Privacy Notice for Processes Relating to Tenants, Customers, and Buyers

Section 1: General Provisions

Chaithanin Company Limited and its affiliates place great importance on protecting the Personal data of partners, agents, and individuals associated with you or others whose information you have provided to us. To assure you that we protect and handle your Personal data in accordance with the Personal Data Protection Act, and in compliance with the Personal Data Protection Act B.E. 2562, Chaithanin Company Limited has established this Privacy Notice for processes related to you, those associated with you, or others whose information you have provided (“Notice”). This Notice clarifies the details of how we manage and process the Personal data we receive from you. It also explains the purposes for collecting, using, disclosing, and transferring your Personal data, as well as the retention period for such data. This includes actions such as recording, organizing, storing, modifying, adapting, retrieving, transmitting, transferring, disclosing, making accessible or available by any means, aligning, combining, restricting or prohibiting access, deleting, or destroying (“Processing”), and your rights as the owner of the Personal data. Chaithanin Company Limited recommends that you read and understand the terms and conditions under this Notice, the details of which are as follows:

Section 2: Definitions

“Company”	means Chaithanin Company Limited and its affiliates, including Marina Golden Bay Victoria Company Limited, Marina Golden Bay Elya Company Limited, Marina Golden Bay Geneva Company Limited, The Sunlight Residence 9 Company Limited, Global Top Group Company Limited, and other companies under the control of Chaithanin Company Limited.
“You”	means tenants, customers, and buyers.
“Personal data”	means any information relating to an identified or identifiable natural person, directly or indirectly, but excluding data of deceased persons.
“Sensitive Personal data”	means Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disability, trade union information, genetic data, biometric data, or any other information affecting data subjects in a similar manner as prescribed by the Personal data Protection Committee.
“Data Controller”	means a person or legal entity who has the power and duty to make decisions regarding the collection, use, or disclosure of Personal data.
“Data Processor”	means a person or legal entity who processes Personal data under the instructions or on behalf of the Data Controller.
“Personal Data Protection Act”	means the Personal Data Protection Act B.E. 2562 and its subordinate regulations, and shall include any future amendments to such laws.

Section 3: Groups or Categories of Individuals from Whom the company Collects Personal data

Under this Notice, the groups or categories of individuals from whom the company collects and processes Personal data include:

• Tenants: This refers to individuals who use or benefit from a property for a limited period and agree to pay rent for such use.
• Customers: This refers to individuals who engage in hiring or using services from the company, or any other similar individuals, such as event participants, website users, those contacting the company for information or services, and respondents to surveys regarding hiring or using the company’s services.
• Individuals Related to Customers: This refers to individuals related to or representing customers, such as executives, directors, employees, representatives, or any personnel of a customer who is a legal entity. This also includes individuals whose personal data appears in various documents related to the relevant processes, such as managers, purchasers, service recipients, and check payers.
• Buyers: This refers to individuals who enter into a contract with the company as the seller, where the seller agrees to transfer ownership of the property to the other party, referred to as the buyer. The buyer agrees to pay the price of the property to the seller. This also includes recipients of services from the company, or those who have been offered or solicited by the company to purchase goods or services, and users of goods or services from the company, even if no compensation is paid.

Section 4: How the Company Collects and Receives Your Personal data

4.1 The company collects and receives your personal data through various channels as follows:

 (A) Personal data you provide directly to the company
You may provide personal data to the company directly, such as when you submit a contract and supporting documents to the company, either by walk-in or by booking accommodation through external websites. This also includes cases where you provide information to the company and submit various documents containing your personal data.

 (B) Personal data automatically collected by the company
The company may receive your Personal data automatically, such as through CCTV recordings, collection of technical information, website traffic and browsing patterns, and your browsing history using cookies and similar technologies. You can find more details in the company’s “Cookies Notice.”

(C) Personal data the company receives from third parties
The company may receive your personal data from third parties, such as company websites where you have provided information, your references, and/or documents from individuals related to you as your contractual counterparty, emergency contacts, references, beneficiaries, or guarantors in your contract.

4.2 In collecting your personal data, you will be informed of the details as outlined in this Notice, including but not limited to the purposes and legal basis for the collection, use, disclosure, and/or processing of personal data. If the Personal Data Protection Act requires your consent for any personal data processing, the company will obtain your express consent.

4.3 If the company collected your personal data before the effective date of the Personal Data Protection Act concerning the collection, use, or disclosure of personal data, the company will continue to collect and use your personal data for the original purposes notified to you during the data collection. You have the right to withdraw your consent by contacting the company using the contact details provided in Section 11 of this Notice. The company reserves the right to consider your request for withdrawal of consent and to proceed in accordance with the Personal Data Protection Act.

Section 5: Personal Data Collected

Your personal data collected and processed under this Notice, whether provided directly to the company, collected automatically by the company, or received by the company from third parties, includes:

5.1 Personal information: such as name, surname, position, national identification number, taxpayer identification number, etc.

5.2 Contact information: such as residential address, delivery location, invoice address, telephone number, fax number, email address, etc.

