Personal Data Privacy Notice

Personal data privacy notice for processes related to trainees, seminar attendees, interpreters and speakers of leadership development charoen pokphand group company limited

1. General Provisions

For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto, (“Laws on Personal Data Protection”) Leadership Development Charoen Pokphand Group Company Limited (“Company”) has arranged this personal data privacy notice (“Privacy Notice”) for processes related to Trainees, Seminar Attendees, interpreters and speakers of the Company to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:

2. Groups or Categories of Persons whom the Company Collects Personal Data

Under this Privacy Notice, groups or categories of persons from whom the Company collects and Processes Personal Data are as follows:

2.1 Trainees / Seminar Attendees which means persons whom may be an employee or a personnel who work for the Company, including persons who register to attend a training or a seminar hosted by the Company and/or book an accommodation with the Company.

2.2 Speakers which means persons whom may be invited or engaged by the Company to be a speaker, lecturer, instructor, etc. to share their knowledge, train, etc. in a training or a seminar hosted by the Company.

2.3 Interpreters which means persons engaged by the Company to interpret in a training or a seminar hosted by the Company.

3. How the Company Collects and Receives your Personal Data

3.1 The Company collects and receives your Personal Data via the following methods:

(a) Personal Data which you directly provide to the Company following these circumstances:

When you contact the Company whether in written or verbal form such as phone call, E-mail, mail, social media, website, application, the Company’s systems, online meeting, direct meeting, etc.
When you contact the Company at Company establishment.
When you submit a quotation or enter into a contact with the Company.
When you submit documents which containing your Personal Data to the Company.

(b) Personal Data which the Company automatically collects from you The Company may collect your Personal Data by automated means, such as the use of Cookies (Cookies) or other similar technologies.

(c) Personal Data which the Company receives from third parties The company may receive your Personal Data from third parties, such as your coordinator or companies within Charoen Pokphand Group (CP Group). In some cases, the Company may collect your Personal Data from a public data source, a data source which contains your business data, or a trade data source, etc. whether you disclose the Personal Data by yourself or give your consent to any third party to disclose the Personal Data.

3.2 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.

3.3 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, after the Laws on Personal Data Protection in regard of data collection, use, or disclosure has become effective, if you do not intend to allow the Company to collect and use Personal Data in which the Company is required to have your consent to process, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 9 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.

4. Collected Personal Data

Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by third parties, such as:

4.1 Personal information,such as first name, last name, date/month/year of birth, age, sex, weight, height, identification number, photograph, signature, nationality, race, religion, marital status, military status, motor vehicle registration, etc.,

4.2 Contact information,such as address, telephone number, E-mail, and user identification on applications (e.g., LINE ID, WeChat ID, WhatsApp ID), etc.

4.3 Information on affiliation,such as company, business unit or organization name, position, employee identification number, company address, affiliate’s contact information, etc.

4.4 Information on registration of the training, seminar, check in or any transaction with the Company,such as Personal Data which appears in a copy of the national identification card, copy of passport, visa details, copy of work permit, copy of tax identification card, copy of driving license, banking information, copy of bank account book, copy of power of attorney, copy of company certificate, copy of VAT registration certificate, invoice, tax invoice, receipt, etc.

4.5 Sensitive Personal Data,such as ethnicity, political opinion, religion, health information, (such as food allergy information, drug allergy information, congenital disease, etc.), Face Scan / Face Recognition, disability, and/or and another data which may affect the data subject in the same manner, as prescribed by the Office of the Personal Data Protection Commission, etc.

4.6 Technical information,such as log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

4.7 Other information,such as guest preference, behaviors in daily life (if any), room number, training or seminar evaluation, photo, video and sound by means of CCTV or any other devices, etc.

