Privacy Notice for Employees and Job Applicants

Last updated August 2026

Muangthai Capital Public Company Limited (the “Company”) recognizes your right to privacy and its responsibilities regarding the collection, use, and disclosure (collectively, “processing”) of Personal Data relating to employees and job applicants (“you”). The trust and confidence you place in the Company are among our most important values. We are therefore committed to processing Personal Data lawfully and appropriately in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”). This Privacy Notice explains how the Company collects, stores, uses, and discloses your Personal Data and describes your rights as a data subject.

1. Personal Data Collected by the Company

The Company may process personal data (including sensitive personal data as defined under Section 26 of the PDPA and as prescribed by the Personal Data Protection Committee (“PDPC”)). The categories of personal data listed below represent the general scope of personal data that the Company may collect.

Personal information, personal information, general information	Name information or information from government documents that specify personal information of service users, such as national identification number, title, first name, last name, middle name, nickname, signature, taxpayer identification number, nationality, driver's license number. Passport number Driver's license number Professional license number Insurer identification number Social security number, etc.
Characteristics Data	Detailed information about users such as date of birth, gender, height, weight, age, marital status Military conscription status, photograph, spoken language, information on requesting a certificate of eligibility for a loan Bankruptcy information Information about being an incompetent person or a quasi-incompetent person, etc.
Contact Information	Information for communication purposes, such as home phone number, mobile phone number, fax number, email address, postal address, social media usernames (e.g., Line ID, Facebook, WhatsApp), accommodation location on maps, etc.
Employment History and Data	Employment details Including work history and educational history, such as type of employment, occupation, rank, position, duties, length of employment. Expertise Reference information Salary information, starting date, leaving date, evaluation results, welfare and benefits Educational institution, educational background, academic results, graduation date, etc.
Financial Information	Income, source of income, salary, bank account number, deposit amount, financial history Deposit account statements, etc.
Information about social relationships	Information about the social relationships of service users, such as holding board positions. Relationships with the company's workers Being a person who has an employment contract with the company Information on being a stakeholder in the business with the company, etc.
Information about insurance policies	Details about the employee's insurance policy, such as the insurer assured beneficiary Policy number Policy type Protection limit Information about claims, etc.
Information on the history of litigation	such as criminal history Records regarding civil litigation or criminal proceedings including police reports and related court orders, etc.
Health and medical information	Medical history medical examination records health care record medical report Details of medical services received Temperature measurement information, etc.
biological information	Facial Recognition, Fingerprint Verification, etc.
User identity and account information	Employee ID, first and last name, job title, branch, district, user account name Employee status System access rights Login date and time and account usage history, etc.
Location information (GPS)	GPS coordinates, approximate location or detailed location Date and time the location was recorded Starting and ending locations of work, routes, distances, and work areas, etc.
Camera data Pictures and videos	Pictures or videos of operations, pictures of documents, evidence, places, property, equipment, and pictures you choose to upload from your device, etc.
Equipment and technical information	Device model and brand Operating system Application version Required device ID Push Notification Token IP number Connection date and time History of using the Crash Log function and system performance data, etc.
Rating information, comments and suggestions	Evaluation scores, comments, suggestions, problem reporting information and the results of following up on solving problems This may be linked to user accounts when necessary.
Information introduced into or generated by artificial intelligence systems	Text, images, documents, positions, operational data Data classification results Analysis results Anomaly detection results, conclusions, or recommendations generated by the system

    If you provide personal data of other individuals (for example, information relating to your spouse, family members, children, dependents, guarantors, or beneficiaries) or request the Company to disclose personal data of such individuals to third parties, you are responsible for informing those individuals of this notice and obtaining their consent where required.

The Company will not collect sensitive Personal Data, such as genetic data, sexual behavior, or information that could cause harm, reputational damage, unfair discrimination, or inequality, unless it has obtained your explicit consent or another lawful basis prescribed by law applies.

2. How We Obtain and Collect Your Personal Data

    The Company collects your Personal Data only as necessary and on a lawful basis, including in the following circumstances:

    2.1 When you express your intention to enter into a contract. or before the contract period for the company to inspect Screen qualifications from your job application and other documents.

    2.2 When you submit supporting documents for consideration in accepting employment or working in the company. Including signing your consent document.

    2.3 When you communicate in writing or verbally through websites, applications, social media, telephone, email, direct meetings, interviews, short messages (SMS), fax, postal mail, or by any other means with company personnel. attorney agent or other persons or other related departments of the company (“Personnel and business partners of the company”)

    2.4 When the company receives personal information from a source other than you. This includes but is not limited to obtaining audit information from publicly available sources. personal resources or commercial resources, websites, social media resources

    2.5 When the company receives personal information from sources other than you. For the purposes of complying with the law and for other regulatory and regulatory purposes, as well as for other lawful purposes.

2.6 When you access the website, application or electronic system of the company. By filling out/sending information Upload/save in such systems, such as personal data from your use of the Company's websites, applications, or electronic systems.

2.7 When you have given permission and it is necessary to use functions related to operations from your device data, such as data from the camera, photo gallery, positioning system (GPS), operating system. or other components of the device

2.8 Automatically generated information During the use of the company's applications or systems, such as date and time of use, IP number, device information Usage history Error information and system performance information

3. Purposes and Legal Basis for Processing Personal Data

The Company collects personal data through lawful and fair means for the benefit of providing services to you and for other purposes specified in this notice. The purposes listed below represent the general framework of how the Company may use personal data.

