PERSONAL DATA PRIVACY NOTICE

PERSONAL DATA PRIVACY NOTICE
OF PANTAINORASINGH MANUFACTURER CO., LTD.

1. General Provisions

For the purpose of complying with the Personal Data Protection Act B.E. 2562 (2019) and subordinate laws issued thereunder, including any amendments which may be made thereto (“Laws on Personal Data Protection”), Pantainorasingh Manufacturer Co., Ltd. (“Company”) has prepared this personal data privacy notice (“Privacy Notice”) to inform you regarding how the Company handles information which can or may identify you, whether directly or indirectly, according to the Laws on Personal Data Protection (“Personal Data”), for instance, the methods by which Personal Data is collected, used, disclosed or dealt with, whether by manual or automated means, such as recording, organization, storage, adaptation or alteration, retrieval, sending, transfer, disclosure or making available by any means, alignment, combination, prohibition of access or restriction, erasure or destruction (“Processing”, “Process”, “Processes” or “Processed”), as well as to notify you of the purposes for such Processing, the retention period of Personal Data, and your rights as the data subject. In this regard, the Company recommends that you read and understand the following terms under the Privacy Notice:

2. The Categories of Persons whom the Company Collects Personal Data and the Sources of Personal Data

2.1 Categories and Sources

(a) Customers
Details – Persons who purchase products and/or use the services of the Company, those expected to do so (prospective customers), or any other persons having similar characteristics such as activity participants, seminar attendees, bidders, website or application users, persons who contact the Company for information or services, and persons who respond to surveys on the Company’s products and/or services. Also included are natural persons related to, or representing, juristic-person customers and persons whose Personal Data appear in relevant documents and processes. (See the Privacy Notice for customer-related processes of the Pantainorasingh Group.)
Sources of Personal Data –

• When you engage in communications or make enquiries via website/application, phone, e-mail, face-to-face or other channels.
• When you express an intention to purchase products or services and enter into a contract with the Company.
• When you register through the Company’s websites or applications (including third-party sign-in).
• When you join marketing activities, loyalty programmes, surveys, questionnaires, provide feedback, enter lucky draws, events or other activities organised by or on behalf of the Company.
• Collection from the Company’s service providers (application providers, e-commerce platforms, PR and recommendation services, etc.).
• In some cases, collection from public sources, whether you disclosed the data yourself or consented to a third party doing so.

(b) Vendors
Details – Persons who provide quotations for products and/or services to be sold to the Company or who otherwise engage with the Company in a similar capacity (farmers, middlemen, service providers, consultants, experts, academics, lecturers, franchise operators, project participants, contracting parties, etc.). Also included are natural persons related to, or representing, juristic-person vendors and persons whose Personal Data appear in relevant documents and processes. (See the Privacy Notice for vendor-related processes of the Pantainorasingh Group.)
Sources of Personal Data –

• Forms you submit via the Company’s website or other means.
• Contracts you enter into with the Company and documents you provide.
• Enquiries, comments, suggestions or complaints you submit by phone, e-mail or other means.
• Public data sources, business-information sources or trade-information sources, whether you disclosed the data or consented to someone else doing so.

(c) Personnel
Details – Persons who work or perform duties for the Company and receive compensation (directors, executives, managers, employees, personnel, trainees, etc.), plus their related persons (family members, reference persons, emergency contacts) and persons whose data appear in relevant documents and processes. (See the Privacy Notice for personnel-related processes of the Pantainorasingh Group.)
Sources of Personal Data –

• Employment contracts or similar agreements you enter into with the Company.
• Documents you submit as supporting evidence for contracts or juristic acts.
• In some cases, data provided because of your status as family member, emergency contact, beneficiary or guarantor for Company personnel.

(d) Job applicants
Details – Persons who may be selected as Company personnel, plus their related persons (family, reference persons, emergency contacts) and persons whose data are contained in job-application documents. (See the Privacy Notice for personnel-related processes of the Pantainorasingh Group.)
Sources of Personal Data –

• Job applications and supporting documents submitted in person, at job fairs, or via the Company’s website.
• Interviews with the Company.
• Data from third-party websites, reference persons, recruiters, government bodies, educational institutions or social media, whether you provided it yourself or consented to disclosure.

(e) Shareholders or securities holders
Details – Persons who hold shares or other securities of the Company (e.g., bond holders).
Sources of Personal Data –

• Documents you submit when becoming a shareholder.
• Data received from Thailand Securities Depository Co., Ltd., banks or debenture registrars relating to your holder status.

(f) General public
Details – Any person not falling into the above categories whose Personal Data are processed by the Company, whether received directly, automatically collected (e.g., via cookies) or provided by a third party—such as individuals recorded by CCTV or who access the Company website.
Sources of Personal Data –

• CCTV images or video controlled by the Company.
• Intentional or unintentional access to the Company’s website.