5.3 Payment information: such as amount, payment terms, bank account number, personal data appearing on invoices, tax invoices, receipts, deposit slips, and account debit slips, etc.

5.4 Information used as evidence for registration as a tenant, customer, or buyer with the company or for various transactions: such as personal data appearing on copies of identification cards, passports, house registrations, name change certificates, customer account opening applications, power of attorney documents, company registration certificates, copies of personal income tax forms (PND.20), and sales contracts or other contracts related to transactions.

5.5 Technical Information: such as computer traffic logs, IP addresses, and data collected through cookies or similar technologies.

5.6 Shareholder Information: such as name, surname, telephone number, address, bank account number, nationality, number of shares, and a copy of the identification card.

5.7 Other Information: such as still and moving images captured through CCTV.

Section 6: Purposes and Legal Basis for Processing Personal Data

6.1 The company processes your personal data for various purposes under the following legal bases (collectively referred to as “personal data processing purposes”):

In the case of tenants/customers:

No.	Purpose	Legal Basis
1	To carry out various processes before entering into a contract, such as tenant/customer registration, qualification assessment, and/or compiling a list of prospective customers or similar individuals.	Legitimate Interest
2	To prepare and facilitate those who wish to visit the company’s premises and collect contact information for visitors in case of emergencies.	Legitimate Interest
3	To handle complaints from tenants/customers and related individuals or any other similar individuals.	Legitimate Interests
4	To communicate, publicize, advertise, offer promotions, and propose prices to tenants, customers, buyers, or any other similar individuals.	Legitimate Interests and Consent Interest
5	To organize activities for building relationships with tenants and customers, and to establish customer alliances, such as organizing seminars, recreational activities, and notifying tenants/customers of rewards.	Legitimate Interest
6	To monitor, maintain order, and ensure the safety of individuals and the company’s assets.	Legitimate Interests
7	To comply with laws relevant to the company’s business and lawful orders from government agencies and relevant officials, such as the Immigration Bureau, Revenue Department, and the Department of Special Investigation (DSI).	Legal Obligation and Public Task
8	To coordinate with relevant agencies for approvals according to the requests of tenants/customers, such as requesting changes to increase or decrease rental prices from the agreed-upon amount using credit.	Legitimate Interest

 In the case of Buyers:

No.	Purpose	Legal Basis
1	To carry out various processes before entering into a contract, such as buyer registration, qualification assessment, and/or compiling a list of prospective buyers or similar individuals.	Legitimate Interest
2	To consider and approve sales requests, including identity verification, authority checks, authorization and delegation processes, risk assessment of relevant transactions, and implementation of internal processes for contracting, contract performance, delivery, service provision, coordination, billing, delivery of relevant documents, tax submission, and facilitating audits.	Contract
3	To comply with laws relevant to the company’s business and lawful orders from government agencies and relevant officials, such as the Land Department, Revenue Department, and responding to requests for information from government officials.	Legal Obligation and Public Task
4	To comply with laws related to transactions between buyers and the company, such as laws on real estate transactions by government agencies, tax laws, laws on verifying land rights, audit laws, securities and exchange laws, and laws on government information.	Legal Obligation
5	To establish legal claims as evidence to counter legal claims, comply with court orders or orders from competent government agencies, and disclose or report your personal data to legally authorized government agencies.	Legal Obligation
6	For business communication, such as contacting, scheduling meetings, attending meetings, engaging in discussions regarding the purchase and sale of accommodations, real estate, and various projects of the company or projects related to the company, including recording details of such communications.	Legitimate Interests
7	To verify qualifications or assess suitability before entering into transactions, assess risks of relevant transactions, verify and authenticate identity, check authority, authorize and delegate the signing of agreements or contracts with the company, check business status, conduct background checks, and implement various internal processes of the company.	Legitimate Interest
8	To comply with laws, court warrants, letters, or orders from agencies, independent organizations, or officials with legal authority, such as complying with subpoenas, attachment orders, court orders, police officers, public prosecutors, government agencies, and reporting or disclosing information to shareholders, government agencies, or independent organizations like the Revenue Department, Land Department, Office of the Auditor General, and the National Anti-Corruption Commission (NACC) to comply with relevant laws.	Legal Obligation
9	To monitor, maintain order, and ensure the safety of individuals and the company’s assets.	Legitimate Interest

6.2 As the personal data processed for the purposes outlined in 6.1 above is necessary for legal compliance, contractual obligations, or the formation of a contract with you, failure to provide this data may have legal implications or prevent the company from fulfilling its contractual duties or entering into a contract with you (in some cases). In such instances, the company may be required to decline entering into a contract with you or providing you with associated benefits or entitlements, either in whole or in part.

6.3 Should the company process your personal data in a manner and/or for purposes not aligned with those stated above, additional privacy policies or notices will be provided, and/or you will be notified in writing explaining such processing. You should review these additional policies or notices in conjunction with this notice and/or such written communications (as applicable).

Section 7: Disclosure of Personal Data

7.1 The company may disclose your personal data under the specified purposes and in accordance with the principles prescribed by law to the following individuals and entities:

(a) Internal departments within the company, including but not limited to executives, directors, employees, and/or personnel of the company, as relevant and necessary for the processing of your personal data.

