Trans.Ad Solutions Company Limited (the “Company”, “we”, “us”, or “our”) recognizes the importance of the protection of Personal Data relating to our business partners. This privacy policy for business partner (“Privacy Policy”) explains how we collect, use and/or disclose Personal Data of the business partner’s personnel, authorized persons, authorized signatories, directors, shareholders and other contact persons (collectively referred to as “you”, or “your”) and informs you the rights relating to Personal Data protection.

“Business Partner”, according to this Privacy Policy, includes, without limitation, business partners, distributors, suppliers, vendors, service providers, construction contractors, investors, analysts, shops, billboard tenants, independent advisors, securities companies, insurance companies, insurance brokers, insurance agents, banks, joint venture partners, and third parties e.g., third parties requesting to enter the area, contractor’s sub-contractors, related persons according to the rules of the Securities and Exchange Commission (e.g., spouse, children under the age of 20), and other business alliances.

The Company collects, uses and/or discloses your Personal Data because we currently have business relationship with you or may have business relationship with you in the future, or because you work for, represent, or proceed on behalf of our business partners, e.g., companies which supplies or provide services for the Company, or which we have business communication with which may involve you.

”Personal Data” means any directly or indirectly identified or identifiable information about you (excluding information concerning the deceased).

“Sensitive Data” means Personal Data which is considered to be sensitive according to the law.

The specific types of Personal Data collected will depend on the relationship which you have with the Company as follows:

• Personal details, such as name – surname, title, age, gender, photo, video, CCTV record, geographic location, date of birth, nationality, marital status, financial status, educational and professional information (e.g. position, division, division code, occupation, information contained in job application, company that you worked for or past employer, certification of employment, salary confirmation letter, professional license, work permit, visa, training information, income and salary, first date of work), identifiable information on government-issued document (e.g., national identification card number, passport number, taxpayer identification number, driving license number, house registration number), vehicle-related information (e.g., vehicle identification number or vehicle registration number), signature (including electronic signature), business partner’s identification number (including type of business partner, type of business, area of business), business partner’s information (e.g., evaluation score of business partner/service provider, merchant identification number, business partner registration date), bank account and payment information (e.g., bank account name, bank, bank account type and number, beneficiary account name, payment date, payment method, payment currency and payment account, domestic and cross-border transfer details), credit card details (e.g., credit card number, cardholder name, expiration date), including information relating to pricing strategy, discount rate, sales volume, disbursement items, disbursement amount, details relating to lands that you own (e.g., land rights certificate number), number of shares, securities holder registration number, number of securities and dividend amount);

• Contact details, such as phone number, mobile phone number, facsimile number, address, place of business address, email address, postal code, social media account information (e.g., LINE ID, Facebook account and available time) and other similar information;

• Information relating to the interactions between the Company and the business partner, such as information that you have given to the Company (as appeared in agreement, form or survey), transactional information between you and the Company (e.g., lease agreement or purchase and sale agreement, contractor agreement, consultancy agreement, tendering or bidding document), information relating to purchase and sale transaction with related person/third party, product type, budget type, disbursement budget, expense details, traveling expense, date of purchasing product/service, amount of products/services purchased, number of disbursement items, budget, headquarter number, document number, project name, registered company, creditors, branch, area and payment terms, computer data (e.g., IP address or cookies), vendor and service provider status inspection result, including information from the terms of reference or scope of tendering/bidding/procurement, report of interests, incident report, litigation information, details of quotation in procurement project, annual vendor/service provider evaluation report, CCTV record and construction details for each project;

• Information of your related person, such as identified information of your spouse or children, information about employee working for company relating to you;

• Sensitive data, such as health data, Sensitive Data from national identification card (e.g., nationality and religion) or Sensitive Data which can be used in litigation.

We will collect, use, disclose and/or transfer Sensitive Data cross-border only on the basis of your explicit consent or where permitted by law.

2.1 Channels for Personal Data collection

The Company may collect your Personal Data through multiple channels including:

• Directly from you (e.g., when you conduct business with the Company or sign an agreement or fill out a form during interactions with the Company, including interactions through our online platforms, website or mobile application, communication via email, phone, survey, name card, postal, during meeting and activity or meeting arrangement with you);

• From business partners or service providers that you work for, represent or act as agent;

• Companies under BTS Group;

• From database in the Company’s system, central drive/central database or transportation software and/or electronic file;

• From public domain e.g., social media platforms and third-party websites or relevant government agencies; and/or

• From other third parties e.g., other business partners of the Company, reference persons, complainants.