5. Purposes and Lawful Basis for the Processing of Personal Data

5.1 The Company Processes your Personal Data for the purposes under lawful basis as follows (collectively, the “Purposes”):

No.	Purposes	Lawful basis of the Processing
(a)	For the Purpose of training or seminar registration, including any facilitation or processes that are necessary for hosting a training or seminar.	Contractual basis: The Processing of Personal Data is necessary to host a training or seminar, including to facilitate Trainees or Seminar Attendees. Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company to conduct any processes which are necessary for hosting a training or seminar such as recording photo, sound or video during the training or seminar, collecting, manipulating, publishing, and developing educational media, developing a course, producing an identification card or a nametag to be used in a training or a seminar, creating an account or a password to access the Company’s systems, following up and evaluating a training or seminar, processing trainee or attendee directory, processing accounting document, processing insurance document, etc. Consent basis: In some cases, the processing of sensitive Personal Data such as ethnicity or the affiliate with a political party (for some Trainees or Seminar Attendees) is necessary in order to group, categorize and filter activities or responsibilities which will be undertaken by relying on the received explicit consent from the Trainees / Seminar Attendees.
(b)	For the Purpose of booking or checking in, checking out, facilitating or any other processes relating to a stay in the accommodation	Contractual basis: The Processing of Personal Data is necessary to book, check-in, check out, housekeep, return item including prepare any service or facilitation during a stay in the accommodation. Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company to conduct any process related to a stay in the accommodation such as processing accounting documents, providing shuttle services, contacting emergency contacts, creating and processing a stay report, departure report, guest report or use the Personal Data to arrange daily or emergencies, etc. Consent basis: In some cases, the Processing of sensitive Personal Data (such as drug allergy information, food allergy information and congenital disease information) is necessary for any purposes such as to provide care and security during a stay in the accommodation, a training or a seminar, to be aware of the well-being of the Trainees and Seminar Attendees, to be able to prepare meals according to the Trainees and Seminar Attendees’ preferences, to consider an appropriate activities which will be undertaken by relying on the received explicit consent from the Trainees and Seminar Attendees, unless in the circumstance that the Company may make an exemption by law such as to prevent or suppress any harm to the life, body or health of the data subject under Section 26 (1) of the Personal Data Protection Act B.E. 2562 (2019).
(c)	For the Purpose of verification of Trainees, Seminar Attendees, Speakers, or Interpreters.	Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company to verify the data subject before any process of the activities or transactions with the Company such as registration to book an accommodation during a training or seminar, verification prior the check-in, permission to enter the Company’s establishment, verification prior entering into the contract with the Company, etc. Consent Basis: For the Processing of sensitive Personal Data which appears on identification cards such as religion and blood type, when cannot conceal, redact, or avoid being collected, the company will conduct the verification process on the data subject by relying on the consent received from the data subject.
(d)	For the Purpose of conducting or complying to the contract related to the Speakers or Interpreters contract, facilitating the Speakers or Interpreters, or conducting any processes necessary for hosting a training or seminar.	Contractual basis: The Processing of Personal Data of the Speakers or Interpreters is necessary for any activities that are conduct or comply with the contract such as employment consideration, employment contract creation, payment of wages or fees, skill or competency evaluation, speaker invitation, including any facilitation during training or seminar period. Legitimate interest basis: The Processing of Personal Data of the data subject as a speaker is necessary for the legitimate interests of the Company to conduct any processes which are necessary for hosting a training or seminar such as recording photo, sound or video during the training or seminar, collecting, manipulating, publishing, and developing educational media, developing a course, producing an identification card or a nametag to be used in a training or a seminar, following up and evaluating a training or a seminar, etc. Consent Basis: In some cases, the Processing of sensitive Personal Data related to health information to evaluate your ability to work which will be undertaken by relying on the received explicit consent from the data subject.
(e)	For the Purpose of any form of public relation about the training and seminar hosted by the Company.	Contractual basis: For the processing of the Personal Data is for the purpose of any form of public relation about the training and seminar hosted by the Company, which include but not limited the cases of Personal Data which requires your consent to process as stated by Personal Data Law Protection, the Company will request for your explicit consent.
(f)	For the Purpose of communication or coordination.	Legitimate interest basis: The Processing of Personal Data is necessary for the Company’s legitimate interests on communication or coordination related to training or seminar hosted by the Company, including the services provided by the Company.
(g)	For the Purpose of sports or recreational activities.	Contractual basis: The Processing of Personal Data and sensitive Personal Data such as health information collected when register to join any sports or recreational activities may be used for any form of public relation, the creation of activity-related media, the storage of health and exercises related information, the storage of health information which may be tracked by any electronic devices after the activity to analyze and improve the sports or recreational activity, including to consider suitability and safety before the activity starts which include but not limited the cases of Personal Data which requires your consent to process as stated by Personal Data Law Protection, the Company will request for your consent. Legitimate interest basis: The Processing of Personal Data is necessary for processing of the Company’s report about sport and recreational activities. In a case where the Company’s fitness center is used, the Company will collect the Personal Data for processing of report (such as fitness center usage report, sport equipment usage report) or any necessary processes when may be in case of emergency. Consent Basis: The processing of the Personal Data is necessary to track and collect sport equipment which are borrowed.
(h)	For the Purpose of compliance with the laws relating to the Company’s business, court order, and legitimate orders of government agencies and relevant officers	Legal basis: The Processing of Personal Data is the performance in compliance with the applicable laws of the Company such as immigration law, laws relating to foreign employment, taxation law, Personal Data protection law, computer-related crime law, including court order, and legitimate orders of government agencies and relevant officers such as the Office of the Personal Data Protection Commission, etc.
(i)	For the Purpose of establishment, compliance, exercise, or defense of legal claims of the Company	Legitimate interest basis: The Processing of Personal Data is necessary for the establishment, compliance, exercise or defense of legal claims in various stages according to the laws, such as investigation and/or inquiry by government officials, case preparation, prosecution and/or pursuit of the case in court, etc.
(j)	For the Purpose of monitoring, protecting and ensuring the security of persons and properties of the Company	Preventing or suppressing a danger of person’s life, body, or health basis: The Processing of Personal Data is necessary for the benefit in monitoring, preventing, or suppressing any circumstances which may be dangerous to person’s life, body, or health Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in monitoring, protecting and ensuring the security of properties of the Company. For example, the CCTV footages can be used to prevent loss or damage to the Company’s properties or to track properties or claim damages in the case where the properties of the Company are lost or damaged, etc.
(k)	For any transaction that is necessary and beneficial to the Company or personnel or corporate bodies or those which are directly related to the purposes set forth above	Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in order to conduct any transactions which are necessary or beneficial to the Company or personnel, or corporate body or directly related to the purposes set forth above. However, on the cases of Personal Data which requires your consent to process as stated by Personal Data Law Protection, the Company will request for your consent.
(l)	For other purposes that the Company will notify you of	The Company will notify you of any other purposes that cause the Company to Process your Personal Data other than the purposes set forth above or when the Company changes the original purposes that were set forth. However, on the cases of Personal Data which requires your consent to process as stated by Personal Data Law Protection, the Company will request for your consent.

