Privacy Policy for Shareholders and Investors of Tidlor Public Company Limited

This Privacy Policy is issued by Tidlor Public Company Limited (referred to as the “Company” or “our Company”) to inform shareholders, securities holders, investors, including their authorized representatives or proxies, and/or any person interested in investing in the Company (“you”) about the Company's purposes regarding the collection, use, disclosure, and/or transfer of your personal data, as well as your rights under applicable laws. Accordingly, the Company has prepared this Privacy Policy, the details of which are set out below.

  • 1. Personal Data Collected

    The Company may obtain your personal data directly from you when you provide such information to the Company, or by reviewing the Company’s shareholder and/or securities registers. In some cases, the Company may obtain your personal data indirectly from other sources, such as Thailand Securities Depository Co., Ltd. (TSD), or through relevant authorities or third parties.

    The Company will collect, use, or disclose your personal data based on legal grounds, including: (1) to perform a contract for providing services or conducting transactions with you; (2) to comply with the Company's legal obligations; (3) for the legitimate interests of the Company or for the legitimate interests of other persons; (4) Consent: where the Company is required to obtain your consent for certain activities involving the collection, use, or disclosure of your personal data, the Company will separately obtain your consent for such activities. In addition, the Company may rely on any other lawful basis permitted under applicable personal data protection laws.

    The specific categories of personal data processed by the Company may vary depending on the circumstances, including your relationship with the Company, the purposes of processing, and the relevant processing activities. The Company may collect your personal data as follows:

    • 1.1 General Personal Data
      • Personal Information and Contact Details, such as full name, address, telephone number, email address, contact details, photographs, employment history or work experience, bank account information, financial status, educational and employment information, and information contained in official documents (e.g., national identification card number, passport number, and taxpayer identification number).
        In the case of shareholders holding shares in the name of a legal entity, the Company may collect and use information relating to such legal entity, including the personal data of its directors or authorized representatives.
      • Transaction Details or Shareholding/Securities Holding Information, such as the number of shares or securities of the Company held by you, shareholder or securities holder registration number, information necessary for issuing documents or evidence of ownership, and information relating to dividend payments.
      • Information Relating to Meetings or Activities in which you, including your authorized representatives or proxies, express an interest, register for, or participate, such as information regarding your interest in activities organized by the Company, meeting registration information, meeting attendance information, questions and comments, as well as photographs and audio or video recordings made during your participation in meetings or other activities organized by the Company.

      Where you provide and/or disclose personal data of another person to the Company for the purpose of contacting or carrying out any activities, including requesting the Company to disclose such person’s personal data to external organizations and/or other third parties at your request, you represent and confirm that you have informed such data subject of the Company’s processing of their personal data in accordance with this Privacy Policy. You also confirm that you have obtained such person’s consent, where required, or that you are otherwise entitled to rely on another lawful basis for providing and/or disclosing such personal data to the Company in accordance with applicable laws.