2.2 Personal Data of third party

If you provide Personal Data of third party to the Company e.g., spouse, children, parents, authorized persons or any other persons, please inform such third party of this Privacy Policy for their acknowledgement and request their consent to the Company if necessary, unless there is other legal ground(s) permitted for disclosure of Personal Data of such third party.

2.3 Personal Data of incompetent person

The Company only collects the Personal Data of children, quasi-incompetent person and/or incompetent person where their parent or guardian has given their consent. The Company does not knowingly collect Personal Data from customers under the age of 20 without their parental consent when it is required, or from quasi-incompetent person and incompetent person without their legal guardian’s consent (as the case may be). In the event that the Company learns that we have unintentionally collected Personal Data from anyone under the age of 20 without parental consent when it is required or from quasi-incompetent person and incompetent person without their legal guardians’ consent,the Company will delete it immediately or collect, use and/or disclose if we can rely on other legal basis apart from consent or where permitted by law.

3.1 THE PURPOSES OF WHICH WE RELY ON CONSENT

After having obtained your consent, the Company may collect, use, disclose and/or transfer your Sensitive Data cross-border, for the following purposes:

• Sensitive Data as appeared in identification documents (e.g., religion and nationality): for the purposes of authentication and verification;

• Health data: for food preparation and facilitation.

Where we rely on consent for the collection, use and/or disclosure of Personal Data, you have the right to withdraw your consent at all time by contacting us (please see contact details in Item 8 of this Privacy Policy). The withdrawal of consent will not affect the collection, use and/or disclosure of Personal Data and Sensitive Data that was previously consented before the withdrawal. The Company may request your consent directly from you or through the Companies under BTS Group, business partners and/or other legal entities.

3.2 THE PURPOSE THAT WE MAY RELY ON LEGAL BASES IN PROCESSING YOUR PERSONAL DATA

We will collect, use and/or disclose your Personal Data based on the context of your interactions with us by relying on legitimate interest, contractual basis, legal compliance, consent or other legal bases permitted under the applicable laws concerning personal data protection (as the case may be), for the following purposes:

1) For business purposes, such as to proceed business transactions with business partners and fulfil our duties and/or requests from business partners, to contact business partners regarding products, services and projects of the Company or the business partners (e.g., to respond to questions or requests);

2) For selection of business partners, such as to verify you and status of business partners, to check status of business or perform other background checks and screen you and business partners, to assess your and business partners’ suitability and qualifications, to assess your and business partners’ risks (including the verification of public information from law enforcement agencies and/or the Company’s blacklist record), to prepare quotations or bidding offer, to enter into agreements, prepare purchase orders or purchase requests with you or business partners and to evaluate your and business partners’ management;

3) For relationship management, such as to keep your Personal Data up-to-date, to maintain the accuracy of Personal Data, to keep agreements, relating documents, agreement’s reference documents and evidence of the work of business partners which may mention you, to plan, operate and manage (contractual) relationships and rights with business partners (e.g., to appoint, withdraw or authorize business partners to engage in transaction and order products or services, process payment, to conduct activities relating to accountancy, audit, invoice issuance, management of product and service delivery), to manage your requests or complaints, to improve, support, monitor, and record;

4) For business communications, such as communication with business partners about products, services and projects of the Company or business partners (e.g., communication via document, response to questions, requests or operational progress report);

5) For marketing purposes, such as to inform you about news and public information which may be useful, including activities, new product and service offers, product and service price negotiation and survey, as well as for to evaluate and consider providing financial aid (e.g., financial loan) to you or business partners;

6) For internal management and communication within the organization, such as to publish internal activities and to comply with business codes of conduct, including but not limited to, procurement, disbursement, internal management, training, inspection, report, document delivery and management, data processing, risk control or management, trend and statistical analysis and planning, and other similar or relating activities;

7) For business analysis and improvement, such as to research, analyse data, estimate, survey and evaluate and report on our products and services and your or business partners’ performance, including to develop and improve our marketing strategy, and our products and services;

8) For registration and authentication, such as for your registration, verification, identification and authentication;

9) For IT systems and IT support systems, such as to support IT and IT support departments, to administrate system access in which the Company has granted the right to access to you, to delete unused accounts, implement business control measures to continue business, and for the Company to identify and solve problems in the IT systems, and to safeguard the security of the our systems, to develop, implement, operate and manage the IT systems;

10) For business partner information management, such as to compile list of business partners, record data in the system and update the list and directory of business partners (which includes your Personal Data), as well as to store and manage agreements and relating documents which may contain your name;

