Privacy Notice for Customers and Related Persons

Thai Lotte Co., Ltd.

Thai Lotte Co., Ltd. (hereinafter referred to as the “Company”) recognizes and prioritizes the protection of your personal data. To comply with the Personal Data Protection Act B.E. 2562 (PDPA), including relevant sub-regulations and future amendments, this Notice explains the details regarding the collection, use, and disclosure (collectively referred to as “Processing”) of your personal data as follows:

1. Scope of Application and Targeted Persons

This Notice applies to natural persons who are owners of personal data and have a relationship with the Company in the following capacities:

• Individual Customers: Natural persons who purchase products, use services, or access the Company’s platforms (current and future), including participants in marketing activities, events, and users of the website or mobile application.

• Persons Related to Corporate Customers: Directors, authorized signatories, employees, representatives, coordinators, or any personnel of a corporate customer whose names appear in business-related documents, such as purchasers, consignees, check signatories, and shop managers.

• Third-Party Data Providers: In cases where you provide the personal data of a third party to the Company (e.g., emergency contacts or alternative recipients), you represent and warrant that you have obtained lawful consent from such person or have a legal basis to do so and have informed them of the details in this Notice.

2. Channels for Data Collection

The Company may collect your personal data through various channels, including:

1. Direct Channels:

   • Communications via telephone, email, mail, fax, or in-person meetings with staff.

   • Submission of documents for contracts, new customer account openings, or credit applications.

   • Data entered through the Company’s official website or mobile applications.

   • Complaints, feedback, or inquiries submitted via the Customer Service Center (Call Center).

2. Indirect/Third-Party Channels:

   • Business partners, such as E-Commerce platforms, distributors, or logistics service providers.

   • Publicly available sources or standardized commercial databases (e.g., Department of Business Development).

   • Social media platforms where you communicate or link your account with the Company.

3. Details of Collected Personal Data

The Company collects only necessary data for specified purposes, categorized as follows:

• Identity Data: Name, surname, nickname, gender, age, date of birth, nationality, National ID number (or Passport number), signature, and actual photographs.

• Contact Data: Registered/Residential address, shipping address, billing/receipt address, mobile and landline numbers, Email address, and communication app IDs (e.g., Line ID).

• Business Data: Shop name, commercial registration number, shop map, storefront photos, and business type details.

• Financial and Transaction Data: Customer ID, purchase history (type/quantity/branch), outstanding balance, credit limit, payment terms, bank account number, and data in payment vouchers/direct debit forms.

• Legal and Security Documents: Copies of ID cards/House Registration (The Company requests you to "cross out" sensitive data such as religion and blood type; otherwise, the Company reserves the right to do so for your protection), Certificate of Incorporation, VAT Registration (PP.20), Power of Attorney, and collateral such as Bank Guarantees.

• Behavioral and Technical Data: Audio recordings of Call Center conversations, still and motion images from CCTV systems for security, purchasing behavior, and Cookies from website usage.

---

4. Purposes and Legal Bases for Processing

The Company processes your data under the following legal bases:

4.1 Contractual Basis:

• To verify identity and evaluate qualifications before accepting new customers or opening accounts.

• To manage purchase orders, shipping, and providing requested services.

• To process payments, debt collection, billing, and issuing financial documents.

4.2 Legitimate Interest Basis:

• To manage relationships with corporate customers (processing representatives' data).

• To improve product/service quality and resolve complaints.

• To ensure security within Company buildings and premises (CCTV).

• To perform internal statistical analysis and exercise legal claims in case of disputes or breach of contract.

4.3 Consent Basis:

• For marketing communications, special promotions, and new product recommendations.

• For in-depth behavioral analysis for Targeted Advertising.

• To use photos or videos of you from events for corporate public relations across various media.

4.4 Legal Obligation Basis:

• To comply with tax laws regarding tax invoice issuance and reporting to the Revenue Department.

• To comply with court orders or requests from police and government regulatory agencies.

Note: If you do not provide personal data necessary for contractual or legal bases, the Company may be unable to fulfill your requests, provide services, or may be required to cancel existing transactions.

---

5. Disclosure and Transfer of Personal Data

The Company may disclose your data to the following parties:

1. Internal Parties: Executives, employees, and relevant personnel for normal business operations.

2. External Service Providers (Outsource): IT and Cloud providers, logistics/transportation companies, banks/payment gateways, marketing/research agencies, and data processors under strict data protection agreements.

3. Professional Advisors: Lawyers, legal consultants, auditors, or independent experts.

4. Government Agencies: Revenue Department, Ministry of Commerce, FDA, and the Office of the Personal Data Protection Commission (PDPC).

5. International Transfers: Data may be transferred to the parent company or affiliates abroad for global management. The Company ensures that the destination has adequate data protection standards as required by Thai law.

6. Data Retention Period

The Company retains data for as long as necessary according to the purpose:

• Contractual Data: Retained for the duration of the contract and for 10 years after the relationship ends to support audits and legal statutes of limitation.

• Marketing Data: Retained for no more than 2 years from the last communication or until you withdraw consent.

• Security Data (CCTV): Retained for 30 – 90 days and automatically deleted thereafter (unless required as evidence in legal proceedings).

• Visitor Data: Retained for no more than 1 year for security purposes.

7. Legal Rights of the Data Subject

You have the following rights under the PDPA:

1. Right to Access: To request access to and a copy of your personal data.

2. Right to Data Portability: To request data in an electronic format to be sent to another controller.

3. Right to Object: To object to the collection or processing of data in certain cases (e.g., direct marketing).

4. Right to Erasure: To request the deletion of data when it is no longer necessary or consent is withdrawn.

5. Right to Restriction: To request a temporary suspension of data usage during verification.

6. Right to Rectification: To keep your data accurate, current, and complete.

7. Right to Withdraw Consent: To cancel consent at any time (without affecting prior processing).

8. Right to Complain: To lodge a complaint with the PDPC if you believe your rights have been violated.

8. Contact Information

For any inquiries or to exercise your rights, please contact:

• Thai Lotte Co., Ltd. (Legal or HR Department)

• Address: 25 Bangkok Insurance Building, 25th Floor, South Sathon Road, Thung Maha Mek, Sathon, Bangkok 10120.

• Phone: 02-029-1415

• Personal Data Protection Working Group. Email: PDPA@lotte.co.th, Email: kiatchanin@lotte.co.th