    • 1.2 Sensitive Data
      • Sensitive Data, such as information relating to religion (where such information appears on a national identification card submitted to the Company).
        Where you provide documents or copies of documents containing sensitive personal data, such as a copy of a national identification card containing information relating to religion, for example, for meeting registration or proxy appointment, and such information is not necessary for the relevant purpose, the Company does not intend to collect or use such sensitive personal data. You are therefore requested to delete or redact information relating to religion, which constitutes sensitive personal data, before submitting such documents to the Company.
        Where the Company is required to collect, use, or disclose sensitive personal data, the Company will do so based on your explicit consent, unless the Company is entitled to rely on an applicable legal exception that permits such processing without obtaining your consent.
  • 2. Purposes of Collection, Use, or Disclosure of Your Personal Data
    The Company may collect, use, and disclose your personal data for various purposes, depending on your interactions and relationship with the Company, including the following:
    • To communicate with you and manage the Company’s relationship with you, including contacting you, providing news and information, conducting public relations activities, and inviting you to participate in activities organized by the Company or external organizations, such as relevant regulatory authorities, through various communication channels, including SMS, email, or social media; facilitating the organization of the Company’s activities; delivering souvenirs and providing benefits to you; as well as resolving issues and handling complaints.
    • For the Company’s administration and management, including compliance with legal obligations, such as carrying out capital increases or reductions, corporate restructuring, changes to registered particulars, submission of the Company’s business operation reports, preparation of records for dividend payments, payment of dividends to shareholders or securities holders, preparation and maintenance of shareholder or securities holder registers, preparation of ownership documents or evidence, issuance of share certificates or securities certificates, transfer or replacement of share certificates or securities certificates, purchase, sale and/or exchange of shares or securities, verification and identity authentication, and activities relating to shareholders’ or securities holders’ meetings, including voting and vote counting at such meetings, recording meeting proceedings, and preparing documents or evidence relating to meeting attendance.
    • To carry out any activities as necessary for the legitimate interests of the Company and other people, provided that such activities do not go beyond what you may reasonably expect, including fraud prevention, handling fraud-related complaints, and preventing and reporting criminal offences, among others.
    • To comply with applicable laws, including compliance with legal requirements, conducting or defending legal proceedings, or complying with orders of government officials, which may include orders or requirements issued by regulatory authorities or other competent authorities.
  • 3. Persons to Whom the Company will Disclose Your Personal Data
    The Company disclose your personal data to the following third parties according to the purposes stated above:
    • Service providers: The Company may disclose your personal data to companies within the Tidlor Holdings Group, as well as to other external service providers that provide services on behalf of the Company, in order to deliver services to you efficiently and to support the Company’s business operations. The Company may disclose your personal data to such service providers, or such service providers may collect your personal data on behalf of the Company, for various business purposes. These service providers may include, or such service provider companies may collect your personal data on behalf of the Company, for various business purposes, such as data storage service providers, cloud service providers, information technology service providers and infrastructure, software and website developers, risk management service providers, information service providers, data analytics service provider, data collection service provider, automated chat program service providers, answering questions through platforms, websites, various applications, call center service providers, SMS service providers, platform network service providers used for support, social media service provider, marketing service provider, general management service providers, debt collection and tracking service providers, audit consultants, legal consultants, printing and transportation service providers, journalists and public relations.
    • Third parties you authorize or request us to disclose your personal data to: The Company may disclose your personal data with consent or according to your request, such as disclosure to companies within the Tidlor Holdings Group.
    • Government Authorities and Other Relevant Authorities: The Company may disclose your personal data to government authorities, regulatory authorities, and other competent authorities, such as the Securities and Exchange Commission, Thailand.
  • 4. Transfer of Your Personal Data Abroad (if any)
    The Company may be required to transfer your personal data to third parties or contractual counterparties located outside Thailand in order to achieve the Company’s business purposes, for your benefit, or for any other purposes specified in this Privacy Policy.
    Where the destination country does not provide a level of personal data protection equivalent to that of Thailand, the Company will take necessary and appropriate measures to ensure that your personal data is securely processed and protected in accordance with applicable data protection laws. Such measures will also be implemented to ensure that any transfer of personal data complies with the requirements of applicable personal data protection laws. In certain cases, these measures may include entering applicable standard contractual clauses or implementing other equivalent safeguards with third parties or contractual counterparties located outside Thailand.
  • 5. Retention Period for Your Personal Data
    The Company will retain your personal data only as necessary, to use according to collection purposes, and to comply with legal obligations and Company regulations as detailed in this policy and applicable laws. The Company will retain your personal data for no more than 10 years, counting from the date you end your relationship or have your last contact with the Company. However, the Company may retain your personal data longer as necessary and/or as permitted by law
  • 6. Your Rights
    Under the provisions of personal data protection laws and exceptions according to related laws, you may have the following rights:
    • Right of Access: You have the right to access and obtain a copy of your personal data, or to request disclosure of the source from which your personal data was obtained where such data was collected without your consent.
    • Right to request correction of your personal data: If you consider that your personal data is inaccurate, outdated, or incomplete, you have the right to request that such personal data be corrected or updated.
    • Right to deletion or destruction: You have the right to request the deletion or destruction of your personal data, or to have such data anonymized so that it can no longer identify you, but this must not affect others' rights, security, existing contracts with the Company, including being contrary to law
    • Right to suspend use: You have the right to request the restriction of the use of your personal data in cases where you see that your data is incorrect or inappropriate, or request suspension of deletion/destruction of your personal data
    • Right to object: You have the right to object to collection, use, disclosure of your personal data, such as objecting to direct marketing and any profiling related to such direct marketing.
    • Right to withdraw consent: If you have consented to collection, use, disclosure of your personal data, you have the right to cancel consent at any time
    • Right to request personal data: Where provided by applicable law, you have the right to obtain your personal data that has been collected, used, or disclosed by the Company, or to receive a copy of such personal data in a format that is readable or commonly used by automated tools or devices, and to have such data transmitted to another organization, provided that: (a) personal data that you have provided to the Company, and (b) cases where the Company has received your consent or to comply with contracts with you
    • Right to complain: You have the right to lodge a complaint with the competent authority regarding the collection, use, or disclosure of your personal data by or on behalf of the Company. However, the Company would appreciate the opportunity to address your concerns before you contact the relevant authority. Therefore, please contact the Company first so that we may discuss and seek to resolve your concerns.

    However, exercising your rights as specified may have legal limitations, and in some cases the Company can reject your request with reasonable reasons. You can exercise the above rights as stated in the "Contact" section

  • 7. Changes to Privacy Policy
    The Company may amend or update this Privacy Policy from time to time as appropriate. In the event of any amendment or update, the Company will publish the latest version of this Privacy Policy on the Company’s website. Such amendment or update will become effective upon its publication on the Company’s website.
  • 8. Links to Other Third-Party Websites
    This Privacy Policy applies only to the Company’s services and your use of the Company’s websites, platforms, applications, or other channels. Where the Company’s channels contain links to external websites, although the Company endeavors to provide links only to websites that maintain appropriate standards for personal data protection, the Company is not responsible for the content of such third-party websites, the collection of personal data by such websites, or the handling and protection of your personal data through such third-party websites, unless otherwise expressly stated by the Company.
    Accordingly, the Company cannot be responsible for the security or privacy of any information collected from you by such third-party websites. The Company therefore recommends that you separately review the privacy policies or personal data protection policies of such third parties as made available on their respective websites.
  • 9. Contact
    The Company values protecting customer personal data and is committed to complying with all provisions of the Personal Data Protection Act B.E. 2562. You can contact the Data Protection Officer to regarding the handling of your personal data at: DPO@tidlor.com
    In addition, if you have any questions regarding your personal data or wish to exercise your rights in relation to personal data collected, used, or disclosed by Tidlor Public Company Limited, you may contact the Company at its Head Office: 428 Ari Hills Building, 9-15th Floor, Phahonyothin Road, Samsen Nai, Phaya Thai, Bangkok 10400, Thailand