11) For system monitoring and security, such as to control access, monitor systems, equipment and internet, and safeguard IT security;

12) For dispute management, such as to resolve dispute, enforce the Company’s agreements, establish, exercise, or raising legal claims, including to grant authorization;

13) For investigation, complaint and/or crime and fraud prevention;

14) For compliance with internal policy and relating/applicable laws, rules, regulations, guidelines (such as to apply for business licences as required by law) and to coordinate or communicate with government agencies, courts or relevant agencies (such as the Revenue Department, the Royal Thai Police Headquarter and the State Audit Office) including to investigate, complain and/or prevent crime and fraud;

15) For danger prevention towards life, body or health of a person, such as to control contagious disease or epidemic;

16) For organizing corporate social and environmental responsibility, refusing to provide the Company your Personal Data may affect you, for example, we may not be able to proceed your request, facilitate you, or fulfil our contractual obligations we have with you, and you may suffer damages or loss of opportunity. Apart from that, refusing to provide your Personal Data may affect our or your legal compliance which may impose penalty.

The Company may disclose or transfer your Personal Data to the following third parties. We will collect, use, and/or disclose Personal Data in accordance with the purposes under this Privacy Policy. These third parties may be located in Thailand and outside Thailand. You can visit their privacy policy to learn more details on how they collect, use and/or disclose Personal Data since you could also be subject to their privacy policies.

4.1 Companies under BTS Group

As the Company is part of Companies under BTS Group which all collaborate and/or partially share customer services and systems, e.g., service systems and website-related systems, the Company may need to transfer your Personal Data to, or otherwise allow access to such Personal Data by the Companies under BTS Group for the purposes set out in this Privacy Policy. Companies under BTS Group may rely on the consent obtained by the Company to use your Personal Data.

4.2 The Company’s service providers

The Company may use other companies, agents or contractors to perform services on our behalf or to assist us in our business with you. The Company may share Personal Data to third parties, including but not limited to (1) infrastructure, software and website developers and IT service providers; (2) marketing, advertisement, design, creative advertising and communication service providers; (3) hospitals; (4) data storage and cloud service providers; (5) banks and financial institutions; (6) insurance companies, sub-insurance companies, insurance brokers, insurance agents, lost adjustors and risk surveyors; (7) logistics and transportation service providers; (8) payment and payment system service providers; (9) voting and vote counting service providers; (10) analysts; (11) travel service agencies; (12) garages and auto parts stores; (13) booking system service providers; (14) outsource internal operation service providers; (15) printing houses; and (16) surveying service providers. In the course of providing such services, the service providers may have access to your Personal Data. However, the Company will only provide the Company’s service providers with the Personal Data that is necessary for them to perform the services, and we will ask them not to use your Personal Data for any other purposes. The Company will ensure that all the service providers we work with will keep your Personal Data secure.

4.3 Our business partners

The Company may transfer your Personal Data to the Company’s business partners, such as business partners, project owners, contract parties, securities companies, stores, construction contractors, joint venture partners, companies that the Company invests in, co-shared partners and third parties that the Company share marketing or promotional campaigns for the business operation and service provision of the Company, provided that the receiving business partner shall agree to treat Personal Data in a manner consistent with this Privacy Policy.

4.4 Third parties permitted by law

In certain circumstances, the Company may be required to disclose or share your Personal Data in order to comply with a legal or regulatory obligation. This includes any government agency, court, government authority, embassy, consulate, or other third party where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect the rights of the Company, third party or individuals’ personal safety; or to detect, prevent, or otherwise address fraud, security or safety issues.

4.5 Professional advisors

The Company may disclose Personal Data to the Company’s expert advisors including, but not limited to, (1) independent advisors; (2) legal advisors who assist the Company in its business operations and provide litigation services such as defending or initiating legal actions; (3) external advisors; (4) project advisors; (5) financial advisors; and (6) auditors who provide accounting services or conduct financial audit for the Company.

4.6 Assignees of rights and/or duties

We may disclose or transfer your Personal Data to our business partners, investors, significant shareholders, assignees or transferees in the event of any reorganization, restructuring, merger, acquisition, sale, purchase, joint venture, assignment, or any other similar events involving transfer or other disposition of all or any portion of our business, assets or stock. If any of above events occurs, the receiving party will comply with this Privacy Policy to respect your Personal Data.

