Privacy Notice

(Effective from 1 June 2022 onwards)

About Us

SREIT Management Company Limited (“the Company”) as the REIT Manager of S Prime Growth Leasehold Real Estate Investment Trust (SPRIME). The Company greatly value the importance of protection of your personal data and treat it with utmost respect. Therefore, the Company has a security system to protect your personal data as well as international standards procedure to prevent unauthorized access, disclosure, use, or alteration of personal data.

The Company reserves the right to amend this privacy notice at any time. The said amendment will be posted on the Company’s website

In this Privacy Notice:

“Personal Data” means any information relating to a person, which enables the identification of such person, whether directly or indirectly, but not including the data of the deceased persons or anonymized data.

“Cookies” means small text file consisting of parts of data from a download activity that may be stored in a web browser you use to access. Cookies data may be saved on your computer device or any communication tools that you use to access the web browser while you visit the Company’s website.

“SPRIME” means S Prime Growth Leasehold Real Estate Investment Trust (SPRIME)

“Major Company’s shareholder”means any person that holds shares exceeding 10% upward. At the present, Major Company’s shareholder is Singha Estate Public Company Limited holding 99.99 % of total paid-up shares

“Company's business partner” means any other persons beyond Major Company’s shareholder that are incorporated with agreement or joint venture for business achievement and/or improvement the corporate’s image together with the Company.

Personal Data the Company Collects from You

The Company will collect your personal data as necessary for lawful purposes. The Company may receive personal data through both direct and indirect means such as electronic channels, physical documents, inquiries, government agencies, the Company’s business partners, and/or other service providers such as Facebook, Instagram, Line, etc.

The Company may collect your personal data such as;

• Personal data and your interest such as name, surname, gender, age, nationality, date of birth, marital status, address, occupation, work place, postal code, email address, telephone number, national ID number, passport number, credit card number, bank account number, monthly income, payment data, vehicle information, purchase history, interest, liking, budget, purchase reasons, survey feedbacks, preference of products and services, hobby such as sport, travel, etc;
• Identifiable image data such as pictures and videos of you and/or your belongings that the Company may collect from CCTV cameras and cameras when there is access to office building, retail space, areas under the Company’s responsibility, during events, meetings, or any seminars;
• Sensitive data such as race, religion, health information, etc. In the event that the Company has accidentally received it and has no intention to collect such data, the Company will not use your sensitive data;
• Technical data such as website usage and searching behaviors. The Company may use Cookie as a tool to collect IP address, the type of web browser used to access website, visit duration, websites that refer to the Company's website, and your location data during website access, etc;
• Marketing and communication data such as your preferences in receiving marketing material, including contact information, and voice recording when you communicate with Call Center or through other social media channels, etc.

The Company collect, use, and disclose aggregated data such as statistical and demographic information. The aggregated data may derive from your personal data; however, such data is not considered as a personal data since it cannot be used to identify a specific individual. For example, the Company may use some of your data after the process of anonymization to create statistical information of people who access the website or to create other statistic data.

The Company is fully aware that the data used must not be able to revert to identifiable data. If the data is then able to be used to identify a specific individual, it will be considered as personal data and will be treated in accordance with this Privacy Notice.

The Company’s website may lead you to a third-party website via a link; such action may allow other websites to collect, use, or disclose your personal data without the Company’s involvement. These services and websites may operate independently from the Company and may have their own privacy notices and policies. The Company cannot be held accountable for any collection, use, or disclosure of personal data occurred on other websites. Hence, it is encouraged that you read the privacy notices of every website you have visited.