 (b) Business partners, service providers, and data processors authorized or hired by the company to manage/process personal data on behalf of the company for various services, such as IT services, payment services, postal services, parcel delivery services, or any other services that may benefit you or relate to the company’s business operations, such as commercial banks.

(c) Advisors of the company, such as legal advisors, lawyers, auditors, or other experts, both internal and external to the company.

(d) Government agencies with regulatory authority, or those requesting disclosure of personal data under legal authority, or involved in legal proceedings, or as permitted by relevant laws, such as the Revenue Department, Department of Business Development, Personal data Protection Committee, Royal Thai Police, Office of the Attorney General, courts, Legal Execution Department, Securities and Exchange Commission, and the shareholder registrar.

(e) Any other person or entity to whom you consent to the disclosure of your personal data.

7.2 The disclosure of your personal data to others will be carried out solely for the specified purposes or other purposes permitted by law. In cases where the law requires your consent, the company will obtain your consent prior to such disclosure.

7.3 When disclosing your personal data to others, the company will implement appropriate measures to protect the disclosed personal data and comply with the standards and obligations for personal data protection as stipulated by the Personal Data Protection Act. In the event that the company sends or transfers your personal data abroad, the company will take steps to ensure that the destination country, international organization, or recipient in the foreign country has adequate personal data protection standards, or ensure that the sending or transfer of your personal data abroad complies with the principles set forth in the Personal Data Protection Act. In some cases, the company may seek your consent for sending or transferring your personal data to such foreign countries.

Section 8: Personal Data Retention Period

The company will retain your personal data for the period necessary to fulfill the specified purposes of processing such personal data. The retention period will vary depending on the purposes for which the personal data is processed. However:

• In the case of tenants or customers, the company will retain your personal data for a period not exceeding 5 years from the date of termination of the legal relationship between you and the company.
• In the case of buyers, the company will retain your personal data for a period not exceeding 10 years from the date of termination of the legal relationship between you and the company. However, the company may retain some of your personal data for a period longer than this if permitted by law or if such retention is necessary for the operation of the company Group.

After the expiration of the aforementioned period, the company will delete or destroy such personal data from its storage or systems and those of other parties providing services to the company (if any), or render your personal data unidentifiable, except in cases where the company is permitted to retain such personal data further as stipulated by the Personal Data Protection Act or other relevant laws.

For further details regarding the retention period of your personal data, you may contact the company using the contact information provided in Section 11 of this Notice.

Section 9: Your Rights as a Data Subject

As a data subject, you have the rights stipulated by the Personal Data Protection Act B.E. 2562. You can exercise your rights through the channels specified by the company in Section 11. You can start exercising these rights once the Personal Data Protection Act becomes applicable to the company. These rights are detailed as follows:

(A) Right to Withdraw Consent:
In cases where the company requests your consent, you have the right to withdraw your consent to the processing of Personal data that you have consented to with the company, unless the withdrawal of consent is restricted by law or contract for your benefit. (However, the withdrawal of consent will not affect the processing of Personal data that you have already lawfully consented to.)

(B) Right to Access
You have the right to access and request a copy of your data under the responsibility of the company, including requesting the company to disclose how it obtained such data that you did not consent to.

(C) Data Portability Right
You have the right to request the company to transfer your Personal data that you have provided to the company as prescribed by law.

(D) Right to Object
You have the right to object to the processing of data relating to you for the collection, use, or disclosure of Personal data relating to you as prescribed by law.

(E) Erasure Right
You have the right to request the company to erase your Personal data as prescribed by law. However, the company may store your Personal data electronically, and there may be some systems that cannot delete the data. In such cases, the company will arrange for the destruction or anonymization of such data.

(F) Right to Restrict Processing
You have the right to request the company to restrict the use of your data as prescribed by law.

(G) Right to Rectification
If you believe that the data held by the company is inaccurate or you have changed your Personal data, you have the right to request the company to correct your Personal data so that such Personal data is accurate, up-to-date, complete, and not misleading.

(H) Right to Lodge a Complaint
You have the right to lodge a complaint with the competent official under the Personal Data Protection Act B.E. 2562 if the company violates or fails to comply with the said Act.
The company reserves the right to consider your request to exercise your rights and proceed in accordance with the Personal Data Protection Act.

Section 10: Amendments to this Notice

The company may amend this Privacy Notice from time to time. When such amendments are made, the company will notify you through the company’s website and/or via email. If it is necessary to obtain your consent, the company will also obtain your further consent.

11. Contact Information

If you have any questions or require further information about the protection of your personal data, the collection, use, or disclosure of your data, the exercise of your rights, or any complaints, you can contact the company through the following channels:

Company Name: Chaithanin Company Limited, Compliance Department

Address: 193/439 Moo 10, Nong Prue Subdistrict, Bang Lamung District, Chonburi Province 20150

Telephone: 0922508448

Business Days and Hours: Monday – Saturday, 09:00 – 18:00

Email: compliance@chaithanin.com

Announced on 1 December 2022