Privacy Policy of OGP Energy Solutions Co., Ltd.

OGP ENERGY SOLUTIONS CO., LTD. (hereafter referred to as “the Company”, “we”, or “our”) recognizes the importance of the protection of Personal Data of the Customers, Business Partners, and Other Third Parties (hereafter referred to as “you”, or “your”). This Privacy Policy and Consent Letter (“Privacy Policy”) is for your notification and acknowledgment of the processing of Personal Data, whether it be the collection, use, disclosure, and transfer of your Personal Data (collectively referred to as “the Data Processing”) following the Personal Data Protection Act B.E.2562 (“PDPA”) and the relevant law.

Under this Privacy Policy, we shall collect the Personal Data of the following persons:

“Customer(s)” means the person(s), and/or organization(s), and/or “person(s) in any organization(s)” who will purchase a product and/or obtain service from the Company or other persons who contact and inquire for information of product and/or service of the Company, the person receiving information of product and/or service through relevant media and the person receiving advertisement and public relations concerning product and/or service of the Company.

“Business Partner(s)” means the person(s), and/or organization(s), and/or “person(s) who will sell products and/or provide service for the Company, such as the contractual party, service provider and advisor, etc., and shall mean to include an ordinary person who is related to the conducting of the transaction between the Company.

“Other Third Partie(s)” means the person(s), and/or organization(s), and/or “person(s) which is not a customer or business partner but has a relationship in the manner relating to the conduct of business.

We reserve the right to modify this Privacy Policy from time to time. Any changes to this Privacy Policy will become effective when we revise it on our website and internally announce it. We will provide additional notice of any significant updates. In case any modification deprives your right of Sensitive data in relation to this Privacy Policy, the Company will first obtain your consent, except as otherwise permitted by law.

The Personal Data we collect

We may collect your Personal Data that receive directly from you when you provide us Personal Data necessary such as telephone number, e-mail address, or other contact channels or another source not directly from you such as search, social media, government authorities, third parties, etc., to consider and enter into a contract, during the performance of our or your services for the Company.

The primary reason we process your Personal Data is to authorize, manage, administer, or enter into other agreements between the Company and the companies you represent or issue purchase orders, process payments, perform accounting, and manage our contracts. Review the services or your products, and other related activities.

In addition, we process Personal Data to comply with our legal obligations (such as record-keeping obligations, screening of committee member duties), as well as to manage our risks and operations (such as Prevention and detection of security threats Execute or defend legal claims).

The personal information we collect from you is any information that can be used to identify you directly or indirectly depending on the processing purpose. This includes, but is not limited to, the following Personal Data:

1.1) Identity and Personal Data

Such as First name, last name, nickname, date of birth, place of birth, age, gender, marital status, height, weight, interests, opinions, ability, photography, motion picture, audio, information about military obligations, information about habits, behaviors, attitudes, aptitude, skills, documents that can be used to identify you or issued by the government agencies (e.g., national identification card, passport, work permit, driving license, car registration book, professional license), signature.

1.2) Contact information

Such as address, household registration, telephone number, mobile phone number, e-mail address, social media account, and include other similar information.

1.3) Third party/reference information

Such as spouse, family member, or emergency contact by recording name, surname, relationship, telephone number, mobile phone number, and others as necessary.

If you provide Personal Data about family members, references, and/or other dependents, it is your responsibility to inform them of their rights with respect to the contents as applicable to them. You are also responsible for obtaining any required consent from them and ensuring that you have the right to provide their Personal Data to the Company.

1.4) Information about recruitment obtained from the application and selection process

Such as Information in resume or curriculum vitae (CV) such as working experience, previous employment (including position, department, title history, salary and benefits), education history, GPA, training history, certificates, qualifications, language skill, job application form and job interview.

1.5) Financial data or information regarding payment

Such as income, salary, bank account details (e.g., bank account number, bank name, branch, account type), tax, credit/debit card number, financial statement, payment term, and other financial-related information.

1.6) Sensitive data means the Personal Data classified by law as sensitive data. We will only collect, use, or disclose Sensitive Data, if we have received your explicit consent or as permitted by law

Such as health information, biometric information, religious, ethnic-religious belief, philosophy, race, nationality, disability, information about criminal records, blood group, the labor union information, and face recognition.

However, the Company has no intention to collect and use religious and blood type data specified in your identification card for any specific purpose. In the event that you provided the Company the copy of your identification card, it is requested that you conceal such data. If you did not conceal such data, it shall be deemed that you authorized the Company to conceal those data and it shall be deemed that such document with concealed data be valid and legally enforceable in all respects. In case that the Company is unable to conceal those data due to some technical limitation, the Company shall collect and use such data as a part of your identification documents only.

1.7) Other information

Such as Information necessary for screening data pursuant to communicable disease prevention measures, investigating conflicts of interest, information regarding whistleblowing, complaints, and disciplinary investigations, information collected from your participation in our activities as well as your responses in surveys and assessments, information that you choose to share and disclose through our application systems, tools, questionnaires, assessments, various documents.

2. The purposes of data collecting and process your Personal Data:

We will collect, use, or disclose your Personal Data under the following legal basis and circumstances, where:

2.1) It is necessary to consider and enter into a written or unwritten contract and manage our contractual relationship with you; purchasing, selling, and servicing; to carry out contract details, financial transactions, and services related to payments; to provide updates on your orders and on the delivery of the products; to process on invoice and receipt issuance.

