Customer Privacy Information Policy

• 1.1 To fulfill membership agreements, such as accumulating points, using or redeeming points, offering and receiving promotions and benefits, participating in membership activities, managing customer's account, delivering products, and handling accounting and finances.
• 1.2 For the legitimate interests of the Company or third parties as follows:
  (1) To allow the Company to handle, enhance, and run its operations, including overseeing and improving the website and application, preventing fraud or other criminal activities, managing relationships with current and prospective members, maintaining and utilizing IT systems, and restructuring, selling, or transferring the Company's assets or business units.
  (2) For security reasons, including the implementation of security protocols that involve personal data of Customer(s), such as gaining access to company premises or logging into the website or application.
  (3) To conduct marketing and data analysis, such as sending news and benefits via email, SMS, application, social media, phone, and direct mail, as well as conducting market research through surveys or interviews.
  (4) To exercise legal rights related to the Company and/or Customer(s).
• 1.3 To prevent and mitigate risks to life, body, and health of the Customer(s) or others, such as contacting in emergencies or controlling and preventing infectious diseases.
• 1.4 To comply with laws, such as following legal provisions, regulations, and orders of legal authorities.
• 1.5 To carry out duties for public benefit or to perform national duties as assigned.
• 1.6 If the Customer provides consent, the Company shall process personal data for the following purposes:
  (1) To allow the Company, subsidiaries, affiliates, and partners to send news and benefits via email, SMS, application, social media, phone, and direct mail.
  (2) To enable the Company to conduct those mentioned activities, which may involve collecting additional personal data. The Company shall notify and seek the Customer's consent accordingly. Details on consent can be found in Section 4.

• 2.1 When the Customer registers as a member of Siam Global House Public Company Limited and during the membership, the Company shall seek the consent to collect the following data:
  (1) Personal information such as ID card number, title, first and last name, date of birth, phone number, email, status, occupation, login credentials, current address, and address as per your ID card.
  (2) Data when the Customer accumulates points, information about purchases and/or services, such as product type, purchase history, return history, claims, financial information, benefits received, and payment history.
  (3) In the event of a refund request, the Company shall collect additional personal data, such as bank account details and ID card.
• 2.2 When the Customer visits the website or application, the company shall collect the following personal data:
  (1) Information about the electronic device you use, such as IP address.
  (2) The type and version of the browser that is used, including the type and version of browser plug-ins.
  (3) Time zone settings.
• 2.3 When the Customer contacts the Company or participate in any activities, such as contacting the Contact Center, completing a Customer Satisfaction survey, or engaging in benefits activities, the Company shall collect the following personal data:
  (1) Personal information such as name, surname, date of birth, status, occupation, photo, and ID card number.
  (2) Contact information such as phone number, email, and address.
  (3) Customer complaints.
  (4) Information related to the Customer participation in activities, such as activity participation or photos from events.
• 2.4 The Company may need to collect and process special personal data as defined by data protection laws, for the purposes outlined in this policy. This may occur when the Customer chooses to disclose such data to the Company, or when such data is provided to the Company by others. In certain cases, the Company may collect special personal data even if the product or service does not directly relate to such data. For example, the Company may need to use the Customer's ID card, which includes religious information, to verify the identity, or collect food allergy information when providing food-related services or organizing relationship-building activities between the Company and members.
• 2.5 If necessary, the Company shall process special personal data only with explicit consent from the Customer or for other purposes permitted by law. The Company shall attempt to implement adequate security measures to protect such data.

• 3.1 The Company's website uses cookies to collect personal data as specified in the Cookie Policy.
• 3.2 The Company's application uses technologies similar to cookies, such as Google Analytics, Mobile App Heatmap, and EDM Tag to collect personal data like application usage behavior, to help the company improve the application experience and offer special privileges that better match their interests.

In cases where the Company collects and processes personal data based on the Customers' consent, they have the right to withdraw such consent at any time. Withdrawing consent shall not affect the collection, use, disclosure, or processing of personal data that was previously consented to.

If the Customers withdraw the consent or refuse to provide certain information, the Company may be unable to fulfill some or all of the purposes stated in this policy.

If the Customers are under 20 years old, please provide details of their legal guardian before giving consent, so that the Company can obtain consent from your guardian as required.

• 5.1 The Company shall keep personal data for as long as needed to fulfill the specific purposes for each data type unless a longer retention period is legally allowed. If the retention period cannot be precisely determined, the Company will retain the data according to standard retention periods, such as the maximum legal statute of limitations, which may extend up to 10 years.
• 5.2 The Company has implemented a system to review and delete or destroy personal data once the retention period has expired, if the data is no longer relevant, or if the data exceeds the necessary scope for the purposes for which it was collected.
• 5.3 If the Company processes the personal data based on the Customer's consent, the Company shall continue processing until the consent is withdrawn. Once a request to withdraw consent is completed, the Company shall retain only the personal data necessary to maintain a record that the Customer has withdrawn consent, so it can respond to future requests accordingly.

