Ascend Commerce Co., Ltd. (“Company“) recognizes the importance of privacy and the protection of personal data of customers, users, and visitors to the Company’s website, applications, or systems (collectively referred to as “you“). The Company has established this Privacy Policy to inform you about its practices regarding the collection, use, and disclosure of personal data, as well as the rights you have under the relevant data protection laws to ensure you can use the services provided by the Company confidently.

Personal Data
“Personal Data” refers to information about an individual that can identify that person, directly or indirectly (excluding information about deceased individuals), such as name, Company name, phone number, email, and interests in products for services requested.

Personal Data may include sensitive information that is at risk of being used for unfair discrimination (Sensitive Data), including but not limited to biological data and religious beliefs. Personal Data includes any information you have provided to the Company and/or that is in the possession of the Company and/or that the Company has collected from other sources or individuals legally.

If the Company needs to collect, use, or disclose your Personal Data in a manner different from that specified in this Privacy Policy, the Company will inform you of the differing nature at the time or before collecting, using, or disclosing your Personal Data.

By accessing the services, you are deemed to have read and understood this Privacy Policy.

Types of Personal Data Collected, Used, or Disclosed
The following Personal Data may be collected, used, or disclosed by the Company to provide services to you:

• Full name and title
• Necessary contact information, such as address, mobile phone number, email
• Financial status information, such as transaction records
• Information about your job position and employer
• Records of conversations, whether in audio (phone) or text (website, email) format when you contact the Company
• Account login information and data recorded during service use, such as username, password, security questions and answers, usage logs
• Device information and service usage behavior, including but not limited to Unique Device Identifier, IP address, mobile operating system, mobile network provider, geolocation, cookies.

For additional services beyond the Company’s basic services or in the case of collecting, using, or disclosing any of Sensitive Data beyond what is mentioned, the Company will operate under the legal bases provided by law and will inform you of the purposes and types of Personal Data required before or while conducting such activities.

Legal Bases for Collecting, Using, and Disclosing Your Personal Data
The Company will collect, use, or disclose your Personal Data under legal basis and for the following purposes:

• Contractual Basis: To fulfill the contract to which you are a party, or to use in processing your request prior to entering into the contract, including but not limited to:
  
  • Accessing services
  • Any other actions necessary to provide you with the best service
  • Providing assistance, inquiries, responding to information requests, or contacting you regarding services
  • Developing, improving service quality, enhancing efficiency, and facilitating your service access
  • Processing data to provide services
  • Other related actions beneficial to you
• Legal Basis: Including but not limited to:
  
  • Compliance with relevant laws the Company is required to follow
  • The Company may disclose your Personal Data to internal/external auditors, government agencies, or other relevant entities as required by law
• Consent Basis: Including but not limited to:
  
  • Marketing purposes, such as offering benefits, selling products or services that may match your interests, promotional activities, public relations, surveys on services, statistical analysis, or business management through your provided contact methods
  • Other lawful purposes where the Company will seek your consent as needed
• Legitimate interest Basis: Unless these interests are overridden by your fundamental rights regarding your Personal Data, including but not limited to:
  
  • Prevention of crime and fraud
  • Security of systems and networks
• Public interest Basis: The Company has implemented appropriate measures to protect your fundamental rights and interests, including but not limited to:
  
  • Identity verification to prevent crime and fraud
  • Concerns about financial support for terrorism or money laundering.

Beyond the legal bases and purposes mentioned above, the Company may collect, use, or disclose your Personal Data under other legal bases, such as to prevent or mitigate harm to your life, body, or health. If such actions occur, the Company will inform you afterward.

Disclosure of Your Personal Data to Third Parties and Collection from Other Sources
To achieve the aforementioned purposes and under the legal bases, the Company may collect and/or use, send, transfer, process, and/or disclose Personal Data to the following entities:

• Legal entities that have control over the Company or are controlled by the Company, including entities under common control, and other entities or individuals that the Company has contractual relationships with, including external service providers with authority over your Personal Data both domestically and internationally, such as external service providers, cloud services, or other partners. The Company ensures that these service providers handle your Personal Data in accordance with this Privacy Policy and applicable laws.
• Auditors, external auditors of the Company, government agencies, assignees of claims, and any other individuals or legal entities to whom the Company must provide Personal Data as necessary for compliance with the law.
• Business transferees in case of mergers, asset transfers, or sale of all or part of the business.

