Privacy Notice for Customers and Third Parties

Last updated May 2025

Muangthai Capital Public Company Limited (the “Company”) recognizes your right to privacy and its responsibilities regarding the collection, use, and disclosure (collectively, “processing”) of Personal Data relating to customers and third parties (“you”). The trust and confidence you place in the Company are among our most important values. We are therefore committed to processing Personal Data lawfully and appropriately in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”). This Privacy Notice explains how the Company collects, stores, uses, and discloses your Personal Data and describes your rights as a data subject.

1. Personal Data Collected by the Company

   The Company may process personal data (including sensitive personal data as defined under Section 26 of the PDPA and as prescribed by the Personal Data Protection Committee (“PDPC”)). The categories of personal data listed below represent the general scope of personal data that the Company may collect.

Personal information, personal information, general information	This includes identifying information such as title, name, surname, middle name, nickname, handwriting, nationality, etc. obtained from official documents or user-provided information.
Characteristics Data	Details about the user, such as date of birth, gender, height, age, marital status, photographs, loan application information, information of bankrupt, etc.
Contact Information	Information for communication purposes, such as home phone number, mobile phone number, fax number, email address, postal address, social media usernames (e.g., Line ID, Facebook, WhatsApp), accommodation location on maps, etc.
Employment History and Data	Type of employment, occupation, rank, position, length of work Reference information, salary, company name, length of employment Details of affiliated agencies Position Work address, etc.
Personal Property Data	Information about the user’s property, such as vehicle registration, motorcycle registration, vehicle manual book, boat registration, land title deed, condominium ownership certificate, usufruct certificate (Nor Sor 3), etc.
Financial Information	Income, source of income, salary, bank account number, deposit amount, financial history, deposit account transaction details, loan information, investment details, transaction information, utility payment records, asset lists, user’s ability to obtain and manage credit, etc.
Details about products and/or services previously purchased from the Company	Credit customer history, payment history, insurance brokerage service usage history, etc.
Verification Data	Information related to the identification process Information related to the identification process, such as getting to know your customer (KYC), customer fact-checking information (CDD), verification information. Risk grading for preventing and suppressing money laundering and prevention and suppression of terrorism financing, etc.

If you provide personal data of other individuals (for example, information relating to your spouse, family members, children, dependents, guarantors, or beneficiaries) or request the Company to disclose personal data of such individuals to third parties, you are responsible for informing those individuals of this notice and obtaining their consent where required.

The Company will not collect sensitive personal data of the data subject, such as genetic data, sexual behavior, or any information that may cause harm, damage reputation, or lead to discrimination, unless the Company obtains your explicit consent or collects such data based on lawful processing grounds as prescribed by law.

2. How We Obtain and Collect Your Personal Data

The Company collects your Personal Data only as necessary and on a lawful basis, including in the following circumstances:

1. When you express your intention to enter into or make a loan contract. Including products and services related to finance and investment of the company or when you Access or use the website or application and/or services online, on your mobile device or by phone. or other services of the company
2. When you submit documents and a set of loan contracts in order to enter into a loan contract with the Company or when you provide information while considering entering into a loan contract for various products or services of the Company.
3. When you communicate by letter or speech through websites, applications, online social media, telephone, email, direct encounters, interviews, SMS, fax, mail, or any other means with personnel, customer service representatives, contractors, suppliers, service providers, delegates, representatives, or other individuals or entities related to the company (“Company Personnel and Suppliers”).
4. When you give consent to provide personal data to the Company to participate in marketing activities, contests, raffles, events, or presentations of products by the Company, suppliers, or affiliated companies.
5. When the Company receives personal data from sources apart from yourself, including but not limited to obtaining information from public sources, private data sources, or commercial data sources, websites, online social media, data providers, associations, or business associations related to products you have contracted or used, complaints about products and services of the Company.
6. When the Company receives personal data from sources apart from yourself for the purpose of complying with the law and for other supervisory purposes, as well as for other purposes permitted by law, such as the Company may receive personal data of data subjects from the Bank of Thailand or the Office of the Consumer Protection Board.

