Privacy Notice

Privacy Notice

Sermsang Power Corporation PLC.

Sermsang Power Corporation Public Company Limited and its subsidiaries (hereinafter referred to as the “Company”) respect the rights of privacy. They also recognize the importance of personal data protection of business partners, as well as directors, employees, and staff (collectively, “You”) to ensure that your personal data are protected. Therefore, the Company has issued this data processing notice to inform you of the details related to the collection, use, disclosure of personal information, including management, deletion, and destruction of your personal data in all channels according to the laws of personal data protection as follows:

1. DEFINITION

“You” means the owner of personal data which the Company processes. This includes, but is not limited to, investors, website users, customers, employees, personnel, agents, and any persons involved in the activities and operations of the Company. “Company” means Sermsang Power Corporation Public Company Limited and its subsidiaries. “Group” means companies established by Sermsang Power Corporation Public Company Limited. The Company holds shares, directly or indirectly, not less than 50% of the registered capital as follows:

SUBSIDIARIES IN THAILAND

1. Sermsang Palang Ngan Co., Ltd. (“SPN”)
2. Access Energy Co, Ltd. (“AE”)
3. Essential Power Co., Ltd. (“EP”)
4. Plus Energy Co., Ltd. (“PE”)
5. Prestige Group Co., Ltd. (“PTG”)
6. Triple P Renewable Co., Ltd. (“PPP”)
7. Sian Clean Solution Co., Ltd. (“SCS”)
8. Sian Renewable Power Co., Ltd. (“SRP”)
9. Sermsang Solar Co., Ltd. (“SS”)
10. Sermsang Corporation Co., Ltd. (“SSC”)
11. Sermsang International Co., Ltd. (“SI”)
12. Sermsang Infinite Co., Ltd. (“SN”)
13. Uni Power Tech Co., Ltd. (“UPT”)

SUBSIDIARIES IN FOREIGN COUNTRIES

1. S. Global Power Limited (“SGP”)
2. Surge Energy Corporation Limited (“SEG”)
3. Access C Management Limited (“ACM”)
4. Seijo Corporation (“SJC”)
5. Sermsang Sustainable Singapore Private Limited (“SSSG”)
6. Tenunn Gerel Construction LLC (“TGC”)
7. Truong Thanh Quang Ngai Power And High Technology Joint Stock Company (“TTQN”)
8. SEA Sun Energy Partners Pte.Ltd. (“SSEP)
9. PT Sea Sun Energi (“SSE”)
10. Truong Thanh Tra Vinh Wind Power Joint Stock Company (“TTTV”) GK OPERATOR (UNDER GK-TK INVESTMENT STRUCTURE) THAT SEG (AS TK INVESTOR) ENTERED INTO TK AGREEMENT WITH
11. k. SS Hidaka No Mori G.K. ("SSH"),
12. G.K. GSSE ("GSSE")
13. Zouen Energy G.K. ("ZOUEN")
14. Ashita Power 1 G.K. ("ASP1")
15. Ashita Power 2 G.K. ("ASP2")

“Personal Data Protection Laws” means the Personal Data Protection Act B.E. 2562 (2019) and related laws, as well as any amended laws in the future.

“Personal information” means information about a natural person which enables an individual to be identified either directly or indirectly, but does not include information of the deceased in accordance with the laws on protection of personal data.

“Processing” means any processing of personal data, whether by automated means or not, such as collection, records, systematization, storage, adjustment or modification, retrieval, consultation, usage, disclosure (by transmitting, transferring, publishing or making accessible or available by any means), arrangement, integration, blockage or restriction, deletion or destruction.

“Personal Data Controller” means a natural person or a juristic person who has the authority to make decisions about the collection, use or disclosure of personal information.

“Personal data processor” means a natural person or a juristic person who performs the collection, use or disclosure of personal information under the order or on behalf of the personal data controller. However, such natural person or juristic person is not a personal data controller.