2.2 In some cases, the Company may collect your Personal Data by automated means such as the use of Cookies or other similar technologies. For more details, please see the Company’s Cookie Policy.

2.3 In collecting your Personal Data, you will be informed of the details as set out in this Privacy Notice, including but not limited to, the lawful basis for the collection, use, disclosure and/or Processing of Personal Data in accordance with the lawful purposes, or in the event that the Laws on Personal Data Protection require your consent for any Processing of Personal Data, the Company will request your explicit consent.

2.4 Where the Company has previously collected your Personal Data before the Laws on Personal Data Protection have become effective, the Company will continue to collect and use your Personal Data in accordance with the original purposes of collection. In this regard, you have the right to withdraw your consent by contacting the Company using the contact details set out in Clause 9 of this Privacy Notice. However, the Company reserves the right to consider your request for the withdrawal of consent and proceed in accordance with the Laws on Personal Data Protection.

3. Collected Personal Data

Your Personal Data that is collected and Processed under this Privacy Notice, regardless of whether such Personal Data was directly provided by you to the Company or automatically collected from you by the Company, or was provided to the Company by third parties, includes the following:

3.1 Personal information, such as first name, last name, date/month/year of birth, age, sex, weight, height, national identification number, photograph, signature, nationality, race, religion, marital status, military status, information concerning family members (such as father, mother, spouse and child), health conditions, biometric data (such as finger print, palm print and facial simulation), etc.

3.2 Contact information, such as address as stated on the national identification card, address as stated in the house registration book, delivery address, billing address, telephone number, fax number, e-mail, social media accounts (e.g. Facebook, Instagram, Twitter, Line ID or third-party service providers, etc.), person who may be contacted in case of emergency, and details of reference person, etc.

3.3 Business information, such as details concerning the customer’s factory (such as name, registration number, location, contact details), car number plate, type of car, Personal Data which is contained in the registry of farmers, copy of document of title, map, latitude and longitude of the farm, terms of trade, etc.

3.4 Information concerning sale and purchase transaction, such as customer code, vendor code, order details (such as the wishlisted product, the quantity and quality), details of the wishlisted product (for example, the net weight, dampness and quality of the raw materials), details of complaints concerning the product (for example, the date of order, type of product, the relevant branch, and the problem that is found), the number of the temporary product receipt, details of delivery and raw materials, number for tracking (traceability system), etc.

3.5 Information concerning payment, such as the monetary amount, the credit limit, the payment terms, the account number, Personal Data which appears in the tax invoice, cheque and cheque stub, payment voucher, receipt, receipt voucher and debit application form, etc.

3.6 Information concerning attention and behavior, such as behavior or trends to purchase products and/or services, user preference on social media, website, or the Company's public relation channels, etc.

3.7 Information that is used as supporting evidence of the execution of transactions and juristic acts, such as Personal Data which appears in a copy of the national identification card, copy of passport, copy of house registration book, copy of change of name certificate, copy of factory license, registration form, copy of documents of title over land, customer’s account opening form, document certifying non-related party, power of attorney, company affidavit, PhorPor. 09/20, map, security documents (such as title deed, bank guarantee, personal guarantee), sale and purchase agreement or any other agreement relating to the transaction, delivery order, copy of lawyer’s license, professional license or business license, copy of military service certificate, copy of bank account book, copy of marriage certificate, copy of birth certificate, form for approval of salary of new staff and monthly staff, medical certificate, result of pre-employment medical check, form for specifying beneficiary, social security application form, letter of consent for personal background check, result of personal background check, employment contract, letter of guarantee for performance of employment contract and related documents (such as certificate of employment specifying job position, copy of civil servant card, certificate of employment specifying salary, copy of business registration, or document on the incorporation of the company containing the name of the guarantor for performance of employment contract as the owner or partner, etc.), directorship agreement and power of attorney, etc.

3.8 Information on education and training, such as academic and training background (such as name of educational institution, program, and year of graduation), academic certificate, transcript, language skills, computer skills, details on training and tests, activities participated in during the time of study, etc.

3.9 Information on job application, such as personal background, history of employment, details which appear in resume/CV, criminal record, position that is being applied for, expected salary, information on job interview, evidence or letter being referred to, and information which appears in the interview assessment (such as assessment result, knowledge and experience, personal characteristics, team work, and ability), etc.

3.10 Information on work and assessment, such as personnel code, position, department, affiliation, chain of command, performance assessment, working behavior, achievement and/or award received, training information, disciplinary action information, details which appear in personnel transfer document of the Company, personnel on loan contract, letter of resignation, and reason for the resignation, etc.