3. Purposes and Legal Basis for Processing Personal Data

The Company collects personal data through lawful and fair means for the benefit of providing services to you and for other purposes specified in this notice. The purposes listed below represent the general framework of how the Company may use personal data.

Contractual Obligations	– Approval consideration Providing various products and/or services, such as applying for loans insurance Payment of money or any property, etc. – Any action related to providing products and/or services, such as processing, contacting, notifying, making complaints, delegating work to others who are external service providers. Transfer of rights and/or duties Notification of debt payment or renewal of various products and/or services, debt collection, etc. – To check and confirm your identity. – To carry out the company's procedures to achieve the objectives of the contract. – To check the history before and during entering into the contract and such details may be examined during the contractual period in order to establish, exercise, contest or proceed with the Company's claims. – for contact and the Company's business operations throughout the period that the Company still has legal relations – Preventing, dealing with, and reducing the risk that corruption may occur. Default on payment of debt or breach of contract Violating various laws, including disclosing personal information, in order to raise the standards of work in the same group of companies/businesses to prevent and reduce risks. – Sending documents or various information to you – Maintaining a relationship with you, such as handling complaints. Taking care of you by the company's employees
Legal Obligations	– Compliance with orders of legal authority. – Compliance with laws under the supervision of the Bank of Thailand. Securities and Exchange Law General insurance law Tax law Laws to prevent and suppress money laundering Laws for preventing and suppressing the financing of terrorism and the proliferation of weapons of mass destruction. Bankruptcy law and other laws that the company needs to comply with, both in Thailand and abroad. Including announcements and regulations issued according to the said law.
Legitimate Interests	– Risk management Supervision Management within the organization Including forwarding to affiliates of the same business for such purpose. Under the company's personal data protection policy – For internal management and operations regarding the development of the Company's products and/or services, such as designing new products and/or services of the Company. – Notifications or offers of products and/or services of the same type as those you have with the Company. Satisfaction assessment – Making personal information non-personally identifiable – CCTV image recording – Exchanging cards before entering the building
Consent	– To provide you with good products and/or services. and consistent with your needs – To allow you to receive offers. Special benefits, advice and news, including the right to participate in special events. – Voice recording via Call Center

Where the Company needs to collect Personal Data and you refuse to provide it, or object to processing for the purposes described above, the Company may be unable to process your request or provide some or all of the requested services.

4. Disclosure of Your Personal Data

Affiliated Companies	The Company may disclose your personal data to its affiliated companies in order to enhance service efficiency, including providing various benefits to you.
Business Partners	The Company may disclose your personal data to other persons or legal entities who jointly offer or develop products and/or services for customers or prospective customers, such as insurance companies, payment service providers, analytics providers, research agencies, survey service providers, marketing service providers, advertising and communication media, and event organizers.
Service Providers	The Company may engage other companies to act as service providers or to support the Company’s business operations, such as outsourcing providers, agents, or subcontractors. The Company may disclose your personal data to such service providers for business purposes, including providing services to customers, such as website and application providers, cloud service providers, software providers, and network service providers.
Professional Advisors	The Company may disclose your information to professional consultants, such as IT consultants, auditors, legal advisors, and tax service providers, to support the Company’s business operation.
Government Authorities and Other Entities as Required by Law	Disclosing your information to government agencies that have the authority to oversee laws and regulations, such as tax laws. Laws regarding labor protection and social security and other laws that the company needs to comply with, both in Thailand and abroad. Including announcements and regulations issued according to the said law.
Third parties who are the assignee, transferee, or transferee under the new debt conversion agreement	The Company may transfer rights, transfer, or enter into novation agreements to transfer rights and obligations of the Company to third parties. In accordance with the terms and conditions of the agreements between you and the Company, the Company may disclose or transfer your personal information to the assignee, transferee, or transferee under the new debt conversion agreement.

