Privacy Notice

Last Updated :   1 August 2024

Dear Shareholders or Your Proxy Holders,

Worldlease Company Limited (“Company”) values a privacy and strives for protecting your personal data (“Personal Data”) based on the laws of Thailand according to the Personal Data Protection Act B.E. 2562 (2019) for the collection, use, and/or disclosure of your Personal Data during and for the purposes related to your investment as set forth herein (“Privacy Notice”).

This Privacy Notice explains: -

• What kind of Personal Data does the Company collect? This includes what you tell the Company about yourself
  (“you”, “your” or “yourself”) and what the Company learnt during the period of your investment.
  
• How does the Company use your Personal Data?
• Who does the Company disclose the Personal Data to?
• What are the choices the Company offers including how to access and update your Personal Data?
• What are your privacy rights and how does the law protect you?

1.Collection of Personal Data


The Company collects many different kinds of the Personal Data, depending on various circumstances that are relevant to investments and requests .

The Company collects the Personal Data about you from a variety of sources, including but not limited to:-

• From you directly during your investment;

• The information the Company has received during your investment regardless of format, including face -to -face, telephone or video call;
  
  
• Identification documents such as ID card, passport, or any other documents issued by government agencies, etc . ;
  
  
• Other forms completed by you during your investment at the Company;
  
  
• The correspondences with you through meetings or other assessments e .g . , CCTV, recording equipment, etc . ;
  
  
• When the Company receives Personal Data of you and /or a person, who is on behalf of you both directly from the data subject and / or from the data collection executed by the securities registrar, e .g . Securities and Exchange Commission .

In some instances, the Company may collect the Personal Data about you from third parties or publicly available sources related to your investment and /or your transactions with the Company .
The categories of Personal Data about you that the Company collects, subject to the applicable law, include but not limited to : -

• Personal details: Name, last name, gender, date of birth, marital status, personal identification number, passport number, other government-issued identification number(s), tax identification number, shareholder account ID, nationality, image of ID card, passport, signatures, authentication data, information provided by you as an answer to the Company (e.g., passwords, facial and voice recognition data, etc.;), photographs, voice recording and CCTV images;
  
  
• Family details : Names and contact details of family members and dependents;
  
  
• Contact details : Address, telephone number, email address and social media profile details;
  
  
• Transactional data : The details of your share investment amount, bank account, deposit account number,  tax payment, and broker;
  
  
• Electronic data : All above data in electronic form, IP addresses, activity logs, online identifiers, unique device identifiers, electronic data for verification of meeting attendance and other technical data which are related to your attended meeting and investments .
  
  
• Sensitive Personal Data : The Personal Data that the law specifically prescribes, including information about your race, ethnic origin,
  religion, or philosophical beliefs, health data, disability, or any other information which affects you in the same way as announced by the Personal Data Protection Committee .
  
  
• Other Data : Other personal data which has been collected, used and /or disclosed relating to relationship with the Company, such as information given by a juristic person to the Company in relation to the investment and /or activities with the Company, and other personal data which are related to your investment or activities with the Company deemed as Personal Data under the laws governing the personal data protection .

During your investment at the Company, the Company may also collect some sensitive Personal Data about you to make reasonable
adjustments of working environment to better suit your religion or beliefs, to provide you with access to the workplace and the Company system, and to comply with related laws . The Company will not collect, use and /or disclose this type of data without your consent unless the law allows the Company to do so .

If you provide Personal Data of any other third party who has involvement with you to the Company such as proxy holders, contact persons and /or any other persons per document of your transaction, etc . , please inform those persons of the details under this Privacy Notice and request their consent, if necessary, or apply other lawful bases to ensure that Company can collect, use and /or disclose Personal Data of the aforementioned third party .

2.Use of Personal Data

The Company may collect and use your Personal Data only if the Company have proper reasons to do so . This includes sharing it outside the Company .
The Company will rely on one or more of the following lawful grounds when collecting, using and /or disclosing your Personal Data : -

• When it is to fulfill a contract the Company has with you (contractual basis) – that is when the Company needs your Personal Data to fulfill your investment or before entering into a contract with you;
  
• When it is the Company’s legal obligation (legal obligation) – that is when the Company needs to collect, use and/or disclose your Personal Data to comply with the law or statutory obligation;
• When it is in the Company’s legitimate interest (legitimate interest) – that is when the Company collects, uses and/or discloses your Personal Data for the Company’s legitimate interest as permitted under the law, so long as your fundamental rights are not overridden by the Company’s legitimate interest; and/or
  
• When you consent to it (consent) – that is when you allow the Company to collect, use and/or disclose your Personal Data for certain purposes.
  
