect

In connection with your job application, your submission of your, curiculum vitae or resume including other relevant documents (hereinafter referred to "Application Documents") for work with us, we will process the following categories of personal data about you:

1. The data you have provided on application document, including name, title. photograph, ID number, nationality, address, phone number, personal email address, date of birth, gender, education background, employment history, qualifications, and other relevant data;
2. The data of referees and emergency contact details you provided to us;
3. Other data obtained through electronic means; and
4. Any data provided through an online job site, via email, in person at interviews and/or by any other method, where applicable

We may also process the following "special categories" of personal data.

1. Data about your health inchuding any medical condition, health, and sickness records; and
2. Data about criminal convictions and offences.

3. Collection of your personal data

We collect personal data about you by (a) you knowingly and voluntanily provide in the course of of or in. connection with job application with us, (b) via a third party who has been duly authorised by you to disclose your personal data to us which may include your recruitment agencies (hereinafter referred to "Authorised Representative"), affer (i) you or your Authorised Representative have been notified of the purposes for which the data is processed, and (ii) you or your Authorised Representative have provided consent to the process of your personal data for those purposes, or (c) via a third party that is for legitimate interest of Company, such as collecting your personal data through a background check service provider, including your referees.

Your personal data, inchuding your Application Documents are kept in both physical copy and digital format as personnel files or within the Company's HR system.

4. Legal ground and purpose of personal data processing

We will process your personal data based on consent for the following purposes of our recritment process:

1. assessing and evaluating suitability for employment in any current or prospective position. within the organization;
2. conducting criminal history checks as pernitted by applicable law;
3. record keeping in relation to recruiting and huring process;
4. ensuring compliance with legal requirements;
5. emergency situations where the health or safety of one or more individals may be endangered; and
6. verifying your identity and the accuracy of your personal details and other data provided.

We do not need your consent if we process personal data in order to carry out our legal obligations, legitimate interests or public interests. It is in our legitimate interests to decide whether to appoint you to work with us since it would be beneficial to our business to appoint someone to that role. We also need to process your personal data to decide whether to enter into a contract of employment with you. We may also analyse your personal data or aggregated/psendonymized data to improve ove our recruitment and hiring process and angment our ability to attract successful candidates.

5. Sharing your data

Your data will be shared intemally within the Company where it is necessary to those who has the need to know for the performance of their roles. This includes, for example, members of the recruitoment team for adonistering hing hing process, the business function manager for their assessment of you.

We may also share your data with third parties as part of the Company sale or restructucture, or for other reasons to comply with a legal obligation upon us.

1. We have a measure restricting access to your personal data, which only employees, agents, contractors and other third parties that need to access to fulfil the mission and duties related to the service can access your personal data.
2. All service providers are pennitted to process your personal data based on our instuctions, they are subject to a duty of confidentiality, and they are required to be compliant and demonstrate the compliance with our policy and the law.
3. Our IT systems are protected against unauthorised access with various level of controlled and password protected access rights.
4. We have measures to share your personal data with third parties, with our written instructions to ensure that your personal data is processed safely and in accordance with the PDPA. Third parties must use appropriate technical and organizational measures to ensure the security of your personal data.

6. Data transferred outside Thailand

Please be aware that your personal data may be transferred to, stored, and processed by us in our facilities with whom we may share your personal data in Japan and Singapore.

7. Retention period

If you become our employee, any relevant personal data collected during your pre-employment period will become part of your personal records and will be retained in accordance with applicable law: If we do not employ you, we may continne to to retain and use your personal data for a period of one year for system adoministration purposes, to consider you for potential fure roles and to perform research. We may retain a minimal amount of your personal data to record your recrniting activity with us to enable us to understand whether you have previously applied for a role at the Company.

We will cease to retain your personal data or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the poses for which the personal data were collected, and are no longer necessary for legal or business purposes.

8. Protecting your personal data

We are aware of the requirement to ensure your personal data is protected against accidental loss or disclosure, data destruction and abuse. We have implemented the following processesses and measurest

Where we share your data with third parties, we provide written instructions to them to ensure that your personal data are held securely and in line with the PDPA requirements. Third parties nust implement appropriate technical and organisational measures to ensure the secunity of your personal data.

9. Your privacy rights

Under certain circumstance pursuant to the PDPA, you have rights to:

1. Request access to your personal data

This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.

1. Request correction of the personal data that we hold about you

This enables you to have any incomplete or inaccurate personal data we hold about you. corrected.

1. Request erasure of your personal data

This enables you to ask us to delete or remove personal data where there is no legal ground for us to continue to process it. You also have the right to ask ask us to delete or remove your personal data where you have exercised your right to object to processing.

1. Object to processing of your personal data

This enables you to ask us to object to processing your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.

1. Request the restriction of processing of your personal data.

This enables you to ask us to suspend the process of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

1. Request the data portability of your personal data to another party.
2. Request withdraw the consent.

In circumstances where you have provided consent to the processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. However, in some cases, we may contime to process your personal data where so permitted by having another legal ground for doing so.

10. Change of personal data

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

11. Making a complaint

The supervisory authority in the Thailand for data protection matters is the Office of the Personal Data Protection Committee ("PDPC Office'). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the PDPC Office.

12. Effective date and change to Privacy Notice

This Privacy Notice shall be effective on 1" June 2021 and we reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates.

13. Contact us about this Privacy Notice

If you have questions or comments about this Privacy Notice, you may contact our Data Protection Officer, by email at bgk-pdpa @sojitz.com, or by post to

Personal Data Protection Team

Sojitz (Thailand) Co., Ltd.

Floor 19th, Q.House Lumpini Building

1 South Sathorn Road, Tungmahamek

Sathorn, Bangkok 10120

Thailand