Rasa Tower Company Limited and its affiliates (Rasa Ventures Co., Ltd., Day Star Co., Ltd., Rasa HMC Partner Co., Ltd., Rasa Land Co., Ltd.) are aware of the importance of your privacy rights when we use your personal data for our business operation and provide services to you. Therefore, we strictly protect your personal data in accordance with the Personal Data Protection Act, B.E. 2562 (2019).

We, as the protector of your personal data, are obliged to strictly comply with the law to inform you of our privacy policy for data subject which describes the collection, usage, or disclosure of your personal data, as well as your rights as the data subject data subject. We hereby confirm that we have strictly complied with the law in order to protect your personal data.

1. Definitions of Personal Data

Personal data can be divided into two categories namely
Personal data (general) means any information relating to a person, which enables the identification of such person, whether directly or indirectly, such as name, surname, address, email address, ID card number.
Sensitive Personal Data means personal data that requires special protection and particular care when collecting, using or disclosing this type of personal data such as personal data on race, ethnicity, political opinion, cult, religion or philosophy, sexual behavior, criminal record, health information, disability, trade union information, genetic data and biological data.

2. Personal data that we collect from you

We collect your information when:

• You visit our website.
• You provide information to us through the website or application.
• You provide information to us through our online or regular contact channels.

We will keep your personal data to the extent necessary for your service provisions, to answer your inquiries and to conduct business operation in accordance with your expectation that we will use your personal data only for the aforementioned purposes. We may collect, use, or disclose different types of your personal data which can be classified into the following categories:

3. Source of Personal Data

1. We will obtain your personal data directly from the following channels

• You make registration by creating an account through website or application.
• You contact us to obtain product/service information that you are interested in.
• You make an appointment to view our products/services.
• You provide us with information when you agree to purchase products/services from us.
• You participate in our promotional activities via electronic channels or social network channels or regular channels.

2. Your personal data, that we received from a third party who collects, uses or discloses personal data according to our order or on our behalf, will not be used for any mean other than for the purposes that we have determined or ordered. In addition, we have required the third party to maintain confidentiality and protect your personal data according to personal data protection law of Thailand.

3. Personal data obtained from cookies when you visited our website. These data would help us to provide better, faster and safer service while maintaining your privacy when you use our service and/or enter our platform.

4. Objectives for Collection, Usage and Disclosure of Personal Data

We use your personal data within the scope of data protection laws and collect only the data required for the same. We will only collect data related to service provision between you and us which are required:

• For our legitimate interests or legitimate interests of a third party or your legitimate interests without prejudice fundamental rights in your personal data;
• For performance of contract in which you are a party or for performance in accordance with your request before entering into the contract;
• To comply with our laws or to prevent or suppress dangers to a person's life, body or health;

We have summarized our utilization of your personal data for service provision and explained lawful basis of personal data processing which we adopted for each activity in the table below.

We may use more than one legitimate personal data processing base for processing your personal data depending on purposes of each of our activities which utilize your personal data.

5. Disclosure or Sharing of Personal Data

1. We may disclose or share your personal data to the following third parties:

• Affiliates;
• Online advertising platform;
• Marketing company or consultant;
• Regulatory agencies such as the Office of the Commissioner for Personal Data Protection;
• Business or professional consultant;

We require the abovementioned third parties that we disclose or share your personal data to maintain confidentiality and protection of your personal data according to standards stipulated in the personal data protection laws of Thailand and to use your personal data only for the purposes that we have prescribed or instructed. The third parties shall not be able to use your personal data beyond the aforementioned purposes.

2. Upon request, we may disclose your personal data to relevant authorities to comply with the laws, for example, to prevent threats to life or body, for the purposes of law enforcement, accusation, exercise of legal rights, and fraud prevention.

6. Retention and Retention Period of Personal Data

We will retain your personal data in our data system under standardized security for usage of our data system and your personal data with the following measures.

