Privacy Notice

3.1 The Company collects and receives your personal data through the channels as follows:

1. Personal data which you directly provide to the Company: You may directly provide your personal data to the Company when you fill out any forms through the Company's website or other channels of the Company together with your contract and other copies of documents which contain your personal information, or when you request for information, giving opinions or comments, submitting complaints to the Company by telephone, e-mail, fax, post, etc.

2. Personal information which the Company automatically collects from you: The Company may collect certain technical information about your device, activities, types of viewing, browsing by Cookies and other similar technologies. For other details, please see Cookie Policy.

3. Personal information which the Company obtains from outsiders: The Company may obtain your personal information from outsiders, such as government agencies, websites of the Department of Business Development, Revenue Department, or other websites.

3.2 When collecting your personal information, you shall be informed of the details in this Privacy Notice, including legal bases for collecting, using and/or disclosing personal data according to the laws. In case that the personal data protection law requires your consent, the Company shall request your consent to allow the Company to process your personal information.

4.1 Personal information collected by the Company under this Privacy Notice can be from different types of data subjects as follows:

1. Customers and investors such as a normal person who holds securities, website visitors, service recipients, participants to activities or seminars, and others who contact to receive information or services from the Company both directly and indirectly.

2. Contract partners, professionals, and related persons to the Company's business such as a normal person who is a contract partner or related to the Company's contracts, including business partners, sellers, service providers, contractors, consultants, professionals in the securities business, and other similar persons

3. The Company's personnel such as normal persons who are the Company's employees, staff or any other persons who work for the Company, directors, managers, executives, specialists and persons obtaining salaries, wages, benefits or any other remunerations directly from the Company, including family members of the Company's personnel

4. Applicants such as a normal person submitting an application or details of personal history to the Company in writing or verbal with a purpose for a job/internship/scholarship as employee or staff/trainee/applicant of the Company, but not yet considered by the Company, including the applicant's family members and reference persons

4.2 Your personal data collected under this Privacy Notice, which you directly provide to the Company or the Company automatically collects from you, or personal information that the Company receives from outsiders as follows:

1. Personal information such as a normal person who holds securities, website visitors, service recipients, participants to activities or seminars, and others who contact to receive information or services from the Company both directly and indirectly.

2. Sensitive personal data such as religion, criminal history, health information, results of health check-up, disability, and biometric information

3. Contact information such as home address, phone number, e-mail, social media contact, and details of contact person in case of emergency

5. Information about securities/derivatives such as trading account, interest or dividend, deposit/withdrawal, transfer or change of holders, and securities pledge notification

6. Technical information including your access to the Company's websites and systems, Log data, contacts and communications between you and other users, recorded information such as computer IP address, code and type of device, mobile network, data connection, GPS, Browser, log-in and log-out of system, referring website, Login Log history, transaction Log, customer behavior, access time, data search, use of functions, the Company's Cookies, or other similar technologies

7. Information about education, training, and employment such as educational background and training, certificate of qualification or academic transcript, scores or grades, level of education, language proficiency, professional license, registration number, issued date of registration, expired date of registration, renewal of registration, employment data, start date of employment, training and testing information provided by the Company or other related agencies, diploma or certificate, employment history, salary or wages

8. Other information such as video and/or audio recording via CCTV, photo, video and audio recording, recorded conversation, and purchasing trends of goods or services

4.3 If the Company collects your personal information before June 1, 2021, it shall process such information in compliance with the laws on personal data protection.

5.1 The Company processes your personal data for the following purposes (collectively, the “Designated Purposes”) and legal bases as follows:

5.2 Since your personal information for processing with the above specified purposes in 5.1 is relevant to the laws or a contract and necessary for the achievement of such purposes, if you do not provide such personal information to the Company, there shall be legal implications or the Company may not be able to perform its duties under a contract with you or may be unable to have a contract with you. Thus, the Company may be obliged to decline a contract with you or cancel services related to you in whole or in part.

5.3 If the Company wishes to use your personal information for the purposes not specified above, it shall provide an additional privacy notice to explain the use of data for those purposes. You should read the additional privacy notice together with this privacy notice.