Retention Period for Your Personal Data
The Company needs to retain your Personal Data for as long as necessary while you are using our services or maintaining a relationship with the Company. This retention period will also continue for as long as necessary to fulfill the purposes related to the Company’s services.

Additionally, the Company may retain your Personal Data beyond this period if required by law or for the purpose of establishing, exercising, or defending legal claims, for a period not exceeding 10 years as stipulated by applicable law.

Once the data is no longer necessary or the retention period has expired, the Company will delete or destroy your Personal Data or anonymize it in such a way that it can no longer be used to identify you.

Data Security
The Company acknowledges and understands the importance of your Personal Data. Therefore, we have enhanced and developed our personal data security systems in accordance with the law, maintaining modern and secure standards at all times. The Company will make every effort to comply with this personal data protection policy and emphasizes to our personnel, including those who process Personal Data and have the legal right to access your Personal Data, the importance of safeguarding and respecting your Personal Data security.

In the event that the Company needs to transfer any of your Personal Data to another country, we will follow the standards required by data protection laws. The Company will not transfer your Personal Data to a destination country that does not provide adequate data protection standards, unless you consent to such a transfer. However, in the event that your Personal Data is compromised through computer-related means such as hacking, theft, duplication, destruction of databases, or any other methods not caused by the Company, the Company reserves the right to deny any liability resulting from such actions.

Data Subject Rights
You have the following rights, as stipulated by the law:

1. Right to Withdraw Consent
   You have the right to withdraw your consent for purposes for which the Company requested it at any time.
2. Right to Access Personal Data
   You have the right to request access to or obtain a copy of your Personal Data collected, used, and disclosed by the Company. This includes requesting the disclosure of how your Personal Data was obtained without your consent. The Company may charge a fee for unreasonable requests and will inform you of the costs before proceeding.
3. Right to Rectify Personal Data
   You have the right to request that the Company rectify your Personal Data that is inaccurate, outdated, incomplete, or misleading.
4. Right to ErasureYou have the right to request that the Company delete or destroy your Personal Data under the following circumstances:
   – When your Personal Data is no longer necessary for the purposes for which it was collected, used, or disclosed.
   – When you withdraw your consent, and the Company has no legal basis to continue processing your Personal Data.
   – When you object to the processing of your Personal Data for legitimate interests, and there are no overriding reasons to deny your request.
   – When the processing of your Personal Data is unlawful.
5. Right to Restrict Processing
   You have the right to request the restriction of the processing of your Personal Data for specific reasons, such as temporarily suspending the use of your account.
   
6. Right to Data Portability
   You have the right to receive your Personal Data in a commonly used and machine-readable format, and to transfer or have the data transferred to another data controller, specifically for the Personal Data you provided to the Company.
   
7. Right to Object
   You have the right to object to the collection, use, or disclosure of your Personal Data as provided by law, including the right to object to direct marketing.
8. Right to Lodge a Complaint
   You have the right to file a complaint with the Personal Data Protection Commission.

Any requests to exercise your rights mentioned above must be made in writing or through electronic means provided by the Company. The Company will make reasonable efforts to respond within a reasonable timeframe, and no later than the timeframe set by law, while adhering to legal requirements regarding your rights as a data subject.

There may be limitations on your rights, and the Company will inform you if we cannot comply with your request. Such limitations will be as provided by the Personal Data Protection Act B.E. 2562. The Company reserves the right to charge any necessary fees related to the processing of personal data as you have requested.

Personal Data of Minors
The Company will collect, use, or disclose personal data of minors only in accordance with the standards set by law. If the Company becomes aware that it has collected personal data of a minor, it will take appropriate steps to address this promptly.

Language
The translation of this personal data protection policy, regardless of the language, is for your convenience only and does not intend to alter the policy. In case of discrepancies between the Thai version and any other language, the Thai version shall prevail.

Policy Updates
Using any of the Company’s services constitutes acceptance of this personal data protection policy. The Company may amend or add to this policy at any time and will notify you of such changes. Your continued use of the Company’s website, applications, systems, or services after such amendments will be deemed acceptance of those changes.

Contact Information for the Data Protection Officer
If you have questions, complaints, requests for access, or any inquiries regarding this personal data protection policy, and/or wish to verify what personal data the Company holds about you, please contact us through the following channels:

• Email: dpo@ascendcorp.com
• Address: Ascend Commerce Co., Ltd., 101 True Digital Park, Phoenix Building, 9th Floor, Sukhumvit Road, Bang Chak, Phra Khanong, Bangkok 10260

Announcement Date: May 3, 2023