5.2 Your Personal Data which the Company will Process for the Purposes set forth in Clause 5.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.

5.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case maybe).

6. Disclosure of Personal Data

6.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:

(a) Charoen Pokphand Group (CP Group), in and outside Thailand, including executives, directors, staffs, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

(b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, information technological services, security service, payroll service, data recording services, payment services, mailing services, delivery services, printing services, health services, insurance services, training services, data analysis services, research services or any other services which may be beneficial to you or relevant to the Company’s business operation, (such as commercial bank, hospital, life insurance company, and non-life insurance company), etc.

(c) Advisors of the Company, such as legal advisors, lawyers, auditors, actuaries, in or any other internal and external experts of the Company, etc.

(d) Courts and relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission in pursuant to applicable laws, such as Immigration Bureau, Ministry of Labor, The Revenue Department, Office of the Personal Data Protection Commission, etc.

(e) Any persons or any other entities that you have given consent to disclose your Personal Data to such as photo or videos on the Company’s public medias. etc.

6.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law. If the law requires your consent to be provided, the Company will request for your prior consent.

6.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. For the cases where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under Laws on Personal Data Protection.

7. Retention Period

The Company will retain your Personal Data for the period necessary to fulfill the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. Furthermore, the Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.

In this regard, the Company will retain your Personal Data for the period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.

After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the circumstance that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8. Your Rights in relation to Personal Data

As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. However, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8.1 Right of Access Personal Data You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

8.2 Right to Personal Data Portability You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

8.3 Right to Object Personal Data Processing You have the right to raise an objection to the Processing of your Personal Data in circumstances prescribed under the Laws on Personal Data Protection.