Where the Company needs to collect Personal Data and you refuse to provide it, or object to processing for the purposes described above, the Company may be unable to process your request or provide some or all of the requested services.

4. Disclosure of Your Personal Data

Affiliated Companies	The Company may disclose your personal data to its affiliated companies in order to enhance service efficiency, including providing various benefits to you.
Business Partners	The Company may disclose your personal data to other persons or legal entities who jointly offer or develop products and/or services for customers or prospective customers, such as insurance companies, payment service providers, analytics providers, research agencies, survey service providers, marketing service providers, advertising and communication media, and event organizers.
Service Providers	The Company may engage other companies to act as service providers or to support the Company’s business operations, such as outsourcing providers, agents, or subcontractors. The Company may disclose your personal data to such service providers for business purposes, including providing services to customers, such as website and application providers, cloud service providers, software providers, and network service providers.
Professional Advisors	The Company may need to disclose your information to professional advisors in information technology, auditing, legal, accounting, and tax and other services to support the Company's business operations.
Government Authorities and Other Entities as Required by Law	The Company may disclose your personal data to government agencies with legal authority and regulatory responsibilities, such as tax authorities, labor and social security authorities, and other relevant laws and regulations, both domestically and internationally, including regulations issued pursuant to such laws.

5. Cross-Border Transfer of Personal Data (If Applicable)

The Company may need to transfer your personal data to affiliated companies within the same business group located in foreign countries, or to other recipients as part of the Company’s normal business operations, such as transferring or storing personal data on servers or cloud systems located overseas. The Company will ensure that such transfer of personal data is conducted in compliance with applicable laws and will implement appropriate safeguards to ensure adequate data protection standards.

6. Duration of Personal Data Retention

    The Company will retain your personal data for as long as reasonably necessary to fulfill the purposes specified in this Notice. In any case, the Company will retain your personal data for no longer than 10 years from the date the relationship ends or the last contact with the Company. In the event of legal proceedings or other necessary circumstances, the Company may retain your personal data until such proceedings are finalized, including any potential appeal or litigation period. After that, the Company will implement procedures to delete, destroy, or anonymize your personal data in accordance with applicable laws.

7. Personal Data Security Measures

    The Company recognizes the importance of maintaining the security of your personal data. Therefore, the Company has implemented appropriate security measures in line with confidentiality standards to prevent loss, unauthorized access, destruction, use, alteration, modification, or disclosure of personal data without authorization or unlawfully.

8. Your Rights

1. Right to Withdraw Consent You have the right to withdraw your consent previously given for the processing of your personal data. However, such withdrawal will not affect the lawful processing carried out prior to the withdrawal.
2. Right to Object You have the right to object to the processing of your personal data based on legal grounds other than consent.
3. Right to Notification: You have the right to be notified about the processing of your personal data, including disclosures related to data processing. The Company will provide you with copies of such information upon request.
4. Right to Rectification You have the right to request correction of your personal data to ensure that it is accurate and up to date.
5. Right to Restriction of Processing You have the right to request restriction of processing of your personal data. In such cases, the Company will only retain your data without further processing.
6. Right to Erasure You have the right to request the deletion or destruction of your personal data.
7. Right to Data Portability You have the right to receive your personal data in a readable or usable format and to request the Company to transmit such data to another data controller where technically feasible. This right applies where the processing is based on consent or contract and carried out by automated means.
8. Right to Lodge a Complaint You have the right to lodge a complaint with the relevant authority if you believe that the collection, use, or disclosure of your personal data violates applicable laws.
9. Right to Access and Obtain Information on Data Source You have the right to access or obtain a copy of your personal data and to request disclosure of how your personal data was obtained.

The Company will process your requests through designated channels such as branches, website, email, or telephone. However, the Company reserves the right to refuse your request if permitted by law or regulation. The Company may charge reasonable fees where applicable.

The Company will respond to your request within 30 days from the date all required documents are duly received.

If unavoidable circumstances require more than 30 days to consider your request, the Company will inform you of the reason for the delay without undue delay. If the Company refuses your request, it will notify you of the decision and the reasons. You may contact the Company if you have questions about the refusal.

If you believe that the Company has handled your rights incorrectly or has violated or failed to comply with the PDPA or subordinate regulations issued under it, you may lodge a complaint with the Office of the Personal Data Protection Committee or a competent expert committee.

9. Changes to the Personal Data Protection Notice

     The Company reserves the right to amend, revise, or update this Notice as permitted by law to reflect changes in legal requirements, services, operations, or feedback from data subjects. The Company will notify you of any changes through the Company’s website. If the changes are material, the Company will notify you prior to their implementation.

10. Contacting for inquiries or exercising your rights

If you have any suggestions or inquiries regarding the collection, use, or disclosure of personal data, or wish to exercise your rights under this Notice, you may contact the Company and/or the Data Protection Officer (DPO) through the following channels:

1. Customer Service Center: 02-483-8888
2. Data Protection Officer (DPO) Email: DPO@muangthaicap.com
3. Contact Head Office : Muangthai Capital Public Company Limited.

                                  332/1 Jaransanitwong Road, Bangplad Sub-district,

                                  Bangplad District, Bangkok 10700