• When it is necessary to the Company to collect, use and/or disclose your Personal Data permitted by the Personal Data Protection Act B.E. 2562 (2019).
  

The Personal Data Protection Act B.E. 2562 (2019) considers some personal data to be more sensitive and therefore treats this type of Personal Data more stringently. In this regard, the Company will not collect, use and/or disclose this type of Personal Data without your consent unless the law allows the Company to do so. If the Company will collect, use, and/or disclose such sensitive Personal Data, it will only do so upon your consent or only for one of the following purposes:

• For management of affairs related to your investment;
• For the prevention or suppression of danger to life (vital interest);
• For the compliance with a law to achieve the purposes with respect to investment protection;
• For establishing, compliance, exercising and /or defending legal claims .

The purposes for which the Company may collect, use and /or disclose your Personal Data, subject to the applicable law, and legal basis on which the Company may perform such collection, use and /or disclosure, are : -

Purposes of data collection, use and/or disclosure	Lawful basis for collection, use and/or disclosure
Compliance with Laws and Corporate Governance Principles
To contact you about your investment and other matters as requested by you. To identify your identity and communication with the Company. To manage the investment and meeting process. To submit, register, report, and/or disclose as required by relevant authorities (e.g. Ministry of Commerce, Securities and Exchange Commission). To prevent and detect money laundering or financing of terrorism and comply with regulation relating to sanctions and embargoes through the Company’s Know Your Customer (KYC) process (to identify you, verify your identity, screen your details against sanctions lists and determine your profile) and perform a Due Diligence (DD) as prescribed by anti-money laundering law and other relevant law. To comply with applicable laws and regulations. To execute various affairs, e.g. management of shareholders’ meeting, verification of identity and signature for entering into transaction or exercising statutory rights as a shareholder, document submission, which are in compliance with relevant laws and regulations, e.g. laws governing public limited companies, rules governing the financial institutions’ business. To execute various affairs for legitimate interest purpose, e.g. shareholders’ meeting minutes taking, recording/ broadcasting of photos, videos or voice during the meeting, implementing security measures.	Legal obligation Legitimate interest
Business operation
To disclose and/or use in publications, articles, letters or other documents of the Company (e.g. annual reports (currently, “one report”), website).	Legal obligation Legitimate interest
Benefits and Risk Management
To pay return and other benefits related to your investment. To deduct tax. To maintain accurate and up-to-date Shareholder records, including details of contact. To ensure a security of premises, data and technology. To respond to and defend against legal claims (including to bail-out, as the case may be).	Legal obligation Legitimate interest

When the Company relies on the legitimate interests as the reason for collecting, using and /or disclosing the Personal Data, it has considered whether your fundamental rights are overridden by the Company ’s legitimate interests and has concluded that they are not .

If you fail to provide your Personal Data to the Company

Where the Company is required by laws to collect your Personal Data or need to collect your Personal Data due to or in connection with your investment and you fail to provide your Personal Data when requested, the Company may not be able to perform obligation the Company has with you or plans to have with you . In this case, the Company may not be able to process activities related to your investment or will not be able to administer and /or manage the purposes for which Personal Data was requested or collected, and you may be denied remuneration and other benefits as a result of the Company ’s inability to use your Personal Data for consideration, but the Company will notify you if this is the case at the time your Personal Data is collected .

3. Disclosure of Personal Data

The Company may share your Personal Data with others where it is lawful to do so, including where the Company or other person : -

• needs to provide you with the requirement under the obligations that the Company has with you as Shareholders or Your Proxy Holders;
  has a legal duties to do so
• needs to proceed with, in connection with a regulatory reporting (e.g., to the Ministry of Commerce, the Securities and Exchange Commission, the Stock Exchange of Thailand, Thailand Securities Depository Co., Ltd., etc.), litigation, asserting or defending legal rights and interests;
  
• has legitimate interest to do so (e.g., manage risk, internal record, etc.);
  
• asks for your consent to disclose such Personal Data, and you consent to it; and/or
• promotes the Company’s public relation activities where you have attended or are in such activities area.
  

The Company may share your Personal Data for the above purposes with others, including : -

• other CIMB Group companies and any sub -contractors, agents or service providers who work for the Company or provide the services to the Company or other CIMB Group companies, including their employees, sub -contractors, service providers, directors and officers
• government authorities, regulators, and relevant persons or agencies e .g . Ministry of Commerce, Securities and Exchange Commission, Stock Exchange of Thailand, Thailand Securities Depository Co . , Ltd . , courts, competent authorities;
• any sub-contractors, agents or service providers who work for the Company or provide the services related to the investment-related work (including working system, registration with government entity);
  
• the Company’s advisors or experts; anyone who provides instructions or operates any of your investments and/or activities on your behalf (e.g., Power of Attorney, solicitors, etc.);
  
•  anybody else that the Company has been instructed by you to share your Personal Data; and /or
• any person entering the area or passing through the area where the Company organizes activities or has seen the Company ’s public relations media .

Except as described in this Privacy Notice, the Company will not use the Personal Data for any purposes other than the purposes as described to you in this Privacy Notice . Should the Company intend to collect, use or transfer additional information which are not described in this Privacy Notice, the Company will notify you and obtain your consent prior to the collection, use and disclosure unless the Company is permitted to do so without your consent under the law . You will also be given the opportunity to consent or to decline such collection, use and /or transfer of your Personal Data .

The Company will continue to adhere to this Privacy Notice with respect to the information the Company has in its possession relating to prospective, existing and former Shareholders or Your Proxy Holders .

Cross-border Transfer of Personal Data

However, such countries may not have the same level of protection for the Personal Data as Thailand. In the event that the Company does this, the Company shall ensure that such countries have an appropriate level of Personal Data protection measures or that the transfer is lawful. For example, your Personal Data may be shared to other CIMB group companies in accordance with the Company’s Binding Corporate Rules (BCRs) or other relevant contractual arrangements, which require all CIMB Group companies to follow the same rules or terms when collecting, using and/or disclosing your Personal Data.

The Company may need to transfer the Personal Data in this way to perform the obligations to fulfill the legal obligations, protect the public interests and /or for the Company ’s legitimate interests .

In some countries, the law might compel the Company to share certain Personal Data e .g . , with tax authorities . Even in these cases, the Company will only share the Personal Data with people who have the right to see it .

4. Retention of Personal Data

The Company will only retain your Personal Data for as long as it is necessary to carry out the purposes for which it was collected, that is, for business reasons, or compliance with the applicable laws .

The Company will keep your Personal Data for up to 11 years after the duration of your investment . However, in the event of regulatory or technical reasons, the Company may keep your Personal Data for more than 11 years .

5. Accuracy of your Personal Data

The Company needs your help to ensure that your Personal Data is current, complete and accurate. Please inform the Company of any changes to your Personal Data by: -

7. Security of your Personal Data

IInformation is the Company ’s asset and therefore the Company places a great importance on ensuring the security of your Personal Data .
The Company regularly reviews and implements up -to -date physical, technical and organizational security measures when collecting, using and /or disclosing your Personal Data .

The Company has internal policies and controls in place to ensure that your Personal Data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by the Company ’s employees in the performance of their duties .

The Company ’s employees are trained to handle the Personal Data securely and with utmost respect, failing which they may be subject to a disciplinary action .

8. Your responsibilities

You are responsible for making sure that the Personal Data you give the Company or provided on your behalf, is accurate and up to date, and you must tell the Company as soon as possible if there are any updates .

Certain Personal Data, such as contact details, and payment details, must be provided to the Company in relation to your investment and transaction .

If you do not provide such Personal Data, this will hinder the Company ability to administer the rights and obligations arising as a result of your investment relationship efficiently .

9. Revision of the Company’s Privacy Notice

The Company keeps the Privacy Notice under a regular review and thus the Privacy Notice may be subject to change . The date of the last revision of the Privacy Notice can be found on the top of the page .

10. Contact us

If you have any questions in regard to the protection of your Personal Data or if you wish to exercise your rights, please contact :