8.4 Right to Personal Data Erasure You may request that the Company delete, destroy or anonymize your Personal Data in circumstances prescribed under the Laws on Personal Data Protection.

8.5 Right to Personal Data Restriction You have the right to request that the Company restrict the Processing of your Personal Data in circumstances prescribed under the Laws on Personal Data Protection.

8.6 Right to Personal Data Rectification You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date, incomplete, or may cause misunderstandings.

8.7 Right to Withdraw Consent If the Company relies on your consent as the lawful basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

8.8 Right to Lodge a Complaint If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

However, the Company reserves the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

9. How to Contact the Company

If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:

Leadership Development Charoen Pokphand Group Company Limited E-mail: [•] dpo@cpli.co.thAddress: [•] 999 M 5 T.Nongnamdang, Pak Chong, Nakhonratchasima, 30450Telephone: [•] (+66) 44 007 800
Data Protection Officer E-mail: [•] dpo@cpli.co.thAddress: [•] 999 M 5 T.Nongnamdang, Pak Chong, Nakhonratchasima, 30450Telephone: [•] (+66) 44 007 800

10. Changes to This Privacy Policy

The Company may make changes to this Privacy Policy from time to time to reflect any changes to our Processing of your Personal Data and to comply with the changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Policy and the amended Privacy Policy through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Policy from time to time.

This Privacy Policy shall be effective from 1 March 2023

Version 3.0 (Updated on March 1, 2023)

Personal data privacy notice For processes related to vendors, contact persons, and corporate social responsibility participants of leadership development charoen pokphand group company limited

1. General Provisions

For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto, (“Laws on Personal Data Protection”) Leadership Development Charoen Pokphand Group Company Limited (“Company”) has prepared this personal data privacy notice for processes related to vendors, contact persons, and corporate social responsibility participants of Leadership Development Charoen Pokphand Group Company Limited (“Privacy Notice”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:

2. Groups or Categories of Persons from whom the Company Collects Personal Data

Under this Privacy Notice, groups or categories of persons from whom the Company collects and Processes Personal Data are as follows:

2.1 Vendors which means natural persons who may become vendors of the Company, both in the case where such persons have declared intentions to enter into a contract or provided quotations for products and/or services to the Company or register or registered as vendors of the Company or any other persons having similar characteristics, such as sellers, service providers, contractors, meeting organizers, sponsors consultants, or experts, etc.;

2.2 Persons in relation to vendors which means natural persons who are related to vendors or act as representatives or personnel of juristic persons who are prospective vendors or vendors of the Company, such as directors, employees, managers, coordinators of the vendors, including those whose Personal Data appears in various documents in connection to relevant processes, such as quotation approvers, or salespersons, etc.;

2.3 Contact Persons which means any person who are in contact with the Company, visitors of the Company, minors or third parties who want to access the property of the Company

2.4 Corporate social responsibility participants which means persons who participate in activities of social and environmental responsibility (Corporate Social Responsibility), minors, and including the coordinators of corporate social responsibility activities.

3 How the Company Collects and Receives your Personal Data

3.1 The Company collects and receives your Personal Data via the following methods:

a) Personal Data which you directly provide to the Company You may directly provide your Personal Data to the Company such as:

When you are in contact with the Company through various communication channels such as, telephone, email, mail or any other social media.
When you make a contact with the Company at the establishment of the Company.
When you provide a quotation for products or services to the Company or when you enter into a contact with the Company.
When you deliver documents and copies of documents which contain Personal Data to the Company.
When the Company will notify you on the collection of your Personal Data to carry out the activities of the Company.
When you make enquiries, provide comments or feedback, or send complaints to the Company.

b) Personal Data which the Company automatically collects from you The Company may collect your Personal Data by automated means such as the use of Cookies or other similar technologies.

c) Personal Data which the Company receives from other sources or third parties The Company may receive your Personal Data from other sources or third parties such as the collection of your Personal Data via your contact persons or companies in the group or affiliates of the Company. In some cases where the Company may collect your Personal Data from public data sources or sources containing your business information or information relating to trades, etc.

3.2 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.

3.3 In the event where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 9 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.