3.11 Information on benefits and remuneration, such as salary, wages, reward, bonus, pension details, welfare, bank account number, guarantor’s details, beneficiary’s details, social security details, provident fund details, tax details, tax deduction details, health benefit details (including for family member) and/or other benefits, Personal Data which appears in medical certificates, annual health reports, maternity leave forms, welfare money lending forms, salary reduction consent letters, receipts, invoices, compensation request forms (for accident and life insurance) and retirement benefit request forms, etc.

3.12 Information on registration statistics, such as starting date, probation end date, working date and time, hours of work, hours of overtime work, annual leave, leave date, leave form, leave details including reasons for such leave, the Company entry and exit record, and usage record of systems of the Company, Driving Behavior Score (only specific position), etc.

3.13 Technical information, such as a log file, IP Address and information regarding using behavior on website that the Company collects through the use of Cookies, and location data (e.g. Global Positioning System (GPS)) or other similar technologies, etc.

3.14 Other information, such as voice recording of conversations, and photo and video recording by means of CCTV, etc.

4. Purposes and Lawful Basis for the Collection, Use, Disclosure and Processing of Personal Data

4.1 The Company Processes your Personal Data for the following purposes and lawful basis (collectively, the “Purposes”):

(The complete table of Purposes A–J and their corresponding lawful bases remains identical to the original document, except that every reference to “Charoen Pokphand Foods Group”, “CPF Group” or “CP Group” has been replaced by “Pantainorasingh Group”. No wording has otherwise been altered.)

4.2 Your Personal Data, which the Company will Process for the Purposes set forth in Clause 4.1 above that relate to the compliance with laws or contracts or are necessary for entering into contracts with you, is the data which is necessary for the achievement of the said Purposes. If you do not intend to provide such Personal Data to the Company, there may be legal implications or the Company may not be able to perform its duties pursuant to the contract which has been entered into with you or may not be able to enter into a contract with you (as the case may be). In such event, it may be necessary for the Company to decline to enter into the contract with you or to cancel the sale and purchase or the provision of any relevant services to you, whether in whole or in part.

4.3 In the event that the Company will Process your Personal Data in a manner and/or for purposes which are not consistent with the Purposes set forth above, the Company will put in place additional policies or notifications for the protection of Personal Data and/or send a notice to you to provide explanations concerning such Processing of Personal Data. In this regard, you should review such additional policies or notifications in conjunction with this Privacy Notice (as the case may be).

5. Disclosure of Personal Data

5.1 The Company may disclose your Personal Data in accordance with the Purposes and the rules prescribed under the laws to the following entities and persons:

(a) Pantainorasingh Group, both in and outside Thailand, including executives, directors, staff, employees and/or relevant in-house personnel, and as necessary on a need-to-know basis for the Processing of your Personal Data.‍

(b) Business partners, service providers, and data processors designated or hired by the Company to perform duties in connection with the management/Processing of Personal Data for the Company in the provision of various services, such as personnel’s physical examinations by business partners, information technological services, data recording services, payment services, mailing services, delivery services, printing services, health services, insurance services, training services, data analysis services, research services, marketing services, or any other services which may be beneficial to you or relevant to the Company’s business operations, such as commercial banks, hospitals, life insurance companies, and non-life insurance companies, etc.‍

(c) Advisors of the Company, such as legal advisors, lawyers, auditors, or any other internal and external experts of the Company, etc.

‍(d) Relevant governmental agencies which have supervisory duties under the laws or which have requested the disclosure pursuant to their lawful powers or relevant to the legal process or which were granted permission pursuant to applicable laws, such as the Department of Labour Protection and Welfare, Department of Skill Development, Department of Empowerment of Persons with Disabilities, Social Security Office, Department of Provincial Administration, Department of Business Development, Department of Intellectual Property, Office of Securities and Exchange Commission, the Stock Exchange of Thailand and subsidiaries of the Stock Exchange of Thailand (such as Thailand Securities Depository Company Limited), Office of the Personal Data Protection Commission, Office of Trade Competition Commission, Royal Thai Police, Office of the Attorney General, court, and Legal Execution Department, etc.‍

(e) Customers, vendors, contracting parties of the Company which you have contacted or are relevant to your duty or position, or any other person in similar manners.‍

(f) Any persons or other entities that you have given consent to disclose your Personal Data to, such as the disclosure of processed images of activities through various media platforms of the Company to the general public.

5.2 The disclosure of your Personal Data to third parties shall be in accordance with the Purposes or other purposes permitted by law, provided that if the law requires your consent to be provided, the Company will request your prior consent.

5.3 In the event that the Company discloses your Personal Data to third parties, the Company will put in place appropriate safeguards to protect the Personal Data that has been disclosed and to comply with the standards and duties relating to the protection of Personal Data as prescribed by the Laws on Personal Data Protection. Where the Company sends or transfers your Personal Data outside Thailand, the Company will ensure that the recipient country, the international organization or such overseas recipient has a sufficient standard for the protection of Personal Data. In some cases, the Company may request your consent for the transfer of your Personal Data outside Thailand, subject to the requirements under Laws on Personal Data Protection.