Purposes of Personal Data Collection, Use, or Disclosure

In order to conduct business operations, activities and/or transactions according to your request and/or to achieve the Company's objectives and/or SPRIME, the Company may collect, use and disclose your personal data, including but not limited to; the following objectives;

• To carry out the contract or to process your request prior to entering into the contract; whether it is for procurement inspection of product or service quality, service provider performance evaluation, or any other relevant procedures. If you do not provide your personal data, the Company may not be able to proceed with your request as notified or there may be other legal effects;
• To comply with the law; the Company may process your personal data to comply with the law regulating company business such as Securities and Exchange laws and Trust laws, rules, regulations and/or other relevant laws in the present and amendment including compliance with the laws governing transactions related to the REIT and other laws stipulating or requiring the Company to submit data or report;
• To carry out the contract with the parties that the Company and/or SPRIME procure or use the services;
• To serve public interest or carry out tasks assigned to the Company by government agencies;
• To carry out the Company’s legitimate interests such as maintain relationship with you, enhance the Company’s business operation standard, and prevent illegal activities, etc;
• To develop marketing plans, conduct data analysis, assess service, improve and develop product or service of the Company as the REIT Manager, and enhance the efficiency of the website;
• To provide security and prevent illegal actions in the office building, retail areas, or areas under the Company’s responsibility including SPRIME’s Assets, using data from CCTV cameras when there is access of such locations;
• To achieve the Company’s internal objectives and/or SPRIME’s internal objectives or to conduct public relations for external audience through both media publications and the Company’s social media channels. This activity includes the Company’s collection of picture or video from events, meetings, or any seminars held by the Company and/or SPRIME. Nonetheless, the said data will not be used for commercial purposes;
• In the event that the Company receives your explicit consent, the Company will only use your personal data for purposes you have given consent to;
• In the event that the Company collects minor personal data, the Company will only process in accordance with the purposes data subject has provided it for and such data will not be used for any other or marketing purpose;
• If the Company wishes to process sensitive data, the Company has to acquire your explicit consent before or during the collection of such data;
• To make a relation with customers and the unitholders such as complaint management informing the benefits without marketing purposes to customers, etc.

Cross Boarder Transfer of Personal Data

Your personal data may be transferred to third party or servers which located internationally. The destination country may or may not have equal data protection standard as Thailand; however, the Company will ensure before transfer that the personal data is protected with equal and appropriate security measures in accordance with personal data protection legal requirements and standard of Thailand. Cross boarder transfer of personal data will be in accordance with lawful basis such as contractual basis, legitimate interest, public tasks, and as you have given your consent for.

Use of Cookies

The Company utilize cookies to improve your browsing experience and enhance your satisfaction. Cookies will allow the Company to understand the website usage and make the website more accessible and convenient. Furthermore, cookies data will be used to develop the Company’s website to be more suitable to your needs. Hence, the company may need to use cookies for statistical analysis, as well as linking data and process it according to marketing objectives.

Categories of Cookies

The Company uses various categories of cookies, divided by the following objectives;

• Necessary cookies, this type of cookies is crucial for the functionality of the website, allowing you to access all contents and fully utilize the Company’s website;
• Analytical and performance evaluation cookies, this type of cookies allow the company measure performance, through calculating the number of pages you visit, as well as the number and unique characteristics of specific visitor group. This data will be used to analyze behavior patterns of website visitors, and the results will be used to improve the website to meet visitors’ needs and enhance visitor’s usage;
• Functional cookies, this type of cookies is used to remember your options during website usage, to provide convenience when you re-visit the website;
• Advertising cookies, this type of cookies will remember your website access and visit and interest points. This data will be used to develop the website and improve appropriate marketing policy.

Cookies Deletion

You can delete cookies by utilizing the various methods specified by each web browser that you use.