4. Collected Personal Data

4.1 Personal information, such as first name, last name, date/month/year of birth, age, sex, national identification number, passport number, taxpayer identification number, photograph, picture, video, nationality, signature, vehicle registration number, or brand and colour of the vehicle, etc.

4.2 Contact information, such as residential address, commercial address, telephone number, email, and application user ID (such as LINE ID, WeChat ID, WhatsApp ID), etc.

4.3 Information related to business, such as names of companies, business units or organizations, position name, etc.

4.4 Information that is used as supporting evidence in the Company’s vendor registration or execution of transactions such as vendor code, seller code, data of bank account, copy of bank account, photograph during operation, Personal Data on copy of national identification, copy of passport, copy of visa, copy of work permit, copy of house registration book, copy of driving license, copy of power of attorney, copy of company affidavit, copy of certificate of value added tax registration, quotation, invoice, cheque and cheque stub, receipt, copy of professional or business license, etc.

4.5 Sensitive Personal Data, such as Personal Data related to religion, health information, disability and/or other data which may affect the data subject in the same manner, as prescribed by the Office of the Personal Data Protection Commission, etc.

4.6 Technical information, such as log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

4.7 Other information, such as photographs and video recording by means of CCTV, etc.

5. Purposes and Lawful Basis for the Processing of Personal Data

5.1 The Company Processes your Personal Data for the purposes under lawful basis as follows (collectively, the “Purposes”):

No.	Purposes	Lawful basis of the Processing
(a)	For the Purpose of procurement, selection and vendor registration	Contractual basis: The Processing of Personal Data for carrying out requests for quotation proposals before entering into a sales contract, a procurement contract, a service contract, or any other contracts and for carrying out a vendor registration or any other performances in the similar means. Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in its business operation and compliance with the Company’s procurement policy such as the verification of information and qualifications of vendors, the collection of your Personal Data that you have been disclosed on websites or other public sources, etc.
(b)	For the Purpose of verification of vendors or persons in relations to vendors	Legitimate interest basis: The Processing of Personal Data of vendors or persons in relations to vendors is necessary for the legitimate interests of the Company in the verification of such persons. Consent basis: For the Processing of sensitive Personal Data which appears on identification cards such as religion and/or blood type when cannot conceal, redact, or avoid being collected, the Company will conduct the verification process by relying on the consent received from such persons.
(c)	For the Purpose of consideration approval of contractors’ accessibility for working at the property of the Company, providing reports or monitoring the work of contractors	Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in the consideration of the approval of contractors’ accessibility for working at the property of the Company, providing reports or monitoring the work of contractors.
(d)	For the Purpose of contract preparation, contract fulfillment, and contract management between the Company and any other contractual parties	Contractual basis: The Processing of Personal Data of the contractual party is necessary for carrying out the requests of such party who has expressed the intention to enter into an agreement with the Company or carried out the duties on such contracts such as receiving products and services, providing quotations for products and services, paying for products and services. Legitimate interest basis: The Processing of Personal Data of the contractual party or persons in relations or representatives of contractual parties. In the event where contractual parties are juristic persons is necessary for the legitimate interests in providing and managing the Company’s contracts such as the verification of qualifications of contractual parties, the verification of business licenses of vendors or vendors’ personnel, the use of data of persons in relations or representatives of vendors as supporting documents for entering into contracts where in the case of vendors are juristic persons, the communication with vendors, representatives, or personnel of vendors, etc.
(e)	For the Purpose of communication of social and environmental responsibility activities (Corporate Social Responsibility), and promotion of the Corporate Social Responsibility performance of the Company	Legitimate interest basis: The Processing of Personal Data of corporate social responsibility participants is necessary for the legitimate interests in performing social and environmental responsibility activities (Corporate Social Responsibility) of the Company and communicating about corporate social responsibility, including carrying out corporate social responsibility obligations to fulfill the established Purpose. Contractual basis: In cases where the Company may use or disclose the Personal Data of corporate social responsibility participants for promoting corporate social responsibility activities of the Company, including in and outside promotions of the Company. The Company will conduct the process by relying on the consent received from such persons.
(f)	For the Purpose of carrying out work and communication with contact persons who are in relation with the Company for visiting and promoting activities.	Legitimate interest basis: The Processing of Personal Data of the visitors is necessary for the legitimate interests in handling pictures of the visiting activities as souvenirs and carrying out work obligations to fulfill the established Purpose. Consent basis: In the case where the Company may use or disclose the Personal Data of visitors for promotion and organization communication activities in and outside of the Company and affiliates of the Company, regardless of the promotions may take place in or outside the Company. The Company will conduct the process by relying on the consent received from such persons.
(g)	For the Purpose of compliance with relevant laws which are applicable to the Company’s businesses, court orders, and legitimate orders of government agencies and relevant officials	Legitimate interest basis: To act in compliance with laws which are applicable to the Company, such as taxation laws, Laws on Personal Data Protection, Laws on Computer-related Crime for applying licenses and/or preparing documents for presenting to government agencies and relevant officials and the Company has to comply or follow court orders or legitimate orders of government agencies and relevant officials such as Office of the Personal Data Protection Commission.
(h)	For the Purpose of establishment, compliance, exercise or defense of legal claims, in various stages according to the laws	Legitimate interest basis: The Processing of Personal Data is necessary for the establishment of legal claims or in various stages and processes according to laws such as investigation and/or inquiry by government officials, case preparation, prosecution, and/or pursuit of the case in court, etc.
(i)	For the Purpose of monitoring, protecting and ensuring the security of persons and properties of the Company	Preventing or suppressing danger to a person’s life, body, or health basis: The Processing of Personal Data is necessary for the benefit in monitoring, preventing, or suppressing any circumstances which may be dangerous to a person’s life, body, or health. Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company in monitoring, protecting and ensuring the security of properties of the Company such as the collection of Personal Data of contact persons who in relation with the Company for accessing the property of the Company or the CCTV footages can be used to prevent losses or damages to the Company’s properties or to track properties or claim damages in case where the properties of the Company are lost or damaged, etc.
(j)	For any transaction that is necessary and beneficial to the Company or persons or juristic persons or directly related to the Purposes set forth above	Legitimate interest basis: The Processing of Personal Data is necessary for the legitimate interests of the Company or persons or juristic persons in carrying out any transactions which are necessary for the Company and/or beneficial to you or directly related to the purposes set forth above. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.
(k)	For other purposes that the Company will notify you of	The Company will notify you of any other purposes that cause the Company to Process your Personal Data other than the purposes set forth above or when the Company changes the original purposes that were set forth. In this regard, where the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request the consent from you.

