Personal Data Protection Policy Announcement

CMH Life Science Company Limited (“the Company”) recognizes the importance of personal data protection and has established governance and management of personal data to comply with the Personal Data Protection Act B.E. 2562 (2019) and related laws. The Company hereby provides the following information to ensure compliance with the said Act, with the key details as follows:

Personal Data

1.1 Types of Personal Data

In this document:

• Personal Data refers to any information relating to an individual that enables the identification of that individual, whether directly or indirectly, but does not include the personal data of deceased persons.
• Sensitive Personal Data refers to personal data concerning race, ethnicity, political opinions, beliefs in religion or philosophy, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data (e.g., fingerprint scans, facial scans, etc.), or any other data that similarly affects the data subject as prescribed by the Personal Data Protection Committee.

1.2 Personal Data Collected

The Company may collect the following personal data:

General Personal Data:

• (a) Personal Information: Name, surname, date of birth, place of birth, marital status, information specified in identification cards or passports, copies of identification cards, or identification card numbers.
• (b) Contact Information: Address, phone number, Line ID, social media contact channels, workplace.
• (c) Job Position: Department or organization.
• (d) Electronic System Usage Information: Email, IP address, browser type, cookies, and chat history in various applications.
• (e) Information Provided: Data provided when contacting or participating in activities with the Company.

Respect for Personal Data Rights

The Company respects the rights of data subjects regarding their personal data and acknowledges that data subjects expect their data to be secure. Personal data received by the Company will be used only for the specified purposes. The Company has stringent measures to ensure the security of personal data and to prevent its unlawful use.

Collection of Personal Data

When collecting personal data directly from the data subject, using personal data, or disclosing personal data, the Company will seek the data subject’s consent prior to or at the time of collection if required by law. The Company will process personal data only as necessary for the purposes explicitly stated.

The Company may also collect personal data from sources other than the data subject, such as public media, only when necessary and in accordance with legal methods.

Purposes of Collecting, Using, and Disclosing Personal Data

The Company collects, uses, and discloses personal data for the following purposes:

• To facilitate the procurement or sale of products and the provision or receipt of services in various forms.
• For financial and tax transactions related to the Company’s contractual obligations.
• For research or studies.
• To create a database for analyzing and offering the Company’s or its affiliates’ services or products, or those of distributors, agents, or related parties.
• To improve operational quality, service delivery, and business-related activities.
• To analyze and track website usage and for retrospective reviews in case of usage issues.
• For participation in the Company’s various activities.
• For access control, preventing and mitigating risks to life, body, or health of the data subject or others, controlling and preventing infectious diseases, and ensuring the security of the Company’s premises, buildings, and areas.
• To comply with applicable laws or regulations, both current and future.

The personal data collected for the above purposes is necessary for contractual obligations or compliance with applicable laws. Failure to provide such data may result in legal violations, or the Company may be unable to manage contracts or provide services to the data subject.

If the purposes for collecting personal data change, the Company will notify the data subject and take further actions as required by law, maintaining records of any amendments as evidence.

Retention Period of Personal Data

The Company will retain personal data for as long as necessary to fulfill the purposes of collection, use, and disclosure outlined in this announcement. The retention period is based on criteria such as the duration of the Company’s relationship with the data subject as a customer and may extend as necessary for legal compliance, statutory limitation periods, establishing legal claims, exercising or defending legal rights, or other purposes in accordance with the Company’s internal policies and requirements.

If the retention period cannot be clearly specified, the Company will retain the data for a period reasonably expected based on collection standards (e.g., a maximum statutory limitation period of 10 years).

Security Measures

The Company implements appropriate and stringent security measures in accordance with its information technology security policies and guidelines to prevent the loss, unauthorized access, destruction, use, alteration, or disclosure of personal data without lawful authority.

Rights of Data Subjects

As a data subject, you have rights under the Personal Data Protection Act B.E. 2562 (2019), including the following:

7.1 Right to Withdraw Consent
You may withdraw your consent for the processing of personal data given to the Company, unless restricted by law or contracts that benefit you. Withdrawal of consent will not affect the lawfulness of prior data processing based on your consent.

7.2 Right to Access Personal Data
You may request access to and obtain a copy of your personal data under the Company’s responsibility and request disclosure of how such data was obtained without your consent.

7.3 Right to Data Portability
You may request the Company to transfer your personal data provided to the Company as prescribed by law.

7.4 Right to Object
You may object to the collection, use, or disclosure of your personal data as prescribed by law.

7.5 Right to Erasure
You may request the Company to delete, destroy, or anonymize your personal data as prescribed by law.