5. Cross-Border Transfer of Personal Data (If Applicable)

    The Company may need to transfer your personal data to affiliated companies within the same business group located in foreign countries, or to other recipients as part of the Company’s normal business operations, such as transferring or storing personal data on servers or cloud systems located overseas. The Company will ensure that such transfer of personal data is conducted in compliance with applicable laws and will implement appropriate safeguards to ensure adequate data protection standards.

6. Personal Data Retention Period

    The Company will retain personal data for as long as necessary and reasonable to achieve the purposes stated in this Notification. We will retain your personal data for no more than 10 years from the end of the relationship or last contact with us. If legal proceedings or other necessities arise, personal data may be retained until the conclusion of such proceedings. This includes the possible timeframes for filing appeals and/or legislation. Afterward, the Company will have procedures in place to delete, destroy, or anonymize your personal data in accordance with applicable law.

7. Personal Data Security Measures

    The Company recognizes the importance of maintaining the security of your personal data. Therefore, the Company has implemented appropriate security measures in line with confidentiality standards to prevent loss, unauthorized access, destruction, use, alteration, modification, or disclosure of personal data without authorization or unlawfully.

8. Your Rights

1. Right to Withdraw Consent You have the right to withdraw your consent previously given for the processing of your personal data. However, such withdrawal will not affect the lawful processing carried out prior to the withdrawal.
2. Right to Object You have the right to object to the processing of your personal data based on legal grounds other than consent.
3. Right to Notification: You have the right to be notified about the processing of your personal data, including disclosures related to data processing. The Company will provide you with copies of such information upon request.
4. Right to Rectification You have the right to request correction of your personal data to ensure that it is accurate and up to date.
5. Right to Restriction of Processing You have the right to request restriction of processing of your personal data. In such cases, the Company will only retain your data without further processing.
6. Right to Erasure You have the right to request the deletion or destruction of your personal data.
7. Right to Data Portability You have the right to receive your personal data in a readable or usable format and to request the Company to transmit such data to another data controller where technically feasible. This right applies where the processing is based on consent or contract and carried out by automated means.
8. Right to Lodge a Complaint You have the right to lodge a complaint with the relevant authority if you believe that the collection, use, or disclosure of your personal data violates applicable laws.
9. Right to Access and Obtain Information on Data Source You have the right to access or obtain a copy of your personal data and to request disclosure of how your personal data was obtained.

The Company will process your requests through designated channels such as branches, website, email, or telephone. However, the Company reserves the right to refuse your request if permitted by law or regulation. The Company may charge reasonable fees where applicable.

The Company will consider and process your request, or notify you if the request is refused, within 30 days from the date on which all required documents have been received in accordance with the Company’s conditions.

If unavoidable circumstances require more than 30 days to consider your request, the Company will inform you of the reason for the delay without undue delay. If the Company refuses your request, it will notify you of the decision and the reasons. You may contact the Company if you have questions about the refusal.

If you believe that the Company has handled your rights incorrectly or has violated or failed to comply with the PDPA or subordinate regulations issued under it, you may lodge a complaint with the Office of the Personal Data Protection Committee or a competent expert committee.

9. Changes to the Privacy Notice

The Company reserves the right to amend, supplement, or update this Notice as permitted by law to reflect changes in applicable law, services, business operations, or feedback from data subjects. Changes will be announced on the Company’s website. If a change is material, the Company will provide notice before the change takes effect.

10.Contact for Inquiries or Exercising Rights

If you have any suggestions or inquiries regarding the collection, use, or disclosure of personal data, or wish to exercise your rights under this Notice, you may contact the Company and/or the Data Protection Officer (DPO) through the following channels:

1. Contact the customer service center: 02-483-8888
2. Data Protection Officer (DPO) Email: DPO@muangthaicap.com
3. Head Office: Muangthai Capital Public Company Limited
   332/1 Jaransanitwong Road, Bangplad Sub-district,
   Bangplad District, Bangkok 10700