Data Deletion Policy

1. General

Quintaura Co., Ltd. (the "Company") recognises the importance of complying with the Personal Data Protection Act B.E. 2562 (2019) and related subordinate legislation, including any future amendments (the "Personal Data Protection Law"). The Company has therefore prepared this Personal Data Protection Policy (Privacy Policy) for customers (the "Policy"), which extends the "Personal Data Protection Policy under Announcement No. 001/2565", to inform customers of how their personal data is protected, so that customers can be confident that information which can identify them, directly or indirectly, under the Personal Data Protection Law ("Personal Data") is treated by the Company as highly important and is protected and managed with appropriate security measures.

The Company needs to collect, process, use, disclose and transfer customers' Personal Data, and has therefore prepared this Policy to inform customers in accordance with the Personal Data Protection Law and to comply with it. The Company recommends that customers read and understand the terms of this Policy, as set out below.

2. Definitions

2.1 "Customer" means a person or juristic person who has a legal relationship with the Company under a sale and purchase agreement, or any other person of a similar nature, such as a person enquiring about the Company's goods or products, including an "Activity Participant", in the capacity of data subject, as well as the customer's representatives, authorised persons, agents or employees involved in that legal relationship, referred to in this Policy as the "Customer" or "you". An "Activity Participant" means a person who has a legal relationship with the Company under an agreement other than a sale and purchase agreement, to the extent related to the Company's business, including a person who expresses an intention to take part in an activity or project or who communicates with the Company in connection with its business, such as persons enquiring about the Company's goods or products, activity participants, users of services on the website, persons contacting the Company to request information, and respondents to questionnaires about the Company's goods and/or services.

2.2 "Customer Personal Data" means the personal data of customers who are natural persons, the personal data of representatives, authorised persons or agents appointed by customers that are juristic persons, and the personal data of customers' employees, staff, contractors and agents assigned to act in connection with any contract or juristic act with the Company.

2.3 "Sensitive Personal Data" means data that identifies a person directly or indirectly and is specified in section 26 of the Personal Data Protection Act B.E. 2562 (2019), namely personal data relating to race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data which affects the data subject in a similar manner as prescribed by the Personal Data Protection Committee.

2.4 "Processing of Personal Data" means the collection, use or disclosure of personal data.

3. Purposes of processing Customer Personal Data

When processing Customer Personal Data, customers will be informed of the details set out in this Policy, including but not limited to the purposes and legal bases for collecting, using, disclosing and/or processing personal data, as follows:

3.1 For the process of making offers and negotiating to enter into a sale and purchase agreement between the Company and the customer, for verifying the documents of buyers and sellers in connection with contacting or negotiating a contract, and for related actions such as recording customer identification, opening a trading account for goods, and registering customers, including their representatives, authorised persons, agents or persons assigned to act in connection with that contract.

3.2 For performing or carrying out the sale and purchase agreement, such as payment, delivery and receipt of goods, preparing trade documents and other actions related to performing the contract, and processing Customer Personal Data for post-sale actions, including but not limited to returns of goods and warranties, where the data subject is a representative, authorised person, agent or person assigned to act in connection with that contract.

3.3 To enable the Company to perform its duties under applicable laws, including but not limited to transport and tax laws, to comply with regulations, notifications or rules issued under the law, to report or provide information to government agencies or relevant bodies as the law requires the Company to do, and to comply with lawful orders of officials and court orders.

3.4 For the Company's legitimate interests, including the following cases:

• Processing Customer Personal Data for internal audits, financial and accounting audits, detecting and preventing fraud, corruption or unlawful acts, or preparing for legal proceedings, and for the Company's other legitimate interests;
• Processing the Personal Data of customers who enter the Company's premises or property for business contact, visits, coordination, etc., for the security of the Company's property and premises;
• Processing the Personal Data of the customer's employees, contractors and agents that the customer sends or transfers to the Company, for the purpose of entering into or performing a contract between the Company and the customer, including contacts or coordination related to negotiating or performing such a contract.