The Company may disclose or transfer Personal Data to third parties located overseas, which the destination countries may have the higher or lower data protection standards than Thailand’s, such as when the Company stores your Personal Data on cloud platforms or servers located outside Thailand or when we engage IT support services. The Company may disclose or transfer Personal Data to third parties located overseas, which the destination countries may have the higher or lower data protection standards than Thailand’s, such as when the Company stores your Personal Data on cloud platforms or servers located outside Thailand or when we engage IT support services. The Company may have to obtain a guarantee from third parties who have the rights to access Personal Data that such Personal Data will be protected under the same data protection standards as Thailand’s. If you require more information on how the Company protects your Personal Data when being transferred cross-border, please contact the Company as per the details in “Our Contact Details” section.

The Company will retain your Personal Data for as long as it is reasonably necessary to fulfil purposes for which the Company obtained them and to comply with the Company’s legal and regulatory obligations. However, the Company may have to retain Personal Data for a longer duration, as required by applicable laws.

We retain your CCTV Details for as long as is reasonably necessary to fulfil the purposes of CCTVs installation as described in this Privacy Policy. In the event that we are no longer legally permitted to retain your CCTV Details, we will delete your data from our systems and records. Nevertheless, in the case where there are any court or disciplinary proceedings, your CCTV Details may be retained until such proceedings have been completed including possible appealing process. After such process, the data will be permanently deleted or stored as required by the applicable laws.

Subject to applicable laws and exceptions thereof, a data subject may have the following rights to:

(1) access or request a copy of the Personal Data or request the Company to disclose how we acquired the Personal Data without your consent; (2) request for revision of your Personal Data to be accurate, updated, complete and not misleading; (3) request for deletion, destruction or anonymization of your Personal Data; (4) obtain Personal Data relating to you, in a structured, readable or usable electronic format, and to transmit or transfer such Personal Data to another data controller, where (a) this is Personal Data which you have provided to the Company, and (b) the Company is processing such data on the basis of your consent or to fulfill contractual obligation under the agreement we have with you; (5) object our collection, use and/or disclosure of your Personal Data or restrain our further use of your Personal Data; (6) withdraw consent to our collection, use and/or disclosure of your Personal Data which we have to rely on your consent to at any time. If you wish to exercise any rights above, please contact us as per the details in “Our Contact Details” section. There may be cases where the law limits the exercise of any rights above or where the Company may appropriately or justifiably decline your request, for example, the Company may decline your exercise of right in order to comply with the laws or court’s orders. If we decline your request due to such reason, the Company will notify you of the reason. If you believe that our collection, use and/or disclosure of your Personal Data by has does not comply with the applicable laws concerning personal data protection, you have the right to submit a complaint to the relevant agencies relating to personal data protection. However, if you have any complaints, please contact the Company first before contacting the relevant agencies so that we have an opportunity to resolve your complaints accordingly.

As a way to protect personal privacy, the Company maintains appropriate security measures, which includes administrative, technical and physical safeguards in relation to access control, to protect the confidentiality, integrity, and availability of Personal Data against any accidental or unlawful or unauthorized loss, alteration, correction, use, disclosure or access, in compliance with the applicable laws. In particular, the Company has implemented access control measures which are secured and suitable for the Company’s collection, use and/or disclosure of Personal Data. The Company restricts access to Personal Data as well as storage and processing equipment by imposing access rights or permission, user, access management to limit access to Personal Data to only authorized persons, and implement user responsibilities to prevent unauthorized access, disclosure, perception, unlawful duplication of Personal Data or theft of device used to store and process Personal Data. This also includes methods enabling the re-examination of unauthorized access, alteration, erasure, or transfer of Personal Data which is suitable for the method and means of collecting, using and/or disclosing of Personal Data.

The Company may amend this Privacy Policy from time to time if there is a change in the Company’s practice in personal data protection due to reasons, such as changes in technology or the law. Such amendment shall be in effect when the Company publishes the Privacy Policy Notwithstanding the fact that if such amendment has significant impact on you as a data subject, the Company will appropriately notify you in advance before the amendment takes effect.

If you wish to contact us to exercise the rights relating to Personal Data or if there is any queries about your Personal Data under this Privacy Policy, please contact our Data Protection Officer (DPO) at:

Trans.Ad Solutions Company Limited 21 TST Tower,21st floor, Viphavadi-Rangsit Road, Chomphon Sub-district, Chatuchak District, Bangkok 10900 Thailand E-mail: dpo@transad.co.th Tel: 02 001 9900-2 Ext. 110 This notice was last updated on 1 November 2022