Disclosure of Personal Data

The Company will keep your personal data confidential and does not have policy to sell your personal data to third party. If there is legal necessity to disclose your personal data, the Company will only disclose your personal data to authorized person, as necessary. However, the Company may disclose and transfer personal data to person or parties as listed below;

• To disclose the Stock Exchange of Thailand, Thailand Securities Depository, Registrar, Trustee, representative, agent, custodian, intermediate, third party that are appointed by the Company and it is reasonably necessary to disclose your personal information to achieve the purpose of using the Company's services and/or SPRIME;
• Government authorities or regulatory agencies such as the Office of Securities and Exchange Commission to comply with law or request of authorized departments including tax auditor.
• The Company’s business partners;
• Service providers such as representative companies, partners, contractors, consultants, financial institutions, cloud service providers, marketing companies, and information technology (IT) development companies. Such parties may locate either domestically or internationally and all party is under agreement with the Company.

Rights of Data Subject

You can submit a request to exercise your legal rights provided under "Contact Us.". The Company will then process your request as soon as possible; however, it also depends on the volume and complexity of the request

• You have the right to withdraw your consent and the Company will stop the processing of your personal data as soon as possible;
• You have the right to access and ask for a copy of your personal data, or to request disclosure of the acquisition of personal data obtained without your consent; unless it is when the Company must comply with the law or court order, or the request of access or to receive a copy of your personal data may impact that cause damage to the rights and freedoms of others;
• You have the right to request correction and rectification on your personal data to ensure that the data is correct, up-to-date, complete, and does not cause any misunderstandings;
• You have the right to receive or request the Company to send or transfer your personal data to other data controller, or to directly request the personal data that the Company disclose or transfer to other data controller; unless it is impossible to do so due to the technical circumstances;
• You have the right to request the Company to erase, destroy, or anonymized your personal data, in the event that such personal data is no longer necessary for the purpose in which it is collected for, you have withdrew your consent or object processing of personal data for direct marketing purposes and others, there is unlawful processing, and other scenarios as required by law;
• You have the right to restrict the processing of your personal data and the Company will stop the processing of personal data; however, the personal data shall be stored for the following purposes 1) To establish legal claims or 2) Personal data is under review for correctness or it is in the process of proving higher legitimate ground. Nonetheless, the Company will only store personal data as necessary;
• You have the right to object the collection, use, or disclosure of personal data for direct marketing, research purposes either in the field of science, history, or statistics; unless it is necessary for public interest, higher legitimate ground, establishment of legal claims, legal compliance, exercise of legal rights, or to defend exercise of legal rights;
• You have the right to file a complaint to relevant government agencies, in the event that you believe the Company, the employee or the contractor of the Company violates or does not comply with The Personal Data Protection Act of Thailand.

Marketing Related Activity

If you wish to cancel or request not to receive marketing materials or newsletter from the Company, you can proceed to submit your request through channel provided under “Contact Us.” However, this cancellation will not affect your ability to receive products or services as addressed in the contract.

Security Measures for Personal Data

The Company has taken appropriate measure to ensure physical protection and organizational and technical measurements, to prevent your personal data from loss, misuse, or unauthorized access, disclose, change and deletion.

In the event that the Company assign external party for system development and maintenance, resources allocation, or any other services, the Company may set for confidentiality and/or data processing agreement in accordance with this Privacy Notice to be made; for the benefit of securing your personal data.

The Company has set the process to manage personal data breach incident and will notify you in accordance with the law. Nonetheless, even though there is strict security measure for personal data, there is a security limitation when it comes to transmission of data on the internet. Hence, the Company is unable to guarantee the security of your personal data disclosed on online platform.

Personal Data Retention

The Company will retain your personal data in accordance with the purpose stated in this Privacy Notice as long as necessary, in accordance with the Company Policy and strict legal requirements.

Contact Us

You can request to exercise data subject rights and if you have any question or complaint, you can contact the Company via the following channels;

• SREIT Management Company Limited as the REIT Manager of SPRIME
  123 Sun Towers Building A, 31st Floor, Vibhavadi-Rangsit Road, Chom Phon, Chatuchak, Bangkok 10900
• Phone: +66 (0) 2050 5555
• http://www.sprimegrowth.com > Contact us > IR Contact > Topic : To exercise rights or compliant about personal data
• Email: dpo@sreit.co.th