3.5 To prevent or suppress danger to the life, body or health of the customer or another person.

3.6 For business, marketing, public relations and sales promotion purposes and for customer relationship activities, such as sending marketing messages, taking photographs or videos to process and publicise marketing activities, and sales promotion through various media channels. The Company will do so based on the consent obtained from you.

3.7 To improve and develop the Company's services to customers, such as research to develop products or services and customer satisfaction surveys.

3.8 When processing personal data for the purposes above, where the law requires the customer's consent for a given purpose, the Company will request explicit consent using the form attached to this Policy. Where the law allows the Company to process Customer Personal Data without consent, such as under clauses 3.1–3.5, the Company is deemed to have informed the data subject of the processing details under this Policy.

3.9 If the Company processes Customer Personal Data in a manner and/or for a purpose that differs from or is inconsistent with this Policy, the Company will issue an additional personal data protection policy or notice and inform customers of the details of that processing.

3.10 Where the Company collected Customer Personal Data before the date on which the Personal Data Protection Law relating to the collection, use or disclosure of personal data came into force, the Company will continue to collect, use and disclose your Personal Data for the original purposes notified to you under this Policy. If you do not wish the Company to process your personal data, you have the right to withdraw your consent by contacting the Company through the contact channels specified in this Policy. The Company reserves the right to consider your request to withdraw consent and to act as required by the Personal Data Protection Law.

3.11 Where personal data processed for the purposes in clauses 3.1–3.7 is Sensitive Personal Data, the Company will request your consent, unless the law allows the Company to process it without consent.

4. Purposes of processing Customer Personal Data

4.1 Under this Policy, the Company collects personal data directly from customers when they submit personal data as part of, or together with, documents for the purpose of entering into and performing a contract with the Company under clauses 3.1 and 3.2, consisting of the following personal data:

1. (a) Personal data shown on copies of national ID cards and name-change certificates, such as first name, last name, date of birth, age, gender, national ID number, signature, specimen signature, copy of house registration, bank account, photograph, and similar personal data appearing in forms or trade documents related to the legal relationship with the Company. Regarding Sensitive Personal Data on ID cards, the Company has no policy of collecting Sensitive Personal Data and asks customers to strike it out or make it unidentifiable;
2. (b) Contact data, such as the address on the copy of the ID card, the address on the copy of the house registration, telephone and fax numbers, e-mail, LINE ID, WeChat ID, Facebook account, Instagram account and social media contact channels appearing in forms or trade documents related to the legal relationship with the Company;
3. (c) In some cases, the Company may collect your personal data automatically through various channels depending on your use, practices or contact with the Company. If such automatic collection differs from or goes beyond this Policy, the Company will issue a specific policy to inform you; for example, when customers use the Company's website, cookies or similar technologies may be used, as further described in the Cookie Policy;
4. (d) In some cases, the Company may collect your personal data when you communicate with it, such as recording or transmitting conversations between you and the Company through online or electronic systems, or when you visit the Company's premises, such as still images and video recorded by CCTV.

4.2 Where the Company collects, uses or discloses the personal data of the customer's staff, employees, agents or assigned persons, which the customer has sent or transferred to the Company for actions related to the purposes in clauses 3.1 and/or 3.2, such as name, surname, job title and contact details, the Company does not need to obtain the consent of those persons, except in the case of Sensitive Personal Data, and the Company informs those persons of the processing details under this Policy. However, if the Company cannot inform those persons directly, the customer agrees to inform them of this Policy on the Company's behalf and to send the Company documents showing their acknowledgement. In addition, where the Company must obtain the consent of those persons, the customer agrees to have them give consent using the consent form attached to this Policy. The customer accepts that the Company may ask you to send evidence of these actions for checking compliance with the Personal Data Protection Law.