• Restrict access to personal data by employees, agents, partners or third parties. Third parties can only access personal data under requirements or given instruction and shall maintain confidentiality and protection of personal data.
• Provide technological means to prevent unauthorized access to computer systems.
• Destroy your personal data to maintain confidentiality when such personal data are no longer needed for legal and business purposes.
• Establish a process to deal with cases of personal data violations or suspected cases and must report personal data violations to the Office of the Commissioner for Personal Data Protection according to the requirements of legal provisions.

Retention Period of Personal Data

• We will retain your personal data for a period necessary to carry out the purposes of our service provision and in accordance with the period stipulated by accounting standard, legal standard and other relevant regulations.
• In order to determine retention period of personal data, we will consider the number, nature of usage, service purposes, sensitivity of personal data, potential risks of misuse of personal data, and duration required by applicable law.
• Your personal data, obtained from cookies when you visited our website, will be retained for no more than 13 months or as required by relevant law.

7. Rights of Data Subject

As data subject, you are entitled to the following rights to the extent permitted by law:

1. You have the right to withdraw your consent to process your personal data that you have previously given your consent to us at any time when your personal data are under our possession (Right to withdraw Consent).
2. You have the right to access your personal data and request us to provide you with a copy of your personal data as well as request us to disclose source of your personal data which you have not given consent to us (Right of Access).
3. You have the right to request us to rectify your personal data or add incomplete data (Right to Rectification).
4. You have the right to request us to delete your data for some reasons (Right to Erasure).
5. You have the right to request us to stop using your personal data for some reasons (Right to Restriction of Processing).
6. You have the right to transfer personal data that you provided to us to another data controller or yourself for some reasons (Right to Data Portability).
7. You have the right to object processing of your personal data for some reasons (Right to Object).

You can contact Data Protection Officer (DPO) / the Company's officer to submit a request for exercise of the abovementioned rights.

8. Marketing Activities and Sale Promotions

We may conduct marketing activities and sale promotions or arrange third parties under our requirements or instructions to do the same in the following cases

• In case, we use your personal data to provide direct marketing to you. We will only do so upon your express consent and we have already informed you the purposes for using your data for direct marketing. In this regard, you can withdraw your consent to us to use your personal data for direct marketing at any time through our opt-out system.
• In case, you participate in sale promotional activities of the Company such as games or activities in various social network channels which aimed to promote our products and services to the general public, we will not process your data for direct marketing unless you have given us an express consent to use your personal data for direct marketing. We will inform you the purposes for using your data for direct marketing. In this regard, you can withdraw your consent to us to use your personal data for direct marketing at any time through our opt-out system.

9. Cookies Policy

Cookies are text files in your computer that are used to store log information regarding your internet usage or your browsing behavior.

We use cookies to store information about your visit to our website to help us provide better, faster and safer service while maintaining your privacy when you use our services via our website. We use cookies in the following cases:

• Functionality Cookies: We use this type of cookies to help us recognize your device or browser so that we can tailor our contents to suit your personal interests more quickly and improve services on the platform to be more convenient and beneficial to you. To disable these cookies, you can set up your device by referring to help and support of your browser or device.
• Analytic Cookies: We use Analytics Cookies provided by Facebook and Google to analyze the traffic of our website visitors in order to offer you products or services through social media advertising. If you do not wish to allow these third parties to process your personal data, you can choose to deactivate these cookies on our website.

10. Personal Data Protection Policy of Other Websites

This privacy policy applies solely to our service and usage of our website. If you have clicked on a link to other website (even via channels on our website), you must study and comply with the privacy policy displayed on such other website in addition to ours.

11. Amendment to Personal Data Protection Policy

We will regularly review the effectiveness of this privacy policy. However, if there is any change in the privacy policy, we will post or publish such change to the policy on our website or other platforms.

12. Contact Channel

Details of Data Controller

If you wish to contact us to exercise your rights as data subject or send us any inquiries and (additional) complaints, you can contact us via the following channel.

Rasa Tower Company Limited and its Affiliates