2. General details

This Privacy Notice is made to clarify details and methods of handling and processing personal data which the Company obtained from you for using, disclosing, and processing, as well as the period of retaining such personal data and your rights as the personal data subject. Since the Company operates its business in Thailand, the processing of your personal data must therefore be in compliance with the data protection laws of Thailand.

3. Collection and receipt of personal information

The Company collects and receives your personal data through the channels as follows:

1. Personal data which you directly provide to the Company: You may directly provide your personal data to the Company when you fill out any forms through the Company’s website or other channels of the Company together with your contract and other copies of documents which contain your personal information, or when you request for information, giving opinions or comments, submitting complaints to the Company by telephone, e-mail, fax, post, etc.
2. Personal information which the Company automatically collects from you: The Company may collect certain technical information about your device, activities, types of viewing, browsing by Cookies and other similar technologies. For other details, please see Cookie Policy.
3. Personal information which the Company obtains from outsiders: The Company may obtain your personal information from outsiders, such as government agencies, websites of the Department of Business Development, Revenue Department, or other websites.

When collecting your personal information, you shall be informed of the details in this Privacy Notice, including legal bases for collecting, using and/or disclosing personal data according to the laws. In case that the personal data protection law requires your consent, the Company shall request your consent to allow the Company to process your personal information.

4. Collected personal data

Personal information collected by the Company under this Privacy Notice can be from different types of data subjects as follows:

1. Customers and investors such as a normal person who holds securities, website visitors, service recipients, participants to activities or seminars, and others who contact to receive information or services from the Company both directly and indirectly.
2. Contract partners, professionals, and related persons to the Company’s business such as a normal person who is a contract partner or related to the Company’s contracts, including business partners, sellers, service providers, contractors, consultants, professionals in the securities business, and other similar persons
3. The Company’s personnel such as normal persons who are the Company’s employees, staff or any other persons who work for the Company, directors, managers, executives, specialists and persons obtaining salaries, wages, benefits or any other remunerations directly from the Company, including family members of the Company’s personnel
4. Applicants such as a normal person submitting an application or details of personal history to the Company in writing or verbal with a purpose for a job/internship/scholarship as employee or staff/trainee/applicant of the Company, but not yet considered by the Company, including the applicant’s family members and reference persons

Your personal data collected under this Privacy Notice, which you directly provide to the Company or the Company automatically collects from you, or personal information that the Company receives from outsiders as follows:

1. Personal information such as your name-surname, date/month/year of birth, age, gender, photos, ID number and copy of your passport or personal ID card, signature, nationality, marital status, and family information.
2. Sensitive personal data such as religion, criminal history, health information, results of health check-up, disability, and biometric information
3. Contact information such as home address, phone number, e-mail, social media contact, and details of contact person in case of emergency
4. Financial information such as bank account number and details of tax information
5. Information about securities/derivatives such as trading account, interest or dividend, deposit/withdrawal, transfer or change of holders, and securities pledge notification
6. Technical information including your access to the Company’s websites and systems, Log data, contacts and communications between you and other users, recorded information such as computer IP address, code and type of device, mobile network, data connection, GPS, Browser, log-in and log-out of system, referring website, Login Log history, transaction Log, customer behavior, access time, data search, use of functions, the Company’s Cookies, or other similar technologies
7. Information about education, training, and employment such as educational background and training, certificate of qualification or academic transcript, scores or grades, level of education, language proficiency, professional license, registration number, issued date of registration, expired date of registration, renewal of registration, employment data, start date of employment, training and testing information provided by the Company or other related agencies, diploma or certificate, employment history, salary or wages
8. Other information such as video and/or audio recording via CCTV, photo, video and audio recording, recorded conversation, and purchasing trends of goods or services

If the Company collects your personal information before June 1, 2021, it shall process such information in compliance with the laws on personal data protection.