6.1 The Company may disclose your personal information under the specified purposes and relevant to the laws to the agencies and persons as follows:

1. The Stock Exchange of Thailand and listed companies in the Stock Exchange of Thailand, including employees, staff, directors, managers, or personnel of the Company as a need-to-know basis for the processing of your personal information

2. Government and regulatory agencies, such as the Securities and Exchange Commission, Bank of Thailand, Office of the Government Information Commission, Office of Insurance Commission, Department of Provincial Administration, Revenue Department, Department of Business Development, and Department of Intellectual Property

3. Agencies requesting for disclosure of personal information according to the laws for litigation or legal actions or related to legal processes, such as the Anti-Money Laundering Office, Office of the National Anti-Corruption Commission, Royal Thai Police Department, Special Investigation, and Office of the Attorney General

4. Associations related to the capital market business in Thailand, such as the Thai Listed Companies Association, Association of Thai Securities Companies, Association of Investment Management Companies, Thai Bankers Association, Securities Analysts Association, and the Thai Investors Association

5. Securities issuer companies, member companies, securities companies, Asset Management Company, brokerage, trading or underwriting of securities

6. Alliances, business partners, service providers, service recipients and personal data processors assigned by the Company for service duties or management of personal information, such as development, improvement, or maintenance of safety standards of work systems, and information technology systems, payment system, accounting audit, Human Resources Management, or any other services that may be beneficial to you

6.2 Disclosure of your personal information to others shall be performed under specified purposes or other purposes only as required by laws. If your consent is required, the Company shall request your clear consent first.

6.3 If the Company sends or transfers your personal information abroad, it shall ensure that the sending or transfer reaches the destination countries, international organizations or overseas recipients with sufficient personal data protection standards. In some cases, the Company may request your consent for the transfer of your personal data abroad, depending on the applicable personal data protection laws.

7.1 The Company shall keep your personal data for a necessary period to achieve the specified purposes in processing of such personal data. The duration shall vary depending on the purposes of collecting and processing personal data.

7.2 Personal data shall be kept for a period of time as required by laws and according to business practices for each type of personal data. After such period, the Company may destroy the personal data from its storage or systems without prior notice to you.

8.1 Right to access personal data

You have the rights to access your personal data and request the Company for copies of such personal data, including disclosure on the acquisition of your personal information which the Company collects, uses, and discloses without your consent in accordance with the personal data protection laws.

8.2 Rights to transfer personal data

You have the right to obtain your personal data generally in a readable or usable form through an automated tool or device, including the right to request the sending or transfer of your personal data in such form to another personal data controller or yourself, unless it cannot be done due to some technical conditions in accordance with the personal data protection laws.

8.3 Rights to reject processing of personal data

You have the right to reject processing your personal data as follows:

If you reject the processing, please indicate whether you wish your personal data to be deleted or suspend the Company from processing such personal data.

8.4 Rights for deletion of personal data

You may request the Company to delete or make your personal information non-personally identifiable as follows:

The above cases shall not apply to the necessary processing of personal data for freedom of expression, documentary history, or statistics in performing duties to the public interest according to the laws towards preventive or occupational medicine objectives, or public interest in public health, while establishing, exercising or fighting legal claims, and complying with laws.

8.5 Rights to suspend the use of personal data

You have the right to suspend the processing of your personal data as follows:

8.6 Rights to correct personal data

You have the rights to request for correction of your personal data if it is inaccurate, outdate, incomplete, or misled.

8.7 The rights to withdraw consent

You have the right to withdraw your consent to the processing of your personal data any time during the personal information is in the possession of the Company.

8.8 The rights to file a complaint

If you have any concerns or questions about the processing of your personal data, please contact the Company by the contact details in 11. In case of the violation of personal data protection laws, you have the rights to file a complaint with the Office of the Personal Data Protection Commission.

The Company shall apply relevant systems to facilitate and process your request without delay, unless the request creates an unreasonable burden on the Company or risks of infringing on the protection of personal information of others, or against the laws, or impossible to act upon the request.

The Company establishes and/or uses a system to store your personal information with appropriate mechanisms and techniques, as well as security measures according to the laws on personal data protection and related laws, including limiting access to your personal data from employees, staff, and representatives of the Company to prevent your personal information from being used, disclosed, destroyed or accessed without permission.

The Company may have links to websites, applications, products, and services of outsiders. Those outsiders may take some information on your use of services. This privacy notice is only for the processing of personal data for the purposes specified by the Company. The Company cannot be responsible for the security or privacy of any of your information collected by the website, applications, products, or services of outsiders. You should be careful and review the privacy notices/privacy policy of individual websites, applications, products, and services of such outsiders.

If you have any questions about this privacy notice or wish to exercise your rights in this Privacy Notice, you can contact the Company by the contact details as follows:

Sermsang Infinite Co., Ltd.

325/14 Lanlaung Rd, Mahanak Square, Dusit, Bangkok 10300 Thailand

Tel. +66 2628 0991-2

Email: [email protected]

This Privacy Notice is enforced and construed in accordance with Thai laws. The courts of Thailand are authorized to administer any disputes that may arise or in connection with this Privacy Notice.

The Company may from time to time amend this Privacy Notice to comply with any changes related to the processing of your personal data and any amendments in the personal data protection laws or other relevant laws. The Company shall notify you of any changes through appropriate channels.

This Privacy Notice is effective from 1 April 2022.

Sermsang Infinite Co., Ltd.