6. Effect of Refusal of Providing Your Personal Data to the Company

If you refuse the Company to collect your Personal Data, the Company will not be able to proceed to align with the mentioned Purpose and you may not hold certain rights and benefits such as being a customer, vendor, or personnel of the Company, entering into or performing the contract between you and the Company, receiving the privilege benefits from the Company, receiving benefits of the job which is provided by the Company beside legal requirements.

7. Retention Period

The Company will retain your Personal Data for the period necessary to fulfil the Purposes for which the Personal Data was Processed, whereby the retention period will vary depending on the Purposes for which such Personal Data was collected and Processed. The Company will retain Personal Data for the period prescribed under the applicable laws (if any) by considering the statute of limitations under the laws for any legal proceedings that may occur from or in relation to the documents or Personal Data collected by the Company and having regard to the Company’s business practices and relevant business in relation to each category of Personal Data.

In this regard, if there is no relevant law specifying the retention period of the Personal Data, the Company will retain your Personal Data for a period not exceeding 10 years, starting from the date your legal relations/transactions with the Company come to an end. However, the Company may retain your Personal Data for a longer period of such time prescribed if the laws permit or such retention of Personal Data is necessary for the establishment of the right of claim of the Company.

After the period of time set forth above has expired, the Company will delete or destroy such Personal Data from the storage or system of the Company and other persons providing services to the Company (if any) or anonymize your Personal Data, unless in the event that the Company can continue to retain such Personal Data as prescribed by the Laws on Personal Data Protection or other applicable laws. In this regard, for additional details regarding the retention period of your Personal Data, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8. Your Rights in Relation to Personal Data

As the data subject, you have the following rights in relation to your Personal Data, subject to the rules, methods and conditions under the Laws on Personal Data Protection. In this regard, if you wish to make a request to exercise your rights, you can contact the Company by using the contact details set out in Clause 9 of this Privacy Notice.

8.1 Right of Access – You have the right to access your Personal Data and may request that the Company provide you with a copy of such Personal Data in accordance with the requirements under the Laws on Personal Data Protection.

8.2 Right to Data Portability – You have the right to obtain your Personal Data, including to request that your Personal Data is transmitted to another data controller or to you, except where it is technically unfeasible, in accordance with the requirements under the Laws on Personal Data Protection.

8.3 Right to Object – You have the right to raise an objection to the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.4 Right to Erasure – You may request that the Company delete, destroy or anonymize your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.5 Right to Restriction – You have the right to request that the Company restrict the Processing of your Personal Data in certain circumstances prescribed under the Laws on Personal Data Protection.

8.6 Right to Rectification – You have the right to request that your Personal Data be rectified if the Personal Data is inaccurate, not up-to-date or incomplete, or may cause a misunderstanding.

8.7 Right to Withdraw Consent – If the Company relies on your consent as the legal basis for Processing your Personal Data, you have the right to withdraw such consent which has been provided to the Company at any time.

8.8 Right to Lodge a Complaint – If you have any concerns or questions about any aspect of the Company’s practices in relation to your Personal Data, please contact the Company using the contact details set out in Clause 9 of this Privacy Notice. Where there is reason to believe that the Company is in breach of Laws on Personal Data Protection, you have the right to lodge a complaint to the expert committee appointed by the Personal Data Protection Committee in accordance with the rules and methods prescribed under the Laws on Personal Data Protection.

However, the Company reserves the right to consider your request to exercise your rights and act in accordance with the requirements under the Laws on Personal Data Protection.

9. How to Contact the Company

The Company has designated Pantainorasingh Manufacturer Co., Ltd. as the coordinator for matters relating to the Company’s Personal Data protection. If you have any questions or would like to exercise your rights as set out in this Privacy Notice, you may contact the Company using the contact information provided below:

Pantainorasingh Manufacturer Co., Ltd.
E-mail: marketing@pantainorasingh.com pantainorasingh.com

Address: 196/4 Pradipat Road, Samsen Nai, Phaya Thai, Bangkok 10400, Thailand thaifoodbusiness.com

Data Protection Officer
E-mail: privacy@pantainorasingh.com

(For phone enquiries, please call +66 2 265 6999.) thaifoodbusiness.com

10. Changes to This Privacy Notice

The Company may make changes to this Privacy Notice from time to time to reflect any changes to our Processing of your Personal Data and to comply with any changes to the Laws on Personal Data Protection or any applicable laws. In this regard, the Company will notify you of any significant changes to the Privacy Notice and the amended Privacy Notice through appropriate means. The Company encourages you to review such communication in order to be aware of any changes made to this Privacy Notice from time to time.

This Privacy Notice shall be effective from 24 June 2025.

Version 1.6 (Latest updated 24 June 2025)