5. Purposes and legal bases for collection, use, and disclosure of personal data

The Company processes your personal data for the following purposes (collectively, the “Designated Purposes”) and legal bases as follows:

• Performing a contract to which you are a party with the Company or processing as you request before making a contract
• Complying with the law of the Company
• Performing duties in a mission for the Company’s public interest or exercising state powers given to the Company
• Preventing or suppressing a danger to life, body or health of a person
• Achieving research or statistical purposes with appropriate measures to protect your rights and freedoms
• Consent given to the Company with no exception or legal basis for the above specified cases or as described in the table below. However, if the Company requests your specific consent for any personal data, it shall process according to the specified purposes with your consent. The Company also shall process any sensitive personal data in compliance with the laws or your clear consent.

Since your personal information for processing with the above specified purposes in 5.1 is relevant to the laws or a contract and necessary for the achievement of such purposes, if you do not provide such personal information to the Company, there shall be legal implications or the Company may not be able to perform its duties under a contract with you or may be unable to have a contract with you. Thus, the Company may be obliged to decline a contract with you or cancel services related to you in whole or in part.

If the Company wishes to use your personal information for the purposes not specified above, it shall provide an additional privacy notice to explain the use of data for those purposes. You should read the additional privacy notice together with this privacy notice.

6. Disclosure of personal information

The Company may disclose your personal information under the specified purposes and relevant to the laws to the agencies and persons as follows:

1. The Stock Exchange of Thailand and listed companies in the Stock Exchange of Thailand, including employees, staff, directors, managers, or personnel of the Company as a need-to-know basis for the processing of your personal information
2. Government and regulatory agencies, such as the Securities and Exchange Commission, Bank of Thailand, Office of the Government Information Commission, Office of Insurance Commission, Department of Provincial Administration, Revenue Department, Department of Business Development, and Department of Intellectual Property
3. Agencies requesting for disclosure of personal information according to the laws for litigation or legal actions or related to legal processes, such as the Anti-Money Laundering Office, Office of the National Anti-Corruption Commission, Royal Thai Police Department, Special Investigation, and Office of the Attorney General
4. Associations related to the capital market business in Thailand, such as the Thai Listed Companies Association, Association of Thai Securities Companies, Association of Investment Management Companies, Thai Bankers Association, Securities Analysts Association, and the Thai Investors Association
5. Securities issuer companies, member companies, securities companies, Asset Management Company, brokerage, trading or underwriting of securities
6. Alliances, business partners, service providers, service recipients and personal data processors assigned by the Company for service duties or management of personal information, such as development, improvement, or maintenance of safety standards of work systems, and information technology systems, payment system, accounting audit, Human Resources Management, or any other services that may be beneficial to you

Disclosure of your personal information to others shall be performed under specified purposes or other purposes only as required by laws. If your consent is required, the Company shall request your clear consent first.

If the Company sends or transfers your personal information abroad, it shall ensure that the sending or transfer reaches the destination countries, international organizations or overseas recipients with sufficient personal data protection standards. In some cases, the Company may request your consent for the transfer of your personal data abroad, depending on the applicable personal data protection laws.

7. Duration of personal data

The Company shall keep your personal data for a necessary period to achieve the specified purposes in processing of such personal data. The duration shall vary depending on the purposes of collecting and processing personal data.

Personal data shall be kept for a period of time as required by laws and according to business practices for each type of personal data. After such period, the Company may destroy the personal data from its storage or systems without prior notice to you.

8. Rights of data subject

As the data subject, you have the rights in relation to your personal data under the rules, procedures, and conditions as prescribed by the laws. If wishing to request for your rights, you may contact the Company at the contact details in 11 (How to Contact the Company).

Right to access personal data

You have the rights to access your personal data and request the Company for copies of such personal data, including disclosure on the acquisition of your personal information which the Company collects, uses, and discloses without your consent in accordance with the personal data protection laws.

Rights to transfer personal data

You have the right to obtain your personal data generally in a readable or usable form through an automated tool or device, including the right to request the sending or transfer of your personal data in such form to another personal data controller or yourself, unless it cannot be done due to some technical conditions in accordance with the personal data protection laws.

