PERSONAL DATA PRIVACY NOTICE
FOR PROCESSES RELATED TO CUSTOMERS OF CP-MEIJI CO., LTD.

1. General Provisions

For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendment which may be made thereto, (“Laws on Personal Data Protection”) , CP-Meiji Co., Ltd. (“Company”) has prepared this personal data privacy notice (Privacy Notice) ของบริษัทฯ (“ประกาศฯ”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”) for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, sorting, combination, restriction on or prohibition of access, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:

2. Groups or Categories of Persons whom the Company Collects Personal Data

Under this Privacy Notice, groups or categories of persons from whom the Company collects and Processes Personal Data are as follows:

2.1 Customers which means persons who purchase products and/or use services of the Company or those who are expected to purchase products and/or use services of the Company (prospective customers), or any other persons having similar characteristics, such as business operators or owners that purchase products and/or use services of the Company, participants in the marketing activities, including activities of competition and points redemption for awards, visitors for milk museum, website users, persons who make contact to request to receive information or services from the Company, customers or testers in new product trial surveys of the Company, and persons who provide responses to surveys concerning products and/or services of the Company, etc.

2.2 Persons related to customers which means persons who are related to or are representatives or personnel of juristic persons that are the customers or may become the customers of the Company, such as directors, executives, employees, representatives, or personnel of customers who are juristic persons, including persons whose Personal Data appear in relevant documents and processes, such as witnesses, purchasers, consignees, and cheque payers, etc.

3. How the Company Collects and Receives your Personal Data

3.1 The Company collects and receives your Personal Data via the following methods:

• (A)
  Personal Data which you directly provide to the Company
  You may directly provide your Personal Data to the Company, such as:

  • When you contact, inquire, express an opinion or comment, submit a complaint to the Company, whether in written or oral communications by face-to-face interaction or by contact at the place of business of the Company, or by any other channels, such as by telephone, fax, e-mail, mail, website, application for communication or any other media platforms;
  • When you express an intention to purchase products or use services of the Company, enter into a contract with the Company, or deliver documents containing Personal Data to the Company; and
  • When you participate in marketing activities, lucky draws, events, or any other activities organized by or on behalf of the Company, etc.

• (B)
  Personal Data which the Company automatically collects from you
  The Company may collect your Personal Data by automated means, such as the use of Cookies or other similar technologies. For more details, please see the Company’s Cookie Policy

• (ค)
  Personal Data which the Company receives from other sources or third parties
  The Company may receive your Personal Data from other sources or third parties, such as
• In case the customer is a juristic person, the Company may receive your Personal Data from contact persons, representatives, or personnel of the juristic person that you affiliated;
• Business partners or service providers of the Company, such as delivery service providers, research service providers, website service providers, application service providers, service providers for public relations and products/services recommendation, and data collection service providers, etc.;
• Companies in the Charoen Pokphand Group (“CP Group”);
• Government agencies, such as Department of Business Development (DBD); and In some cases, the Company may collect your Personal Data from public data sources, data sources containing information relating to your business, or sources containing information relating to trades, irrespective of whether you have disclosed the Personal Data by yourself or have provided consent to somebody else to disclose such Personal Data, etc.

3.2 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the purposes and lawful bases for the collection, use, disclosure and/or Processing of Personal Data, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will explicitly request your consent.

3.3 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. Nevertheless, after the Laws on Personal Data Protection in respect of the collection, use or disclosure of Personal Data have taken effect, if you do not wish for the Company to collect and use your Personal Data and if the Company has relied on your consent as a basis in Processing your Personal Data, you may contact the Company using the contact details set out in Clause 9 of this Privacy Notice to request for the withdrawal of your consent. To this end, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.

4. Collected Personal Data

Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by other sources or third parties, includes the following:

4.1 Personal Information, such as first name, last name, date/month/year of birth, place of birth, age, sex, nationality, identification number, passport number, photograph, and signature, etc.