• 6.1 The Company will not disclose any of personal data without consent, except in cases permitted by data protection laws.
• 6.2 The Company Discloses and Shares the Customer Personal Data with:
  (1) Subsidiaries, affiliated companies, and partnership companies providing and selling construction materials and home appliances.
  (2) Individuals and Juristic Person that are not affiliates ('third parties') to fulfill the purposes of collecting and processing personal data as outlined in this policy. These include company representatives, service providers for points exchange or transfer, transportation providers (e.g., postal services), transaction and financial service providers (e.g., banks, payment processing companies, electronic payment providers, credit service providers), technology service providers (e.g., cloud systems, blockchain systems, SMS or email messaging systems), IT program and system providers, auditors, consultants, government agencies (e.g., Revenue Department, Anti-Money Laundering Office or ALMO), and other entities necessary for conducting business, providing services, and fulfilling the purposes of collecting and processing personal data as outlined in this policy.
• 6.3 In the event of a restructuring, sale or transfer of the Company's business or assets, the Company may disclose the personal data to the transferee or purchaser of the business, and/or their advisors. However, the Company shall make every effort to protect personal data and require the purchaser and/or their advisors to comply with data protection laws and this policy.
• 6.4 The Company shall implement appropriate measures to protect and process personal data only as necessary, and also prevent unauthorized use or disclosure of personal data.

• 7.1 The Company may transfer personal data to affiliates or third parties in foreign countries when necessary. This could be to fulfill a contract involving The Customer, to take pre-contractual actions at the request, to protect or prevent harm to life, body, or health, to comply with legal obligations, or to carry out tasks of significant public interest.
• 7.2 The data may be stored on servers or cloud services provided by third parties, and the Company may use third-party programs or applications in the form of Software as a Service (SaaS) or Platform as a Service (PaaS) to process your personal data. However, the Company shall ensure that no unauthorized individuals can access personal data and require these third parties to implement appropriate security measures.
• 7.3 In cases where the personal data is transferred to foreign countries, the Company shall comply with data protection laws and take appropriate measures to ensure that the data is protected. This includes ensuring that the recipients of such data have adequate protection measures, and that the data is processed only as necessary. The Company shall also prevent unauthorized use or disclosure of the personal data.

• 8.1 The security of personal data is important to the Company. The Company has implemented appropriate technical and administrative security measures to protect personal data from loss, unauthorized access, misuse, alteration, and destruction. These measures include encryption and access restrictions, ensuring that only permitted personnel trained in the importance of data protection can access the personal data.
• 8.2 Appropriate security measures are used to prevent unauthorized access, use, alteration, modification, or disclosure of personal data by individuals who do not have the right or duty related to such data. These measures shall be reviewed as necessary or when technological changes occur to maintain effective security.
• 8.3 The Company has integrated the Customer Privacy Information Policy with its risk management system as follows:
  (1) The Company complies with the Personal Data Protection Act B.E. 2562 to ensure the safety of customer and stakeholder data.
  (2) The policy is communicated, and consent is requested for data use, including responding to data subject rights.
  (3) A Data Protection Officer (DPO) has been appointed, and all personnel receive training to comply with data protection laws.
  (4) Cyber risk management includes installing firewalls and monitoring to prevent data loss or leakage. The Company also has a disaster recovery plan.

• 9.1 The Customer has rights under the Data Protection Act, summarized as follows:
  (1) Withdraw consent for the company to process such personal data.
  (2) Request to view and obtain copies of personal data or request disclosure of the source of personal data.
  (3) Send or transfer personal data in electronic form as prescribed by the Personal Data Protection Act to another personal data controller.
  (4) Object to the collection, use, or disclosure of personal data.
  (5) Request the deletion, destruction, or anonymization of personal data.
  (6) Restrict the use of personal data.
  (7) Rightfully correct personal data to ensure it is accurate, up-to-date, complete, and not misleading.
  (8) File a complaint with the Personal Data Protection Committee if the Company or its data processors, employees, contractors, or other agents violate or fail to comply with the data protection law. The Company shall consider and respond to such request within 30 days from the date of receipt. These rights are subject to the provisions of the data protection law.

• 10.1 For inquiries regarding this notice, please contact:
• Data Protection Officer (DPO)
• Siam Global House Public Company Limited
• 232 Moo 19, Rob Muang Subdistrict, Muang District, Roi Et Province, 45000
• Tel.: 1160
• Email: dpo@globalhouse.co.th