Tipco Asphalt Public Company Limited (“the Company”) would like to assure the investor, registered shareholder and/or any person interested in the investment of the Company (“You”) that your personal data is important to the Company and the Company guarantee to protect and process those personal data under the best information security measures. The Company, therefore, intend to inform You of this Investors and Shareholders’ Privacy Notice (“the Notice”) that defines the necessity that the Company may have in collecting, compiling, processing and/or disclosing your personal data for the performance of Company’s obligations as a company to You in accordance with the Public Company Act of Thailand and Civil and Commercial Code. 

Your personal data that the Company is processing

“Personal Data” includes information of investor, registered shareholder and/or any person interested in the investment of the Company that is personally identifiable. The Company may obtain and collect your Personal Data directly from You or from the shareholder registry book that the Company shall be obliged to keep under the applicable laws and the Company may receive from Thailand Securities Depository Company Limited who provides securities registrar service.

The Company need to collect and process the following Personal Data of You: 

1. Personal Data of You as the registered shareholder, including full name, nationality, occupation, current address, number of shareholding, bank account information, Identification card number, email, and telephone number; 
2. In case You are a major shareholder as defined under the laws and regulations of regulatory authorities including without limitation Thailand Securities and Exchange Commission and Stock Exchange of Thailand, the Company would need to collect and store additional Personal Data of You, including your background (i.e., educational record and work experience) and photo of You or your representative in case that You are the corporate shareholder; 
3. Any Personal Data that You may provide to the Company during the communication or conversation that You may have with the Company via the investor relation channels, including without limitation full name, nationality, occupation, address and contact information (i.e., telephone number and/or email);
4. Information of the meeting attendance that You as the registered shareholder participating in, including meeting registration information that may include shareholder’s proxy information, as well as video and voice recording during the meeting held both online and offline; and
5. Any Personal Data that You may submit to the Company for processing under other specific purposes.

In case You are the corporate shareholder, the Company would need to collect the information of your directors or in case You have appointed any proxy to attend the shareholders’ meeting and exercise any legal rights on your behalf, the Company would need to process the Personal Data of those persons; provided that when You provide Personal Data of those persons to us, the Company shall deem that You have given the representation that You have obtained all the consent or have the legitimate rights to disclose such persons’ Personal Data to the Company.

“Sensitive Personal Data” includes Personal Data that is private, sensitive, and at risk from being used for discrimination such as information regarding racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, genetic data, biometric data, or any other information which may affect the data subject in the similar way as announced by the Personal Data Protection Committee. In general, the Company has no intention to collect your Sensitive Personal Data for any purpose yet in cases the Company may need to collect your Sensitive Personal Data, the Company shall request for the explicit consent from You before the collection of such data.

Objectives for the personal data process undertaken by the Company. 

The Company would need to process your Personal Data for the following purposes:

1. To perform the legal obligations that the Company may have to provide the shareholders’ right to You such as to manage the corporate matters (i.e. company establishment, capital increase, capital decrease, business restructuring, change of company registration); to deliver the meeting invitation and other notices to You as required under the relevant laws, for instance, the invitation to the general shareholders’ meeting or the submission of the annual business report to the shareholders in accordance with your statutory rights; to allocate and distribute dividends to the relevant and entitled shareholders; to prepare the relevant accounting and tax report; and to perform any other legal obligations that the Company being public limited company and listed company in the Stock Exchange of Thailand shall perform. Then, in order to perform the rights and obligations to such shareholders, the Company would also need to verify your identity or your authorized person’s or proxy’s identity in exercising your right in the meeting or share transfer transaction;
2. To manage and respond to your query or request to the Company including to inform any information about the Company’s management that may directly relate to your investment and your statutory rights as the shareholder; to communicate and respond back to your request; to manage complaint relating to the exercise of your shareholder’s rights; or to manage the feedback provided; 
3. To protect the legitimate interest of the Company or other person, including to analyze the shareholding structure; to record and manage the shareholders’ meetings (for instance, to register the attendance, to record the resolution passed; to record picture and/or video during the shareholders’ meeting; and to disseminate the information recorded during the meeting on the Company’s website and other communication channels. All these activities would be undertaken to ensure the Company’s transparency and corporate governance for the interests of shareholders. The Company may also process the Personal Data for the purpose of data analysis, operating activities and facilitating shareholders in any other special events that the Company may organize; for the risk management and internal control; for internal audit; and for the exercise of the Company’s right in the legal claims;
4. In particular in the case of the majority shareholders as defined, to prepare the Company’s annual report that the Company are obliged to do so and may need to submit to the relevant authorities, or publicly disclose in accordance with the conditions and requirement prescribed in the relevant laws which may include the disclosure of your Personal Data on the Company’s website; and
5. To perform any other obligations under the laws, notifications, regulations, judgment or instructions from regulatory authorities under which the Company shall be obliged to perform, including without limitation the guidance of the Thailand Securities and Exchange Commission, Stock Exchange of Thailand, Ministry of Commerce, or other authorities.

Retention Period of Your Personal Data 

The Company shall be required to process and store your Personal Data for all the purposes defined above as long as necessary to (i) response to any contact that You as an investor or any person interesting to invest in the Company may contact the Company; (ii) for all the period of time that You remain the Company’s shareholder and as long as the Company may have the obligations under relevant laws to perform to You; or (iii) as long as the Company may have the obligations under other relevant laws to retain your Personal Data.

In addition, in order for the Company to protect their legitimate rights that the Company has with you as the shareholders, the Company reserve the right to retain your Personal Data for the period of time that is necessary to protect such rights, in particular, for the appropriate prescription period after the cessation of your shareholder status for the maximum of 10 years for general prescription period.

Disclosure of your Personal Data

In general, your Personal Data shall not be disclosed to any person except in these necessary circumstances that the Company may need to disclose your Personal Data to the following person:

1. To affiliates, business partners, or any third party service providers who provide support to the Company in the business operation and the performance of obligations that the Company may have with the shareholders or to protect the Company’s legitimate rights, including without limitation Thailand Securities Depository Company Limited as the Company’s registrar and other counsels (legal, accounting or others) as well as the internal and external audits; provided that the Company represent to only disclose your Personal Data under the defined purpose of data processing and on the necessary basis;
2. To the governmental authorities in case the Company shall be obliged under the applicable laws, court orders, or the instructions of such government authorities to disclose your Personal Data to; provided that the Company shall only disclose any information on the necessary basis;
3. To the counterparty where in some cases the Company may be required to disclose the Company’s annual report which may includes the Personal Data of majority shareholders for the purpose of executing contract or coordinating to them; provided that the Company shall only disclose the limited Personal Data without causing excessive impact on You as the data subject; and
4. To any other person that You have given explicit consent to the Company to disclose your Personal Data to.

Representation to implement appropriate information security measures

The Company undertake that the Company shall implement the appropriate security measures to prevent the unauthorized or unlawful access, amendment, change, or disclosure of your Personal Data. In addition, the Company shall establish internal policy to limit the access control or the use of your Personal Data in order to maintain data confidentiality and security and the Company commits to review those measures on the regular basis to comply with the industry standard and relevant laws. 

Your Rights as the Data Subject

The Company acknowledge and respect your rights as the data subject in relation to your Personal Data that is in the Company’s control. You can exercise your rights in accordance with the conditions under the applicable laws as follows:

1. Right to request for access and to obtain copy of the Personal Data including the right to request for the correction and update the Personal Data;
2. Right to request for data portability;  
3. Right to object to the process of Personal Data being undertaken by the Company; 
4. Right to request for Personal Data erasure or de-identification when the Personal Data is no longer necessary to be processed or when the data subject has withdrawn the consent; 
5. Right to request the Company to restrict the use of the Personal Data, in case the Personal Data shall be deleted or those Personal Data are not necessary to be processed; and
6. Right to withdraw consent that the You have given to the Company under the defined purposes.

You can contact the Company in order to make the request to exercise any defined rights at:

• Data Protection Officer: DPO — Ms.Udomporn Punpatch Email : dpo@tipcoasphalt.com
• Data Controller – Corporate Affairs – Mr. Thanapol Laosiripong Email: thanapol_lao@tipcoasphalt.com

Contact Venue: Tipco Asphalt Public Company Limited, 118/1 25FL Tipco Tower1, Rama 6 Road, Phayathai Sub-district, Phayathai District, Bangkok 10400, Telephone: 66-2-273-6000

Change of this Notice

The Company may review and update this Notice from time to time to ensure that this Notice comply with the practice and relevant laws or regulations; provided that the Company will notify the change of this Notice by announcing the updated Notice to You via any communication channels of the Company.