7.6 Right to Restrict Use
You may request the Company to restrict the use of your personal data as prescribed by law.

7.7 Right to Rectification
If you believe the Company’s data is inaccurate or your personal data has changed, you may request the Company to correct your personal data to ensure it is accurate, up-to-date, complete, and not misleading.

7.8 Right to Be Notified of Changes
The Company may periodically review and amend this announcement to ensure appropriate protection of your personal data.

7.9 Right to Lodge a Complaint
You may lodge a complaint with the competent authority under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with the Act.

Upon receiving a request to exercise your rights, the Company will process it within the timeframe prescribed by law. The Company reserves the right to refuse or not act on such requests if permitted by law. If you choose to provide only specific personal data, it may limit your ability to fully access the Company’s services, and the Company may be unable to work with or provide services to you if required data is not provided.

Disclosure of Personal Data to Others

The Company may need to disclose personal data to its affiliates or other strategic partners, both domestic and international, who collaborate with the Company in providing products and services, as reasonably necessary to enforce the Company’s terms and conditions, during corporate restructuring, mergers, or business sales, or to government or public authorities as required by law, court orders, or orders from competent authorities. Personal data will be kept confidential in both physical and electronic forms and during all stages of data transfer.

For cross-border transfers of personal data, the Company will strictly comply with the Personal Data Protection Act B.E. 2562 (2019).

Data Protection Officer

The Company has appointed a Data Protection Officer (DPO) to oversee the Company’s operations regarding the collection, use, and disclosure of personal data in compliance with the Personal Data Protection Act B.E. 2562 (2019) and related laws.

Contact Information

For inquiries or further details regarding personal data protection, please contact the Company via the following channels:

CMH Life Science Company Limited

• Address: 189 Moo 4 (Ban Kiew Lae Luang), Tambon Yuwa, Amphoe San Pa Tong, Chiang Mai 50120
• Phone: 061-3091223

Data Protection Officer

• Address: 189 Moo 4 (Ban Kiew Lae Luang), Tambon Yuwa, Amphoe San Pa Tong, Chiang Mai 50120
• Email: Cmhholding2558@gmail.com

Changes to the Personal Data Protection Policy

The Company will periodically review this policy to ensure compliance with applicable practices and laws. If amendments are made, the Company will notify you through appropriate announcements.

Announced on June 1, 2022

Mr. Rutthavith Siramornsit
Chief Executive Officer

数据隐私政策

个人信息保护政策声明

CMH Life Science 有限公司（以下简称“公司”）充分认识到保护个人信息的重要性，并致力于监督和管理个人信息，以确保符合《2562年（2019年）个人信息保护法》及相关法律的规定。为此，公司特此通知您以下信息，以遵循《2562年（2019年）个人信息保护法》的要求，其主要内容如下：

个人信息

1.1 个人信息的性质

在本文件中，
个人信息指与自然人相关的任何信息，能够直接或间接识别该自然人的身份，但不包括已故者的个人信息。

敏感个人信息指与种族、民族、政治观点、宗教或哲学信仰、性行为、犯罪记录、健康状况、残疾、工会信息、遗传数据、生物数据（例如指纹扫描、面部扫描等）或个人信息保护委员会规定可能对个人信息主体产生类似影响的任何其他信息。

1.2 收集的个人信息

公司可能收集以下您的个人信息：

一般个人信息：

• (1) 个人资料：包括姓名、出生日期和地点、婚姻状况、身份证和护照中列明的信息、身份证副本或身份证号码。
• (2) 联系信息：包括地址、电话号码、Line ID、社交媒体联系方式、工作地点。
• (3) 职位、部门或组织。
• (4) 电子系统使用信息：包括电子邮件、IP地址、浏览器类型、Cookies以及各类应用程序中的聊天记录。
• (5) 您在与公司联系或参与公司任何活动时提供的信息。

尊重个人隐私权

公司尊重个人信息主体的权利，并充分认识到个人信息主体希望其信息获得安全保障。公司收集的个人信息将仅用于相关目的，公司采取严格措施确保信息的安全，防止个人信息被非法使用。

个人信息的收集

公司直接从个人信息主体收集个人信息，并在使用或披露个人信息时，若法律要求，将在收集前或收集时获得个人信息主体的同意。公司仅在明确告知的目的范围内处理必要的个人信息。