4.2 Contact information, such as address, delivery address, billing address, telephone number, fax number, e-mail, and user IDs for various applications for communications or other social media (e.g., Line, Facebook, and Instagram) etc.

4.3 Customer business information, such as name and address of company, affiliated agency or affiliated organization, position, name and address of the store, categories of the customers or stores, and contact details for trading, etc.

4.4 Information concerning sale and purchase transaction, such as customer code, order details (e.g., the wish-listed product, quantity and quality), available period for customers to receive the product, and details of complaints concerning the product (e.g., date of order, type of product, relevant branch, and the problem that is found), etc.

4.5 Information concerning payment, such as monetary amount, purchase amount, bank account details, Personal Data which appears in the invoice, tax invoice, and receipt, etc.

4.6 Information that is used as supporting evidence in the Company’s customer registration or execution of transactions, such as Personal Data which appears in a copy of the national identification card, copy of passport, information on visa, copy of work permit, copy of house registration book, power of attorney, copy of company affidavit, copy of VAT registration certificate, map, sale and purchase agreement or any other agreements relating to the transaction, and delivery order, etc.

4.7 Sensitive Personal Data, such as religion, and health data, etc.

4.8 Technical information, such as log file, IP Address, and information that the Company collects through the use of Cookies or other similar technologies, etc.

4.9 Other information, such as license plate number, type of vehicles, interests, behaviors or trends to purchase products and/or services, voice recording of conversations, and photo and video recording by means of CCTV, etc.

5.Purposes and Lawful Bases for the Processing of Personal Data

5.1 The Company Processes your Personal Data for the purposes under lawful basis as follows (collectively, the “Purposes”)

5.2 Your Personal Data which the Company will Process for the Purposes set forth in Clause 5.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or services related to you, whether in whole or in part.

5.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case maybe).

6. Disclosure of Personal Data

6.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following persons and entities:

• (A)
  Companies in the CP Group, including directors, executives, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.

• (ฺB)
  Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, such as information technological services, website management services, data storing services, payment services, mailing services, delivery services, printing services, data analysis services, research services, marketing services, promotional activities, or any other services which may be beneficial to you or relevant to the Company’s business operations, etc.

• (C)
  Advisors of the Company, such as legal advisors, lawyers, auditors, or any other internal and external experts of the Company.

• (D)
  Court and relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission pursuant to applicable laws, such as Revenue Department, Ministry of Commerce, Office of the Personal Data Protection Commission, Trade Competition Commission of Thailand, Royal Thai Police, and Office of the Attorney General, etc.

• (E)
  Any persons or other entities that you have given consent to disclose your Personal Data to, such as the disclosure of processed images of activities through various media platforms of the Company to the general public.

6.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law, provided that if the law requires your consent to be provided, the Company will request for your prior consent.

6.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. Where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data or such transfers of your Personal Data outside Thailand have been carried out in accordance with the Laws on Personal Data Protection. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under the Laws on Personal Data Protection.

7. Retention Period

The Company will retain your Personal Data for the period necessary to fulfil the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. The Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.

In this regard, the Company will retain your Personal Data for a period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.

After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the event that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8. Your Rights in relation to Personal Data

As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. In this regard, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8.1 Right of Access

You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

8.2 Right to Data Portability

You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

8.3 Right to Object

You have the right to raise an objection to the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.4 Right to Erasure

You may request that the Company delete, destroy or anonymize your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.5 Right to Restriction

You have the right to request that the Company restrict the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.6 Right to Rectification

You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date or incomplete, or may cause a misunderstanding.

8.7 Right to Withdraw Consent

If the Company relies on your consent as the legal basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

8.8 Right to Lodge a Complaint

If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Commission in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

To this end, the Company reserves the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

9. How to Contact the Company

If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact details provided below:

10. Changes to This Privacy Notice

The Company may make changes to this Privacy Notice from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Notice and the amended Privacy Notice through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Notice from time to time.