1.1

U-Tapao International Aviation Co., Ltd. and affiliates (the "Company") respect the privacy of customers, service users, the Company's stakeholders, and any person who has provided the Company with personal data. The Company recognises the importance of protecting personal data and its integrity and/or cross-border transfer of your personal data. To ensure that the personal data it receives is used for the intended purposes and in accordance with the law, the Company has prepared this Personal Data Protection Policy (the “Personal Data Protection Policy") to inform the data subject of the purposes and details of personal data collection, use, and disclosure, and/or cross-border transfer of your personal data, as well as your legal rights.

1.2

In addition to this Personal Data Protection Policy, the Company may prepare a Privacy Notice for the Company's services or activities to inform the data subject who is our service user and participant, of the personal data being processed, the objectives and legitimate purposes of the processing, the retention period, and the data subject's specific rights. If the terms of the Privacy Notice conflict materially with those provided under this Personal Data Protection Policy, the terms of the specific Privacy Notice for the services or activities will govern.

1.3

This Personal Data Protection Policy applies to the Company's business operations on websites, via telephone or email, by mail or social network, as well as any other channels or locations where your personal data is collected.

1.4

The Company may amend this Personal Data Protection Policy from time to time. The most updated version of the Personal Data Protection Policy will be published for your information. The Company encourages you to carefully review this Personal Data Protection Policy and to regularly review the updated Personal Data Protection Policy.

2.1

The purpose of this Personal Data Protection Policy is to clarify the Company's personal data collection, use, and disclosure practices, as well as how to implement, promote, and enforce these practices.

2.2

Personal data collection, use, or disclosure always requires the data subject's consent, unless the Company may collect, use, or disclose the data without consent in accordance with the law.

2.3

The Company may comply with the laws or act within the exceptions under the laws that expressly permit it to act on or take any steps regarding the personal data. However, this Personal Data Protection Policy applies to the extent that it is not provided or exempted by law.

2.4

The Company may update or modify this Personal Data Protection Policy without notifying you in advance. However, the Company will notify you when the update is significant.

2.5

This Personal Data Protection Policy applies to the Company's customers and service users, as well as the data subject whose personal data is collected, and anyone whose personal data is received by the Company as a result of a transaction by the data subject.

2.6

The Company may be unable to provide the whole or part of the required services to the data subject if the Company needs to collect the necessary personal data to enter into or perform a contract, to provide services, to survey and carry out an activity, or to carry out its statutory duties, and the data subject refuses to provide the personal data or objects to the processing of the personal data in accordance with the objectives of the contract or the activity.

3.1

Personal data that the data subject has provided directly to the Company via channels such as during a transaction, while applying for a service or product, or participating in an activity such as a job application, registration of activity participation, entering into and executing a contract or document, completing a questionnaire, or when the data subject communicates with the Company at the Company's office or using other channels under the Company's control.

3.2

Personal data that the Company collects from the data subject’s use of website, products, services, or participation in other activities under the contract or in a mission such as a monitoring of website, product, or service use or participation in the Company’s activities using cookies or a software on the data subject’s personal devices.

3.3

Personal data that the Company receives or gains access to from other sources, such as those maintained by government agencies, business partners and their service providers, data service providers, individuals or legal entities conducting transactions with the Company, public sources (such as the Government Gazette), anyone with the lawful authorisation or rights, and any other persons or agencies with whom the Company has a legal relationship.

4.1

Data subject’s identification data such as photograph, title, middle name, family name, alias, gender, date of birth, age, marital status, family status, number of family members and children, relationship data such as with an emergency contact person, nationality, country of residence, car registration number, signature, information in a government document (such as a copy of national identity card, passport, visa, alien’s certificate, work permit, government official/ state enterprise identity card, copy of house registration, birth certificate, certificate of name change, certificate of marriage and divorce, death certificate, certificate of driving licence or other similar identification documents).

4.2

Contact information such as address details in important documents, current residence, and country of residence based on nationality, workplace, telephone number, mobile phone number, facsimile number, email address, name or account name used in electronic channel of communication or social networks (such as LINE ID) or evidence of residence in Thailand (for foreigners).

4.3

Information in documents used in carrying out transactions such as a company’s certificate of incorporation, a list of shareholders, a Power of Attorney, a commercial registration document, or a bank account number.

4.4

Sensitive personal data means personal data that may be collected by the Company for its operation or services based on specific legal requirements, such as religion data on a copy of a national identification card or nationality data on a copy of a passport in some countries, biometric data such as facial images, fingerprints, e-signature (the key behavioural feature of which is analysed using an identity verification and authentication technology), criminal records, and medical records. The Company does not intend to collect sensitive personal data. However, when the Company needs to collect the sensitive personal data the Company may only occasionally collect, use, or disclose this sensitive personal data based on the data subject's explicit consent or when required to do so by law.

4.5

The Company may collect personal data of a minor, a quasi-incompetent person, and an incompetent person when their parents, curators, or guardians have given their consent. The Company does not intend to collect personal data from an individual under the age of 20 without their parental consent as is required by the law, or from quasi-incompetent persons and incompetent persons without their legal curator’s or guardian's consent (as the case may be). If the Company learns that it has collected personal data from anyone under the age of 20 without parental consent when it is required, or from quasi-incompetent persons and incompetent persons without their curator’s or guardians’ consent, the Company will delete it immediately or collect, use, disclose and/or transfer only if the Company can rely on other legal bases apart from consent.

4.6

A person providing the Company with a third party’s personal data must notify the third-party data subject of the requirements under this Personal Data Protection Policy and, if required, seek the third-party data subject’s consent, or must establish other legal bases to ensure that the Company may collect, use, or disclose the third-party personal data. Third-party data subject under this clause is, for example, a third party that is a juristic person’s personnel or who is related to the person giving the Company the data such as shareholders, directors, authorised persons, family members, reference, partners, guarantor, mortgagor, person giving the security, beneficiary, administrator, emergency contact person, or other persons under the relevant transaction documents.

5.1

5.2

6.1

The Company may disclose the data subject’s personal data to a third party with the data subject’s consent or the legal requirements that allow the disclosure. The individual or organisation that receives the personal data will collect, use, or disclose it in accordance with the scope of the consent or the scope applicable under this Personal Data Protection Policy. In some cases, the data subject may also be subject to the recipient’s personal data protection policy. The personal data recipient may be located in Thailand or abroad.

6.2

In some instances, the Company may need to disclose the personal data to comply with the order of a person with lawful authority or right or to comply with the laws.The recipients of personal data may include a law enforcement agency, the Company's supervisory regulator, a government agency, an association, an agency, or other parties whose disclosure is required to fulfil legal or contractual obligations or to protect the Company's or a third party's rights. This may also involve taking appropriate legal action.

6.3

For the purposes of the Company's business operations, the Company may disclose the data subject's personal data to its auditor, external auditor, legal counsel, tax counsel, or other advisers or specialists.

6.4

In some instances, U-Tapao International Aviation Co., Ltd. may be required to work with its affiliates in providing services to customers and may use some systems jointly with its affiliates. These systems are, for example, service provision systems or website-related systems. Therefore, personal data transfer within the affiliates may be necessary or the affiliates may be permitted to access personal data for the objectives described under this Personal Data Protection Policy.These affiliates may also rely on the consent obtained by U-Tapao International Aviation Co., Ltd..

11.1

Right to withdraw consent: If the data subject has consented to the Company's collection, use, or disclosure of personal data (whether before or after the effective date of the personal data protection law), the data subject may withdraw consent at any time while the personal data is maintained by the Company, unless the data subject's right is restricted by law or a contract that benefits the data subject. The withdrawal of the data subject’s consent does not affect the collection, use, or disclosure of personal data before the withdrawal. However, the Company may be unable to perform its contractual obligations or provide services to the data subject if the data subject withdraws consent. The consent withdrawal may result in the transaction or other activity being suspended or terminated. Due to the consent withdrawal, the data subject may not receive useful information or advice. Before withdrawing consent, the data subject should consider and inquire about the consequences of the withdrawal.

11.2

Right of access: The data subject may request access to the personal data under the Company’s control. The data subject may also request a copy to be made of the personal data by the Company, and to require the Company to disclose how it has obtained the data subject’s personal data.

11.3

Right to data portability: The data subject may receive the personal data if the Company has prepared the data in a structured, commonly used, and machine-readable format that permits automated use or disclosure of the data. The data subject may also require the Company to transmit or transfer the personal data in such format to another controller when it is automatically possible. The data subject may request the personal data transmitted directly from one controller to another unless it is not technically feasible.

11.4

Right to object: The data subject may object to the collection, use, or disclosure of personal data at anytime if the personal data is collected, used, or disclosed for the necessary operations in the legitimate interests of the Company or other individual or juristic person or in the public interests.Where the data subject objects to the processing of personal data, the Company may continue to collect, use, or disclose the personal data if the Company can demonstrate compelling legitimate grounds for the processing, which override the the data subject’s rights or for the establishment, exercise or defence of legal claims, as the case may be.

11.5

Right to erasure or destruction of personal data: The data subject may request the erasure, destruction, or anonymisation of personal data if the data subject believes that the personal data has been collected, used, or disclosed unlawfully, or if the personal data are no longer necessary in relation to the purposes for which they were to be retained, or if the data subject has exercised his or her right to withdraw consent or object to the processing of the personal data as described above.

11.6

Right to request suspension of use: The data subject may request to suspend the use of the personal data temporarily while the Company is investigating the data subject’s request to exercise the rights to rectification or to objections or in other situations where the personal data is no longer necessary and must be erased or destroyed in accordance with the applicable laws, but the data subject instead requires the suspension of use.

11.7

Rights to rectification: The data subject may request to rectify inaccurate, incomplete, and misleading personal data relating to the data subject.

11.8

Right to complaint: The data subject may complain to the lawful authority under applicable laws if the data subject considers that the collection, use, or disclosure of the personal data violates or fails to comply with the relevant laws. The data subject’s exercise of the rights listed above may be restricted under relevant laws. Under certain circumstances, the Company may refuse to comply with or may be unable to comply with the request to exercise the rights such as when it is required to comply with the law or the court’s order, or when the Company is compelled by the public interests, or the exercise of rights may violate the rights or freedoms of others. If the Company refuses to comply with the data subject's request, it must provide the data subject with an explanation for the refusal.