1.Information of Data Controller

Details of the data controller
Name: MAJOR DEVLOPMENT PUBLIC COMPANY LIMITED and companies in its group (“Major Group”)
Contact Address: 141 Major Tower 16th Floor, Soi Thonglor 10 (Sukhumvit 55), Klongton Nua, Wattana, Bangkok, Thailand 10110
Contact Methods:
Contact: Data Protection Officer: DPO
Telephone: 1266
E-mail: dpo@mjd.co.th
Website: https://www.mjd.co.th

2.Personal data that we collect from you

In entering into a procurement contract or any other contract with you, we may collect personal data of authorized persons signing the contract, your representative, or related parties that need to provide personal information to the company as evidence for entering into contract or performing contracts as follows:
• Personal data including Name-Surname, Date of birth, National Identification number, Taxpayer identification number
• Contact data including Address, E-Mail, Telephone Number, Line id
• Financial data including Bank account number

3.Purpose of collection, use and disclose of personal data

We may use your personal data to the extent permitted by the personal data protection law. We only collect your personal data as necessary and to the extent that is related to provision of our service to you, where it is necessary:
• For our legitimate interests or any other person and your interests, which do not override your fundamental rights;
• For the performance of a contract to which you are a party, or in order to take steps at your request to enter into a contract;
• For compliance with a law to which we are subjected or for preventing or suppressing a danger to a person’s life, body or health.
We explain in the table below about how we use your personal data, and which lawful basis we rely on to do so.

Purpose/activity	Types of data	The lawful basis of processing
1) To communicate with you prior to entering into a contract and after signing a contract. 2) To proceed your request in relation to performance of contract.	- Name-Surname - Date of birth - Address - Telephone Number - E-Mail - Line id - National Identification number - Taxpayer identification number - Bank account number	1) Necessary for the performance of contract or to take steps at your request prior to entering into a contract 2) For our legitimate interest to legitimate interest to collect your personal data for processing payment and other remunerations relating to a contract.

We may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data.

4.Sources of Personal Data

1. We receive your personal data directly from you through the following electronic channels including website or application or offline channels when:
• You make a query to receive our service or to become our vendor;
• You make a query with us relating to our service.
2. We receive your personal data from a third party that collects, uses or discloses your personal data as instructed by us or on our behalf. Your personal data will not be used other than the purposes for which we instruct or require such third party to do. We require such third party to protect confidentiality of your personal data and to have measures to protect your personal data as required by the Thai personal data protection law.

5.Disclosing or sharing your personal data

1. We may have to disclose or share your personal data with selected third parties as follows:
• Our affiliated companies;
• Relevant Government Agencies;
• Regulator such as the Office of the Personal Data Protection Committee;
We require that the third parties above protect confidentiality and protect your personal data in accordance with requirements under the Thai personal data protection law. They may use your personal data only for purposes as instructed by us. Your personal data will not be used other than the purposes for which we instruct or require them to do so.
2.Upon request, we may disclose your personal data to a relevant authority for compliance with a law such as prevention of a danger to a person, legal compliance, setting for an indictment, exercising legal rights, and preventing fraud.

6.Retention policy and retention period of personal data

We collect your personal data in our information system and provide standard security to keep our information systems and the use of your personal data secure with following measures:
• Restrict access to personal data which may be accessed by employees, agents, contractors and other third parties. They can only access your personal data on our instructions, and they are subject to a duty of confidentiality and protection of personal data.
• Provide technological methods to prevent unauthorized access to computer systems.
• Destroy your personal data for security purposes when such information is no longer needed for legal and business purposes.
• Put in place procedures to deal with any suspected personal data breach and will notify a regulator of a breach where we are legally required to do so.
Retention period of personal data
• We will keep your personal data for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements.
• To determine the appropriate retention period for personal data, we consider the amount, nature, purpose and sensitivity of the personal data, the potential risk of harm from unauthorised use of your personal data, and the applicable legal requirements.
• We collect your personal data obtained from cookies when you use our website. We will keep your personal data for no more than 12 months or as required by relevant laws.

7.Right of Data Subject

Data subjects have the right to proceed to the extent permitted by law as follows:
1. The data subject shall have the right to withdraw his or her consent at any time. When processing personal data, you give us consent throughout the duration of your personal data with us (The Right to withdraw).
2. The data subject shall have the right to withdraw his or her consent at any time. When processing personal data, you give us consent throughout the duration of your personal data with us (The Right to withdraw).
3. The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her (The Right to Rectification).
4. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay (The Right to Erasure).
5. The data subject shall have the right to obtain from the controller restriction of data processing (The Right to Restriction of Processing).
6. The data subject shall have the right to transmit their personal data to another controller without hindrance from the controller to which the personal data have been provided (The Right to Data Portability).
7. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. (Right to Object)

You can contact the company’s DPO in order to proceed with the request to exercise the above rights.