此外，公司可能从非直接来自个人信息主体的公共来源（如公开媒体）收集个人信息，但仅限于法律允许的必要情况。

收集、使用和披露个人信息的目的

公司根据以下目的收集、使用和披露您的个人信息：

• 为采购或销售产品、提供或接受各种形式的服务。
• 与公司合同履行相关的金融和税务交易。
• 研究或调研。
• 建立数据库以分析和提供公司、集团公司或与公司相关的经销商、代理商或个人的服务或产品。
• 提高公司运营、服务质量及相关业务活动。
• 分析和跟踪网站服务使用情况，以及在发生使用问题时进行回溯检查。
• 参与公司的各类活动。
• 控制访问权限、防止和遏制对您或其他人的生命、身体或健康的危害、控制和预防传染病，以及确保公司建筑物内外及区域的安全。
• 遵守公司现行及未来适用的法律或法规。

公司为上述目的收集的个人信息是履行合同或遵守适用法律所必需的。如果您未提供必要的个人信息，可能违反法律，或公司可能无法管理合同或为您提供相关便利。

若后续个人信息收集目的发生变更，公司将通知您并依法采取必要措施，包括记录修订内容作为证据。

个人信息存储期限

公司将根据本声明中列明的收集、使用和披露个人信息的目的，存储您的个人信息，存储期限以必要为限。存储期限的依据包括：您作为公司客户与公司关系的持续期间，以及为遵守法律或法定时效、建立法律权利、履行法律义务、行使或抗辩法律权利或根据公司内部政策和规定的其他原因所需的合理期限。

若无法明确确定存储期限，公司将根据收集标准（如一般法律最高时效10年）预估合理的存储期限。

安全性保障

公司制定了适当且严格的措施，根据公司的信息技术安全政策和实践，确保个人信息的安全，防止丢失、未经授权访问、破坏、使用、修改或非法使用个人信息。

您作为个人信息主体的权利

作为个人信息主体，您享有《2562年（2019年）个人信息保护法》规定的权利，包括以下权利：

7.1 撤销同意权

您有权撤销对公司处理您已同意的个人信息的许可，除非法律或对您有利的合同限制撤销。撤销同意不影响此前合法处理的行为。

7.2 访问个人信息权

您有权访问并获取公司负责的您的个人信息副本，并要求公司披露未获您同意的个人信息来源。

7.3 传输个人信息权

您有权要求公司依法传输您提供给公司的个人信息。

7.4 反对收集、使用或披露个人信息权

您有权依法反对与您相关的个人信息收集、使用或披露的处理。

7.5 删除个人信息权

您有权要求公司依法删除、销毁或匿名化您的个人信息。

7.6 暂停使用个人信息权

您有权要求公司依法暂停使用您的个人信息。

7.7 更正个人信息权

若您认为公司持有的信息不准确或您的个人信息发生变更，您有权要求公司更正个人信息，确保信息准确、最新、完整且不引起误解。

7.8 获知个人信息通知变更权

公司可能不时审查和修改本通知，以确保您的个人信息得到适当保护。

7.9 投诉权

若公司违反或未遵守《2562年（2019年）个人信息保护法》，您有权向有权官员投诉。

当公司收到您依据《2562年（2019年）个人信息保护法》提交的权利请求后，将在法律规定的时间内处理。公司保留在法律允许的情况下拒绝或不执行请求的权利。若您选择仅提供特定个人信息，可能无法充分享受公司服务，或公司可能无法与您合作或提供任何服务。

向其他个人或实体披露个人信息

公司可能需要向集团公司、国内外战略合作伙伴或其他与公司合作提供产品和服务的个人或实体披露个人信息，以执行公司条款和条件，或在组织重组、合并或出售业务时披露。此外，公司可能根据法律规定、法院命令或有权官员的命令，向政府或公共机构披露个人信息。个人信息将以纸质和电子形式保密，并在所有数据传输过程中保持安全。

若需将个人信息传输至国外，公司将严格遵守《2562年（2019年）个人信息保护法》的规定。

个人信息保护官

公司已任命个人信息保护官（Data Protection Officer, DPO），以监督公司收集、使用和披露个人信息的操作，确保符合《2562年（2019年）个人信息保护法》及相关法律。

联系方式

如对您的个人信息保护有疑问或需了解更多详情，请通过以下方式联系公司：

CMH Life Science 有限公司
地址：泰国清迈省桑帕通县尤瓦镇189号4村（Kiw Lae Luang村）50120
电话：061-3091223

个人信息保护官
地址：泰国清迈省桑帕通县尤瓦镇189号4村（Kiw Lae Luang村）50120
电子邮箱：Cmhholding2558@gmail.com

个人信息保护政策和实践的变更

公司将定期审查本政策条款，以确保符合相关实践和法律。若有修改，公司将通过适当的公告方式通知您。

发布日期：2022年6月1日

Rutthavith Siramornsit
首席执行官