PRIVACY NOTICE FOR PARTNERS AND RELEVANT EXTERNAL PARTIES

CP Axtra Public Company Limited (the “Company”) recognizes the importance of personal information and respects the privacy rights of our business partners, trade partners, suppliers, tenants, and/or lessors, goods and/or service providers, and other external parties (collectively referred to as “you,” “Partners,” or “External Parties”). The personal information which has been disclosed by you or collected by us during contract execution, form completion, document submission, or online usage, including inquiries, comments, feedback, or complaints submitted to the Company will be referred to as “personal information” which might be in the forms of documents, files, website www.cpaxtra.com, all Applications and online services of the Company (together as the “Website”), will be used by us only for the purposes as stipulated under this Privacy Notice, hereinafter referred to as “Privacy Notice”.

Personal information refers to any information that can directly or indirectly identify you, such as your name-surname, address, email, phone number, and identification number. This also includes login information, such as your username and password, other information that you may provide when contacting us about our services (for example, social media account details including Line ID), transaction information, and other related data. However, it does not include information of any juristic person.

Under this Privacy Notice, the Company collects and processes personal data from the following groups:

1. Potential Partners which mean individuals who may become business partners with the Company, including business affiliates, sellers, suppliers of goods and/or services, farmers, small and medium-sized enterprises (SMEs), contracting parties, service providers, vendors, and lessors or tenants at the Company's locations or branches, whether or not these individuals have expressed intent to enter into a contract and/or registered as the Company's Partners.

2. Partners which mean business affiliates, sellers, suppliers of goods and/or services, farmers, small and medium-sized enterprises (SMEs), contracting parties, service providers, vendors, and lessors or tenants at the Company's locations or branches, as well as any other individuals who have already submitted bids to sell goods and/or services to the Company. This also includes those who have successfully registered as the Company's partners or have any other similar relationships with the Company, such as consultants, experts, academics, speakers, participants in business projects, contracting parties, or other similar individuals.

Individuals associated with potential or current Partners which means individuals who are related to or represent such potential or current Partners, such as directors, employees, agents, or personnel of Partners that are legal entities. This also includes those whose personal information appears in various documents related to the relevant processes, such as managers, buyers, recipients of goods, and check signers.

· Your personal data e.g., name-surname, occupation, ID number, passport number, birthdate, tax identification number (if any)

· Contact details e.g., address, email, phone number, Line ID and contact person

· User account details including your registration details for accessing our partner system or other similar systems of the Company, such as username, password, and partner ID, etc.

· Information related to transactions, services, and leasing, such as partner ID, tenant ID, details of the goods or services requested, shipping details, bank account numbers, and amounts, etc.

· Information used as evidence for registration as our business Partner or for various transactions, such as personal information appearing on a copy of an ID card, tax identification number, copies of passports, name change certificates, house registration, driver's licenses, vehicle registration numbers, types of vehicles, copies of land deeds, power of attorney documents, company affidavits, copies of tax ID cards, invoices, receipts, cash bills or substitute receipts, checks and check stubs, payment vouchers, copies of bank account statements, remittance acknowledgment receipts, direct credit registration approval records, and copies of professional or business licenses, etc.

· Technical information for example, computer traffic data (logs), computer identification numbers (IP addresses), and data collected by us through cookies or similar technologies, etc.

· Other information that the system may request or that you may provide voluntarily for registration in our partner system or other similar systems, including audio recordings of conversations, video recordings of online meetings via various conferencing applications such as Microsoft Teams and Zoom, still images, and video footage captured by recording devices, etc.

This Privacy Notice covers the following topics.

· Collected personal information

· Purposes of collection, use or disclosure

· Disclosure of personal information

· Sending or transfer of personal information to overseas

· Retention period of personal information

· Your rights

· Updating your personal information

· Security measures for your personal information

· Cookies and technical information

· Redirecting to other parties’ websites

· Changes to the Privacy Notice

· Notification of personal information breach and leakage

· Contact us

Method of Collection	Collected Personal Information
When you register your personal information for registration or enter into the contract with the Company, including procedures for taking steps as per request prior to entering into contract, contract signing, form filling, questionnaires, registrations or submission of claims or requests for exercising your rights	Identifiable information such as name, surname, birth date, identification number. Contact information such as address for sending documents, email and phone number.
When you login into our website or other online channels	Transaction information such as trading and services transactions, bank account, product details and other services sold or provided by you to us including your website access data or other services of the Company Technical information such as username, password, interests, setting preferences, IP address, information of accessing the system.
When you contact us or our representatives via offline channels	Identifiable information such as name-surname, date of birth and ID number
Other cases according to security protection system of the Company such as CCTV	Captured image or footage

We will collect your personal information only if you have consented to us. For those who have been our existing suppliers, business partners and service providers before the Personal Data Protection Act B.E. 2562 (the “PDPA”) enters into force, we will continue collecting and using your personal information which has been collected by the Company for the original purposes which you allowed us to collect your information.

If necessary, the Company may collect your sensitive personal information such as health information, religion, blood type, etc. only with your explicit consent or when permitted by laws.

Any collection of your personal information by our relevant employees or other relevant persons or any actions performed on behalf of the Company which is necessary for providing services and management of our website, including the use of personal information for any undertaking may rely on (1) Consent Basis (2) Contract Basis (i.e. performance of a contract or taking steps at your request before entering into a contract) (3) Legal Obligation Basis(4) Legitimate Interest Basis (5) Legal Claims Basis (6) Vital Interest Basis and (7) Compliance with Relevant Laws Basis by which the purposes of collection, use or disclosure of personal information will be as follows:

Purpose of Data Use	Reasons and Legal Basis for Processing
To compile a list or register potential business Partners or similar individuals for the company's procurement activities, as well as to carry out related requests	Contract Basis: In cases where potential business Partners wish to enter into a sales or service contract with the company, or if it involves fulfilling requests from such potential Partners or similar individuals, we need to process personal information to collect or register such individuals.
To carry out planning, reporting, business forecasting, including business data analysis, and the company's business development	Legitimate Interest Basis: The processing of personal information is necessary for legitimate business interests of the Company, such as generating purchase orders and maintaining history records.
To facilitate procurement and the selection of Partners or similar individuals.	Contract Basis: The processing of personal information is necessary to respond to price quotation requests from bidding Partners or similar individuals before entering into sales contracts, service contracts, lease agreements, or any other business agreements related to our procurement activities. Legitimate Interest Basis: The processing of personal information is necessary for legitimate business interests and to implement the Company's procurement policies, such as assessing and evaluating the qualifications and performance of you or your employees before entering into a contract with the company (i.e. pre-audit) as a contracting party, or in your capacity as a director, representative, authorized agent, or personnel acting on behalf of a legal entity. This is also for the purpose of considering the approval of commercial agreements and/or service contracts.
To create and manage contracts between the Company and you or any contracting party	Contract Basis: The processing of personal information of contracting parties is necessary to fulfill the requests of those parties who have expressed their intention to enter into a contract with the Company. Legitimate Interest Basis: The processing of personal information of contracting parties (or of related individuals or representatives of the contracting parties, in cases where the contracting party is a legal entity) is necessary for legitimate business interests in creating and managing the Company's contracts, such as verifying the identity and qualifications of the contracting parties.
To fulfill contractual obligations (including performing duties under related contracts, such as creating user accounts and passwords for Partners, business affiliates, or service providers to access the company’s website or systems, as well as providing necessary training or meetings, etc.)	Contract Basis: The processing of personal information is necessary to fulfill the contractual obligations that the Company has with you or similar individuals, including the verification and/or evaluation of your performance under the contract with us. This also ensures security during the execution of the contract, assesses operational efficiency, and complies with our internal processes (e.g., communication and coordination regarding product delivery, returns, equipment, building access cards, managing accidents during transportation, etc.). Additionally, it is essential for conducting financial transactions, such as payment for goods and refunds, which are provided both offline and online, such as through the website, applications, and other channels.
To manage and improve the company's standard operational procedures	Legitimate Interest Basis: In improving and developing the Company's information technology systems, communication methods with partners, and business operations, we need to use personal information for research and development of information technology systems (including data security systems) and operational methods.
To gather feedback from Partners or similar individuals	Legitimate Interest Basis: We may occasionally request your cooperation in responding to surveys or performance evaluations conducted by the company or its affiliates and any other assigned companies. If you agree to participate in such surveys, it is considered that you consent to the collection, use, and disclosure of any additional personal information you provide. The use of this data will be in accordance with the purposes stated in this announcement or any other purposes that we will specify in the survey.
To organize activities or campaigns for advertising, public relations, sales promotions, and CSR initiatives	Contract Basis: The processing of personal information is necessary to fulfill contractual obligations that we have with you or similar individuals, such as using your photographs for advertising and promoting the Company’s activities, among other purposes. Legitimate Interest Basis: When you participate in promotional activities, advertising events, CSR, or various campaigns organized by us, including live broadcasts and video recordings at our stores or other locations, we may use photographs, video clips, or images of you to promote those activities across the Company's online media, print media, or social media channels. We will inform you beforehand in a manner that is appropriate and suitable for the circumstances.
To contact and interact with you	Legitimate Interest Basis: The company needs to use personal data to communicate with you regarding company news, to clarify information, or to provide assistance as appropriate.
To exercise legal claims	Legal Obligation and Legitimate Interest Basis: The processing of personal information is necessary to establish legal claims, comply with or exercise those claims, and to litigate or resolve disputes between us and you. For example, this applies in cases of disputes or breaches of contract.
To comply with applicable laws and lawful orders from authorized officials	Legal Obligation and Legitimate Interest Basis: To comply with legal requirements, such as tax laws and data protection laws, including lawful orders from authorized officials, such as the Personal Data Protection Committee, for investigations and inquiries in accordance with legal processes and other regulations. This also includes reporting or disclosing information to government agencies as required by law, or when receiving subpoenas or warrants from law enforcement, government agencies, courts, or other law enforcement bodies.
To ensure the maintenance of public order and to safeguard the security of individuals and the Company’s property	Legitimate Interest Basis: The processing of personal information is necessary for legitimate interests in maintaining public order and ensuring the security of our property, as well as preventing fraud. This includes monitoring and investigating misconduct, such as using footage from surveillance cameras (CCTV) to prevent loss or damage to our property, or to recover assets or seek compensation in cases of loss or damage to the Company's property. Vital Interest Basis: The processing of personal data is necessary for the purpose of monitoring, managing, preventing, or mitigating any events that may pose a threat to the life, body, or health of individuals.
To transfer rights, duties, and any benefits under the contract between you and us e.g., in the case of mergers or the lawful assignment of contracts	Legitimate Interest Basis: The processing of personal information is necessary in the event of a merger or any contract assignment to ensure that the rights, duties, and obligations of the contracting parties continue uninterrupted.
To undertake any necessary actions that are beneficial to you or directly related to the aforementioned purposes	Legitimate Interest Basis: The processing of personal information is necessary for legitimate interests in carrying out any required actions by the Company and/or for your benefit, or directly related to the purposes outlined above.

In the case where the personal information collected by us as stated above is necessary for the Company’s compliance with applicable laws or performance of contract and you do not provide us with such necessary personal information, we may be subject to legal liabilities and/or may not be able to provide you with our products and services and/or may not be able to manage or administer the contract or give any convenience for you.

In the case where we need to collect, use, disclose or perform any processes with your personal information, apart from the purposes mentioned in this Privacy Notice, we will inform such change in our website or publish the Notice at the Company’s stores which may require an additional consent from you.

The company does not have a policy for storing or processing your sensitive personal information, such as race, ethnicity, religion, and health information. If you submit any documents to the company that contain such information, such as a copy of your ID card that includes religion and blood type, please redact that information before submission.

The Company may disclose your personal information to other relevant parties for the purposes that have been stipulated under this Privacy Notice to:

1. Subsidiaries, affiliates and any related companies for purposes of undertaking activities as set out in this Privacy Notice;

2. Agencies, contractors/sub-contractors and/or service providers for their implementation and procedures, for example, carriers, quality control service providers, warehouse service providers, document storage and destruction service providers, printing house, marketing agency, event organizers, market research companies, IT development and maintenance service providers, training service providers, auditors, lawyers, tax and legal advisors, and any consultants;

3. Government authorities, supervisory authorities or other authorities as stipulated by laws, including competent officials;

4. Insurance companies;

5. Our business partners or other third parties as per your consent or relevant contractual requirements or legal requirements, as the case may be; and

6. The assignee of the rights, duties, and any benefits from the Company, including any persons who are assigned by the aforesaid assignee to act on its behalf, for example, in the case of organisational restructuring, merger or acquisition, etc.

When disclosing your personal information to third parties or our affiliated companies within the country, we will ensure that we or other organisations receiving your personal information will have an adequate data protection standard in order to prevent any damage that may arises. If any disclosure is subject to consent, the Company will seek your consent before proceeding with such disclosure of information.

We may transfer your personal information to a country outside Thailand for the purposes that have been stipulated under this Privacy Notice such as sending personal information to a company who processing personal information on our behalf. When disclosing or transferring your personal information to third parties or affiliated companies located overseas, the Company will comply with the relevant laws regarding cross-border sending or transfer of personal information and ensure that the receiving country has an adequate data protection and security standard at the same level or standard as provided under the PDPA.

We will retain your personal information for as long as is considered necessary for the purpose for which it was collected, used or disclosed as set out in this Privacy Notice i.e., as long as you are our Partners, or for a period as necessary to comply with applicable laws, or to be in accordance with legal prescription, or to establish, comply with or exercise the rights to legal claims or defend against the rights to legal claims, or until you request us to delete your personal information, or to comply with, for any other cause, our internal policies and regulations.

You are entitled to the following rights under the PDPA:

Data Subject’s Rights	Description
Right of access	You have a right to get access and obtain a copy of your personal information that we hold about you, or you may ask us to disclose the sources of where we obtained your information that you haven’t given consent. The Company will send such copy to you within 30 days upon obtaining your request. In certain cases, the Company may request additional information in order to confirm your identity and your rights as part of our security measures.
Right to data portability	You have a right to request us to automatically transfer your personal information to other persons, and request to see the personal information that we have transferred to other persons, unless it is impossible due to technical circumstances.
Right to object the processing of your information	You have a right to object to collection, use or disclosure of your personal information at any time, for example, if it is under the following circumstances: 1) It is for the purpose of direct marketing; and/or 2) It is for the purpose of scientific, historical or statistical research unless it is necessary to performance of a task carried out for reasons of public interest by the data controller.
Right to erasure or anonymisation so that it can no longer identify the data subject	You have a right to request us to delete, destroy or anonymise your personal information in the following circumstances where: 1) The personal information is no longer necessary for the purpose of which it was collected, used or disclosed; 2) You have withdrawn your consent to which the collection, use or disclosure is based on and we have no ground to reject such request; 3) You have objected to the collection, use or disclosure of the personal information and we have no ground to reject such request; and/or 4) When the personal information has been unlawfully collected, used or disclosed under the PDPA.
Right to restrict the processing of your information	You have a right to request us to restrict the processing of your personal information in the following circumstances when: 1) your personal information is being in the process of verifying the accuracy, relevance, or completeness; 2) the information needs to be deleted or destroyed because it was collected, used, or disclosed unlawfully, but you request to suspend it instead; 3) the personal information is no longer necessary for the purposes for which it was collected, but you still need to retain it for the establishment, compliance with, or exercise of legal claims; 4) the Company is in the process of verifying its right to refuse your objection to the collection, use, or disclosure of your personal information.
Right to withdraw consent	You may withdraw your consent at any time, unless it is restricted by law, or by the contract which gives benefits to you. However, the withdrawal of consent shall not affect the processing of personal information you have already given consent legally.
Right to rectification	The company must ensure that personal information is accurate, up-to-date, complete, and not misleading. If we deny your request, we will record the denial along with the reasons in our records.
Right to lodge a complaint with the Personal Data Protection Commission	You have the right to make a complaint in the event where the Company, the data processor including the employees and contractors of the Company do not comply with the PDPA or other notifications issued under the PDPA.

To contact Lotus’s

You can exercise your rights related to personal data as detailed above by filling out the Data Subject Request Form and sending your request along with the attached documents to datasubject.request@lotuss.com. In case you are a small or medium-sized enterprise (SME), you can contact us at sme@lotuss.com.

To contact Makro

If you have any questions or would like to exercise any rights relating to your personal information, please submit your request via www.siammakro.co.thon exercising your rights under the PDPA topic or contact the public relation staff at the branch or call center tel. 02-779-9955 every Monday to Friday at 08.00-18.00 hours.

In the event that the personal information you have provided has changed, you must notify the Company of such update or edit the provided personal information so that your personal information is always accurate and up-to-date. If any of your personal information is incorrect, it may affect our service provision where we will not be responsible for any loss or damage that may occur to you or the third party as a result of your failure to correct or update your personal information to be accurate in any way.

The Company certifies that all the personal information collected will be stored safely and strictly with adequate security standards. If you have a reason to believe that your personal information has been breached or if you have any questions regarding this Privacy Notice, please contact the DPO of the Company.

Cookies will be sent to your web browser or to your device when you visit the website or check for messages. This program will collect information about website usage behavior and when you ordered other products. In addition, it includes technical information that is username, password, interests, setting preferences, IP address, login information, browser type, browser version, time and date setting, connection setting, operation and platform system and other technology on your devices where you sign in into our system.

Adherence to such information, the program assists the Company to contact and remember your browser or device, which will facilitate the use of the website. If you have no demand to use the cookies program, you can reject installation of such program. However, refusing to use this cookie program may affect the use of our website or online services due to insufficient information, or the Company may require time to request for additional information. (if any)

You can learn more about our cookies in our Cookies Policy at https://www.cpaxtra.com/cookies-policy.php

The Company’s website may be redirected to other websites for the purpose of facilitating you when you visit other websites. These websites may collect your personal information where the Company is not involved nor responsible for the collection of your personal information or the disclosure of your personal information to other websites of other parties, as well as the privacy noticeof these websites in any way. For this reason, we recommend that you carefully review the privacy notice of these websites before you use the service on those websites.

The Company reserves the right to change, amend or update the Privacy Notice at any time as it deems appropriate and will notify you of such changes. We will post any changes, modifications, or updates on our website, which you can review at any time, or will provide written notice to you.

In the event of a breach or leakage of personal information, we require that the reporting party notify through the channels specified by the Company or contact the DPO immediately. The channels for reporting breaches are as follows:

Tel: 02-067-9700 every Monday to Friday during 08.00-18.00 hours

Email: DPO@cpaxtra.co.th or DPOThailand@lotuss.com

If you have any comments, suggestions, questions or want to make a complaint regarding your personal information, please contact us at:

CP Axtra Public Company Limited

Address: 1468 Phatthanakan Road, Phatthanakan, Suan Luang, Bangkok 10250

Tel: 02-779-9955 every Monday to Friday at 08.00-18.00 hours

Data Protection Officer

Address: 1468 Phatthanakan Road, Phatthanakan, Suan Luang, Bangkok 10250

E-mail: DPO@cpaxtra.co.th or DPOThailand@lotuss.com

This Privacy Notice was latest updated on 1 october 2024

PRIVACY NOTICE FOR PARTNERS AND RELEVANT EXTERNAL PARTIES

GROUP OR CATEGORY OF THE PERSONAL THAT THE COMPANY WILL COLLECT THE PERSONAL INFORMATION

PERSONAL INFORMATION THAT THE COMPANY WILL COLLECT DURING BUSINESS TRANSACTIONS OR CONTRACT EXECUTION

SCOPE OF THIS PRIVACY NOTICE

COLLECTED PERSONAL INFORMATION

PURPOSE OF COLLECTION, USE AND DISCLOSURE

DISCLOSURE OF PERSONAL INFORMATION

SENDING OR TRANSFER OF PERSONAL INFORMATION TO OVERSEAS

RETENTION PERIOD OF PERSONAL INFORMATION

YOUR RIGHTS

UPDATING YOUR PERSONAL INFORMATION

SECURITY MEASURES OF YOUR PERSONAL INFORMATION

COOKIES AND TEACHNICAL INFORMATION

REDIRECTING TO OTHER PARTY’S WEBSITES

CHANGES TO THE PRIVACY NOTICE

NOTIFICATION OF PERSONAL INFORMATION BREACH AND LEAKAGE

CONTACT US