TSUBAKI NAKASHIMA

Privacy Policy

Thailand EC Platforms

1. Scope

This privacy policy addendum ("Addendum") supplements the general privacy policy of Tsubaki Nakashima Group ("General Privacy Policy") and applies specifically to EC platforms operating in Thailand. In the event of any inconsistency or conflict between the General Privacy Policy and this Addendum, the provisions of this Addendum shall prevail.

2. Definition of Personal Data

Personal data means any information that can identify specific individuals, including but not limited to names, physical addresses, and email addresses.

3. Types of Personal Data under this Addendum

The Company may collect, use or disclose personal data of users in different ways depending on the relationship between you and the Company, as detailed below:

• Personal Details
  Title, name, gender, age, nationality, date of birth, national identification number or passport number, photograph.
• Contact Information
  Address as per ID card or house registration, current address, electronic address, telephone number, social network user account.
• Financial Information
  Bank account name and number, bank branch, bank deposit account information. Note: The Company does not store credit/debit card information. All payment transactions are securely processed by our designated payment agent.
• Work Details
  Occupation, job title, details about the establishment, location map of the establishment.
• Access Information
  Website usage behavior (e.g. cookies), IP addresses, device information, pages visited, date and time of access.
• Communication Records
  Records of conversations with customer service representatives via telephone, email, chat, social media, and other channels.

4. Purpose and Basis for Collecting Personal Data

The Company will collect, use, or disclose your personal data only when necessary or where there is a processing basis, which may include:

Contract-Based Processing

• Consider qualifications, screen and assess risks before entering into a contract
• Process requests, provide assistance, or answer questions
• Verify and confirm identity before service registration
• Process information to provide services
• Notification of transactions, payment proof, tax documents
• Follow-up on outstanding payments or debt collection

Processing Based on Legitimate Interests

• Managing business operations, risk assessment, fraud prevention
• Investigating and monitoring corruption, money laundering, or misconduct
• Managing customer relationships and handling complaints

Processing Based on Legal Obligation

• Compliance with applicable laws and regulations
• Following orders from competent authorities

Consent-Based Processing

• Optional services requiring explicit consent
• Personalized services to meet your specific needs

5. Disclosure of Personal Data

The Company may disclose your personal data to third parties in the following cases:

• When necessary to provide services (business partners, transportation providers, payment processors)
• When required by law or requested by competent authorities
• When you have given explicit consent
• When part or all of the Company's business is transferred
• When necessary to protect human life or property

6. Retention Period of Personal Data

The Company will retain your personal data for the duration of your relationship with the Company and for up to ten (10) years following its termination, unless required by law or necessary to establish or exercise legal claims. Upon expiration, the Company will promptly delete, destroy, or anonymize your personal data.

7. Transferring Personal Data Abroad

The Company may transfer your personal data to foreign jurisdictions, such as cloud servers located outside Thailand. In such cases, we will confirm the applicable domestic and regional laws and implement appropriate safeguards before transferring the data.

8. Security Standards

The Company implements organizational and technical measures to protect your personal data from unauthorized access, use, alteration, or disclosure. These include restricting access to authorized personnel only, requiring confidentiality obligations, and deploying security software to detect and prevent unauthorized access.

9. Collection of Personal Data of Individuals Lacking Legal Capacity

The Company does not intend to collect personal data from individuals who lack legal capacity, including minors (under 20 years of age unless legally married), quasi-incompetent persons, or incompetent persons as defined by applicable law. The Company requests that legal guardians ensure such individuals do not submit personal data. If such data is received without proper consent from the legal guardian, the Company will suspend processing and delete the data in accordance with applicable laws.

10. Persons Authorized to Access Personal Data

Access to personal data is restricted to Company personnel and authorized third-party contractors and/or agents whose responsibilities require such access for the purposes stated in this Addendum. If the Company appoints a third party to store or process your information, access will be limited to personnel of the designated third party whose duties are directly related to data storage or processing.

11. Rights of Data Owners

Under the Personal Data Protection Act, you have the following rights regarding your personal data:

• Right to Access
  Request access and copies of your personal data
• Right to Correction
  Request correction of inaccurate or incomplete data
• Right to Deletion
  Request deletion, destruction or anonymization of your data
• Right to Suspension
  Request suspension of data usage
• Right to Object
  Object to collection, use or disclosure of your data
• Right to Data Portability
  Request transfer of your data
• Right to Withdraw Consent
  Withdraw previously given consent
• Right to Complaint
  File complaints with competent authorities

12. Updates to Privacy Policy

The General Privacy Policy and this Addendum may be revised from time to time. Any changes will take effect upon posting the updated version on our website.

13. Applicable Law

This Addendum shall be construed in accordance with the laws of Thailand.

14. Contact Channels

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us: