SARAPAD THAI CO., LTD. ("we", "us", or "our") is using closed-circuit television (CCTV) devices for monitoring our designated space within and around Sarapad Thai Shop at One Bangkok (the “Monitored Space”) to protect life, health, and property. We collect personal data of all customers, tenants, employees, directors, contractors, workers, visitors, or any individuals entering the Monitored Space (collectively referred to as "you" or "your") through the use of CCTV devices. This Privacy Policy provides information on our collection, use, disclosure,

By entering the Monitored Space, you have acknowledged this Privacy Policy and allow our collection, use, disclosure, and transfer of your individually identifiable information (the “Personal Data”). We may amend this Privacy Policy from time to time, please review it each time you enter the Monitored Space.

1. What Personal Data we collected

By entering the Monitored Space, we collect your Personal Data as follow:

    · Still images;

    · Your Movement;

    · Voice (with prior notification); and

    · Picture of your belongings e.g., vehicle.

Your Personal data above is collectively referred to as the “CCTV Data”.

2. Why we collect, use and/or disclose your Personal Data

2.1 We may collect, use, disclose, transfer, and/or carry out any operation, including but not limited to recording, holding, adapting, altering, modifying, destroying, deleting, retrieving, combining, copying, transmitting, storing, extracting, amending, or adding, related to your CCTV Data and other Personal Data concerning you, for the "CCTV Monitoring Purposes" as listed below:

(a) to protect your health and personal safety, including your belongings;

(b) to protect our buildings, facilities and assets from damage, disruption, vandalism, and other crime;

(c) to support law enforcement organizations in the deterrent, prevention, detection, and prosecution of crime;

(d) to assist in the effective resolution of disputes which arise in the course of disciplinary or grievance proceedings;

(e) to assist in the investigation or proceedings concerning a whistleblowing complaint; and

(f) to assist in the establishment or defense of any civil litigation, including but not limited to employment proceedings.

2.2 We will install CCTV devices in plain sight and only to achieve the CCTV Monitoring Purposes. The areas we will not install the CCTV devices are in staff rooms, changing rooms, toilets, shower rooms, or any other areas designated as staff rest areas.

2.3 Our CCTV devices are in operation 24 hours a day and 365/366 days a year, and may capture audio recordings.

2.4 We will place signage at the entrance and exit points, and the monitored areas to alert you that a CCTV installation is in use. In case the CCTV includes voice recording, you will be notified that both video and voice are being recorded.

3. Legal bases

We will not collect, use, disclose process, transfer, and/or carry out any operation, including but not limited to recording, holding, adapting, altering, modifying, destroying, deleting, retrieving, combining, copying, transmitting, storing, extracting, amending, or adding, related to your CCTV Data and other Personal Data concerning you, without consent except for the following:

(a) Vital interest. It is necessary for our prevention or suppression of a danger to a person's life, body, or health;

(b) Legitimate interest. It is in our legitimate interest to protect your health and personal safety, as well as your belongings, our buildings, facilities and assets, and to carry out any other acts to achieve the CCTV Monitoring Purposes. We will endeavor on the continuing basis to balance our legitimate interest and that of any relevant third parties, as the case may be, and your fundamental rights and freedoms related to the protection of the CCTV Data concerning you. We will also endeavor to identify any steps required to achieve the right balance as appropriate;

(c) Legal obligations. For us to comply with the legal obligations prescribed by the applicable laws, including but not limited to the laws regarding safety and environment in the workplace.

4. To whom we may disclose or transfer your Personal Data

4.1 We will keep CCTV Data concerning you confidential and will not disclose or transfer it except to our parent, subsidiaries, affiliates, and other carefully selected third parties now or in the future, licensees, joint venture partners, and/or service providers, who may be located overseas, to achieve the CCTV Monitoring Purposes provided in this Privacy Policy.

4.2 Third parties to which we may disclose CCTV Data and other Personal Data concerning you include:

(a) Group and our affiliates. We may disclose or transfer CCTV Data and other Personal Data concerning you to Group and our affiliated companies, as part of our legitimate interest and our affiliates' interest to achieve the CCTV Monitoring Purposes.

(b) Governmental and/or regulatory organizations. We may disclose or transfer CCTV Data and other Personal Data concerning you to comply with legal obligations, or to support or assist law enforcement organizations with regard to the investigation and prosecution of civil or criminal proceedings.

(c) Third-party service providers. We may disclose or transfer CCTV Data and other Personal Data concerning you as our necessary steps to ensure our protection of your health and personal safety, and belongings, to third-party service providers.

5. International transfers of your Personal Data

5.1 We may disclose or transfer your CCTV Data as part of necessary steps to ensure your health, personal safety, and belongings, to third-party service providers that are outside of Thailand. Such disclosure or transfer may only be done by obtaining your consent, unless there are any other compelling legitimate grounds (e.g. to perform the contract terms between us and other persons for your benefit) as permitted by applicable laws.

5.2 If your CCTV Data is transferred to destination countries where the standard of protection available is not sufficient under the applicable laws on data protection in Thailand, we will take steps necessary to protect the Personal Data transferred to other persons internationally to reach the same level of protection as we provide with respect to your CCTV Data, and in compliance with the applicable laws on data protection which is in effect at that time.

6. Security measures

6.1 We use reasonable organizational, technical, and administrative security measures to protect CCTV Data and your Personal Data from accidental, unlawful, or unauthorized destruction, loss, access, use, alteration, or disclosure.

6.2 We will from time to time review and update our security measures as necessary or upon development of the concerning technology to ensure effective and appropriate security measures, and in line with minimum legal requirements as prescribed by the relevant governmental organizations.

7. How long do we keep your Personal Data

We will retain your CCTV Data in our system for the period necessary to fulfill our duties to achieve the CCTV Monitoring Purposes prescribed in this Privacy Policy.

8. Your rights as a data subject

Subject to applicable laws and exceptions thereof, you may have the following rights to:

• Access: You may have the right to access or request a copy of the Personal Data we are collecting, using and disclosing about you. For your own privacy and security, we may require you to prove your identity before providing the requested information to you.

• Rectification: You may have the right to have incomplete, inaccurate, misleading, or out-of-date Personal Data that we collect, use and disclose about you rectified.

• Data Portability: You may have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to send or transfer this data to another data controller, as long as you had provided this Personal Data to us, and we had been processing this data on the basis of your consent or to perform a contract with you.

• Objection: You may have the right to object to certain collection, use and disclosure of your Personal Data such as objecting to direct marketing.

• Restriction: You may have the right to restrict the use of your Personal Data in certain circumstances.

• Withdraw Consent: For the purposes you have consented to our collecting, using and disclosing of your Personal Data, you have the right to withdraw your consent at any time.

• Deletion: You may have the right to request that we delete or de-identify Personal Data that we collect, use and disclose about you, except we are not obligated to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise, or defend legal claims.

• Lodge a complaint: You may have the right to lodge a complaint to the competent authority where you believe our collection, use and disclosure of your Personal Data is unlawful or noncompliant with applicable data protection law.

9. Our Contact Details

If you have concerns or questions regarding this Privacy Policy or if you would like to exercise your rights in relation to your CCTV Data, please contact:

SARAPAD THAI CO., LTD.

Email: th.fpt.dpo@frasersproperty.com