Rights to reject processing of personal data

You have the right to reject processing your personal data as follows:

1. The Company takes your legitimate interest or that of a third party to process your personal data for public benefit, unless the Company can clarify with legal grounds that the processing of your personal data is aimed for the rights to claim, compliance, or legal defense.
2. The Company processes your personal data for direct marketing purposes.
3. The Company processes your personal data for scientific research purposes, history, or statistics, unless it is necessary for the Company’s public interest.

If you reject the processing, please indicate whether you wish your personal data to be deleted or suspend the Company from processing such personal data.

Rights for deletion of personal data

You may request the Company to delete or make your personal information non-personally identifiable as follows:

1. Your personal data is no longer necessary for keeping in according to the specified purposes for the processing of your personal data.
2. You withdraw your consent for the collection and processing of personal data. The Company no longer has legal authority to collect or process such personal data.
3. You reject the processing in 8.3.
4. The collection or processing of your personal data is unlawful.

The above cases shall not apply to the necessary processing of personal data for freedom of expression, documentary history, or statistics in performing duties to the public interest according to the laws towards preventive or occupational medicine objectives, or public interest in public health, while establishing, exercising or fighting legal claims, and complying with laws.

Rights to suspend the use of personal data

You have the right to suspend the processing of your personal data as follows:

1. The Company is in the process of verifying the accuracy of your personal information as you request.
2. You wish to suspend the use instead of deletion of your personal data in 8.4.
3. The Company no longer needs to use your personal information. However, you wish the Company to keep your personal data to establish a claim, comply, or exercise the claims, or raise against legal claims.
4. The Company is in the process of verifying 8.3 (a) or reviewing 8.3 (c) to decline your refusal in 8.

Rights to correct personal data

You have the rights to request for correction of your personal data if it is inaccurate, outdate, incomplete, or misled.

The rights to withdraw consent

You have the right to withdraw your consent to the processing of your personal data any time during the personal information is in the possession of the Company.

The rights to file a complaint

If you have any concerns or questions about the processing of your personal data, please contact the Company by the contact details in 11. In case of the violation of personal data protection laws, you have the rights to file a complaint with the Office of the Personal Data Protection Commission.

The Company shall apply relevant systems to facilitate and process your request without delay, unless the request creates an unreasonable burden on the Company or risks of infringing on the protection of personal information of others, or against the laws, or impossible to act upon the request.

9. Security and safety in keeping personal information

The Company establishes and/or uses a system to store your personal information with appropriate mechanisms and techniques, as well as security measures according to the laws on personal data protection and related laws, including limiting access to your personal data from employees, staff, and representatives of the Company to prevent your personal information from being used, disclosed, destroyed or accessed without permission.

10. Link to websites, products, and services of outsiders

The Company may have links to websites, applications, products, and services of outsiders. Those outsiders may take some information on your use of services. This privacy notice is only for the processing of personal data for the purposes specified by the Company. The Company cannot be responsible for the security or privacy of any of your information collected by the website, applications, products, or services of outsiders. You should be careful and review the privacy notices/privacy policy of individual websites, applications, products, and services of such outsiders.

11. Contact channels

If you have any questions about this privacy notice or wish to exercise your rights in this Privacy Notice, you can contact the Company by the contact details as follows:

Sermsang Power Corporation Public Company Limited

325/14 Lan Luang Road, Si Yaek Mahanak Subdistrict, Dusit District, Bangkok 10300

Tel. +66 2 628 0991-2

E-mail: [email protected]

12. Law enforcement

This Privacy Notice is enforced and construed in accordance with Thai laws. The courts of Thailand are authorized to administer any disputes that may arise or in connection with this Privacy Notice.

13. Amendment to this Privacy Notice

The Company may from time to time amend this Privacy Notice to comply with any changes related to the processing of your personal data and any amendments in the personal data protection laws or other relevant laws. The Company shall notify you of any changes through appropriate channels.

This Privacy Notice is effective from 1 April 2022.

Sermsang Power Corporation Public Company Limited