5. Disclosure of Personal Data

The Company discloses, sends, transfers or exchanges Customer Personal Data for the purposes in clause 3, to the following persons or bodies:

5.1 Service providers, such as information technology, data recording, data analytics or any other services related to the Company's actions to enter into or perform a contract with you;

5.2 Financial, electronic payment or other service providers related to the Company's actions to perform a contract with you, including payment for goods;

5.3 Government agencies with a supervisory duty under the law, or that request disclosure of personal data under legal authority, or in connection with legal proceedings, or as permitted by applicable law, such as the Revenue Department and the Department of Business Development;

5.4 Any other person or body to which you have consented to the disclosure of your personal data, such as publishing activity photos through various media channels, disclosure to social media service providers, or public disclosure through various media as part of the purposes in clause 3.6;

5.5 Affiliated companies, including their executives, directors, staff, employees and/or internal personnel, as relevant and necessary for processing your Personal Data as part of the purposes in clause 3.4;

5.6 The Company's advisers, such as legal advisers, lawyers, accounting advisers, auditors or other experts, both internal and external, as part of the purposes in clause 3.4.

6. Retention period of Personal Data

6.1 The Company will retain Customer Personal Data for as long as necessary to achieve the purposes of collecting, processing and using the Personal Data specified in clause 3 of this Policy. The retention period varies depending on the purpose of the processing. For data retained for entering into or performing a contract, the Company will retain it for as long as the parties remain in a contractual relationship. In addition, the Company will retain personal data for the periods required by applicable law, taking into account the statutory limitation periods for any litigation that may arise from or relate to the processing of personal data for each purpose.

6.2 Where the retention period cannot be clearly specified, the Company will retain Customer Personal Data for a period reasonably expected under data retention standards. However, the Company may retain Customer Personal Data for longer if permitted by law or if such retention is necessary for establishing the Company's legal claims.

6.3 After the above periods expire, the Company will delete or destroy the personal data from its storage or systems and those of other persons providing services to the Company (if any), or make the personal data unable to identify you.

7. Customers' rights as data subjects

As data subjects, customers have the following rights under the Personal Data Protection Law:

7.1 Right of access: Customers have the right to access their personal data and to obtain a copy of the Personal Data they have provided under this Policy, as provided by the Personal Data Protection Law.

7.2 Right to data portability: Customers have the right to request that their Personal Data be sent or transferred to another data controller or to themselves, unless this is impossible by its nature, as provided by the Personal Data Protection Law.

7.3 Right to object: Customers have the right to object to the collection, processing and use of their Personal Data as provided by the Personal Data Protection Law.

7.4 Right to erasure: Customers have the right to request that the Company delete, destroy or anonymise their Personal Data as provided by the Personal Data Protection Law.

7.5 Right to restrict processing: Customers have the right to request that the Company suspend the processing of their Personal Data as provided by the Personal Data Protection Law.

7.6 Right to rectification: If customers find that the Personal Data they provided under this Policy is inaccurate, or their Personal Data has changed, they have the right to request that it be corrected as provided by the Personal Data Protection Law.

7.7 Right to be informed of changes to the registration form for Personal Data: The Company may consider amending the registration form for Personal Data as appropriate to ensure that customers' Personal Data is properly protected, as provided by the Personal Data Protection Law.

7.8 Right to complain: If customers have concerns or questions about the Company's practices regarding their personal data, please contact the Company using the contact details in clause 7 of this Policy. Where there is reason to believe that the Company has violated the Personal Data Protection Law, customers have the right to file a complaint with the expert committee appointed by the Personal Data Protection Committee, in accordance with the rules and procedures prescribed by the Personal Data Protection Law.

However, customers' rights as data subjects under this Policy are subject to the limitations and conditions of the Personal Data Protection Law. The Company may therefore refuse your request, giving the reasons provided by law, and reserves the right to consider your request under the Company's conditions, procedures and rules.

8. How to contact the Company

The Company may change this Policy from time to time to reflect any changes in the processing of Personal Data and as required by the Personal Data Protection Law or other applicable laws. The Company will notify you of any material changes, together with the updated notice, through other channels it will announce. The Company recommends that you check this notice periodically for changes.