2.2) It is necessary for managing and improving our services, products, and business operations for you;

2.3) It is necessary to inform you of information relating to marketing communication, activities, sales, services, public relations, notices, news, promotions, special offers, product display, procurement and support, special activities, and direct marketing.

2.4) It is necessary to create and maintain a database of your, to generate statistics pertaining to you; and to continuously improve our services, and necessary for evaluate your performance for future management and collaboration.

2.5) It is necessary to contact the parent company, a subsidiary, a group company, and an affiliated company of the Company.

2.6) It is necessary for preventing or suppressing a danger to a person’s life, body, or health, for instance, to prevent an epidemic, to provide first aid, or to make contact in case of an emergency.

2.7) It is required by law to obtain your explicit consent under PDPA.

2.7.1) Medical information about serious ill, chronic disease, disability: to provide work capability assessment, appropriate management compliance with relevant laws.

2.7.2) Biometric data e.g., fingerprint, face recognition

2.7.3) Your religious belief, philosophy, race, nationality, disability, genetic data for verification purposes and welfare allocation (e.g., food preparation, provision of religious holiday, and workforce planning)

2.8) In case that you disagree with Privacy Policy and refuse to give such Personal Data to the Company, Company may not be able to perform a contract or follow your request then may violate the laws or having other negative impacts to you.

3. Disclosure or transfer of the Personal Data

The Company may disclose, sent, or transfer your Personal Data to others with your consent or as permitted by law to third parties in accordance with the purposes under Privacy Policy for protect your Personal Data from unauthorized transactions. (e.g., Money laundering), litigation and other liability. These third parties may be located in Thailand and areas outside Thailand.

3.1) The directors, executives, staffs, contractors, agents or consultants, parent company, subsidiary, group company or affiliated company of the Company (hereinafter referred to as the “Group company”) collaborate and partially share systems (including website-relate services and systems) and as part of our regular reporting activities, we may need to transfer your Personal Data to, or otherwise allow access to such Personal Data other companies within the Group company for the purposes set out in this Privacy Policy.

3.2) Our service providers, business partner, and any other person or juristic person; we may also transfer or allow access to your Personal Data to third party, business partners and service providers including, but not limited to law firm, accounting firm, auditing firm and broker insurance.

3.3) Other third parties required by law: In certain circumstances, we may be required to disclose or share your Personal Data in order to comply with a legal or regulatory obligation. This includes any law enforcement agency, court, regulator, government authority or other third party where we believe it is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, the rights of any third party or individuals’ personal safety, or to detect, prevent, or otherwise address fraud, security, or safety issues (e.g., The Royal Thai Police, etc.).

4. Personal Data retention

We will retain your Personal Data for as long as necessary during the period we have a relationship with your business you represent or work for, or for ten years after termination of the agreement, or for as long as necessary in connection with the purposes set out in this Privacy Policy, unless law requires or permits a longer retention period.

We will delete or destroy your Personal Data when the retention period expires or when it becomes irrelevant or unnecessary for the purpose of collecting that Personal Data.

5. Our contact details

OGP Energy Solutions Co., Ltd.

55 Wave Place Building 10th floor, Wireless Road, Lumpini, Pathumwan, Bangkok 10330 Thailand

+66-2-255-7550 E-mail: pdp@ogps.co.th

(Monday– Friday: 08.20 – 17.00 hrs. except public holidays)

6. Cross-border transfer of the Personal Data

We may disclose or transfer your Personal Data to individuals, organizations, or third-party provider to Japan where the Group company is located or to any other destination outside Thailand. However, in some cases, the Personal Data protection standard in the destination country may not be adequate as required by the authority under the PDPA.

7. Your rights as a Data subject

You have the following rights pursuant to the provisions of the PDPA subject to the limitations and conditions under PDPA:

7.1) Right to withdraw consent: You have the right to withdraw consent for the Data Processing of the Personal Data by the Company at any time during the period of collection and retention of such Personal Data except where the withdrawal is restricted by law or a contract which gives benefits to you.

7.2) Right to access: You have the right to request for the access and copy of the Personal Data which are under the control of the Company. Also, if the Personal Data has been collected without your consent, you have the right to request for the disclosure of the acquisition of such Personal Data. However, any of the above-mentioned request may be refused if it is permitted under the law or court order or the exercise of such right may cause damage to rights and freedom of other persons.

7.3) You have the right (i) to request that the Company transfers the Personal Data to other data controller if it can be done by the automatic means or (ii) to request for the Personal Data in such formats that the Company sends or transfers to other data controller unless it is impossible to do so due to technical circumstances.

7.4) Right to object: You have the right to object the Data Processing of the Personal Data by the Company under certain circumstances as prescribed in the PDPA.

7.5) Right to request the erasure, destruction, and anonymization: You have the right to request the Company to erase, destruct, and anonymize the Personal Data under certain circumstances as prescribed in the PDPA.

7.6) Right to request the suspension of use: You have the right to request that the Company suspends the use of the Personal Data under certain circumstances as prescribed in the PDPA.

7.7) Right to request the update: You have the right to request the Company to ensure the Personal Data remains accurate, up to date, complete, and not misleading.

7.8) Right to lodge the complaint: You have the right to lodge the complaint to the relevant official authority under the PDPA of the violation of the PDPA by the Company and the employees or sub-contractors thereof.

If you wish to exercise any of the rights set out above, please contact us per the contact information described in Clause 5 of this Privacy Policy.

OGP Energy Solutions Co., Ltd.

Mr. Yuichi Ishisaka

Managing Director