5.2 Your Personal Data which the Company will Process for the Purposes set forth in Clause 5.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such an event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.

5.3 In the case where the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case maybe).

6. Disclosure of Personal Data

6.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:

(a) Charoen Pokphand Group (CP Group), including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

(b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services such as security service, information technological services, data recording services, document storage services, payment services, mailing services, delivery services, printing services or any other services which may be beneficial to you or relevant to the Company’s business operation.

(c) Advisors of the Company, such as legal advisors, lawyers, auditors, actuaries, in or any other internal and external experts of the Company, etc.

(d) Courts and relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission in pursuant to applicable laws such as Revenue Department, Ministry of Commerce, Office of the Personal Data Protection Commission, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, and court, etc.

(e) Any persons or any other entities that you have given consent to disclose your Personal Data to.

7. Retention Period

8. Your Rights in relation to Personal Data

8.4 Right to Personal Data Erasure You may request that the Company delete, destroy or anonymize your Personal Data in circumstances prescribed under the Laws on Personal Data Protection.

However, the Company reserves the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

9. How to Contact the Company

If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:

Leadership Development Charoen Pokphand Group Company Limited E-mail: [•] dpo@cpli.co.thAddress: [•] 999 M 5 T.Nongnamdang, Pak Chong, Nakhonratchasima, 30450Telephone: [•] 044-007-800
Data Protection Officer (DPO) E-mail: [•] dpo@cpli.co.thAddress: [•] 999 M 5 T.Nongnamdang, Pak Chong, Nakhonratchasima, 30450Telephone: [•] 044-007-800 ext. 8910

10. Changes to This Privacy Policy

The Company may make changes to this Privacy Policy from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Policy and the amended Privacy Policy through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Policy from time to time.

This Privacy Policy shall be effective from 1 May 2022

Version 2.0 (Updated on May 1, 2022)