Privacy Notice

The ttb Financial Group, comprising TMBThanachart Bank Public Company Limited, Phahonyothin Asset Management Company Limited, TMBThanachart Broker Company Limited, ttb Consumer Company Limited, ttb Wealth Securities Public Company Limited, ttb Leasing Company Limited, and any other companies that may be incorporated in the future (each a "Company" and collectively the "ttb Group"), recognizes the importance of protecting Personal Data.

Each Company acts as an independent Data Controller in relation to the collection, use, and disclosure of Personal Data associated with its own products, services, and business activities, unless otherwise expressly stated.

References to the "ttb Group" in this Privacy Policy are made solely for convenience of reference and explanatory purposes. Such references shall not affect the status of any relevant Company as the Data Controller responsible for the processing of Personal Data under its responsibility.

The ttb Group is committed to protecting your Personal Data, whether you are a customer, a related person, an employee, a job applicant, a service provider, or any other individual who has a relationship with a Company within the ttb Group.

The ttb Group has implemented appropriate technical, organizational, and security measures to safeguard Personal Data against unauthorized access, use, alteration, disclosure, loss, destruction, or any other unlawful or unauthorized processing, in accordance with the Personal Data Protection Act B.E. 2562 (2019) and other applicable laws.

1. Data Subjects Covered by this Privacy Policy

This Privacy Policy provides important information regarding the processing of Personal Data relating to the following categories of Data Subjects:

If you are involved in or related to the Company's human resources management activities, such as being an employee, job applicant, or an individual related to employment matters, please refer to the Human Resources Privacy Notice described in Section 7 of this Privacy Policy.

Where the Company is required to collect your Personal Data for the purposes of entering into or performing a contract, or for compliance with applicable laws, your failure to provide such Personal Data, or the provision of inaccurate, incomplete, or outdated Personal Data, may affect the Company's ability to provide services, conduct relevant transactions, or comply with legal obligations.

For example, if you do not provide the Personal Data required for account opening, the Company may be unable to open an account for you as requested.

2. Personal Data Collected by the Company

"Personal Data" means any information relating to an identified or identifiable natural person, whether directly or indirectly identifiable (excluding data relating to deceased persons). This includes Personal Data obtained directly from you or from other lawful sources, such as government agencies, credit information companies, business partners, service providers, or publicly available sources permitted by law.

Sensitive Personal Data means Personal Data that is inherently private in nature. The Company does not intend to collect Sensitive Personal Data from you unless it is necessary for the provision of products or services to you, or where otherwise permitted or required by applicable law.

The Company may collect various categories of Personal Data depending on the nature of its relationship with you, the purposes for which the Personal Data is processed, and the products or services that you use.
The categories of Personal Data that may be collected include, but are not limited to, the following:

The Company will collect, use, and disclose such Personal Data only as necessary and for the purposes specified in this Privacy Policy.

3. Sources of Personal Data

The Company may obtain Personal Data from various sources, including the following:

1. Directly from the Data Subject, such as when you provide information through product or service application forms, job application forms, or through communications via various channels, including websites, applications, or social media platforms.
2. From sources other than the Data Subject, such as government agencies, lawful data sources, publicly available sources, individuals associated with the Data Subject, companies within the ttb Group, business partners, and commercial counterparties, where there is an appropriate legal basis for the disclosure of such Personal Data.
3. Where the Company has not collected Personal Data directly from the Data Subject, the Company will provide the Data Subject with information regarding the processing of Personal Data within the period prescribed by applicable law, unless the Company is exempt from such requirement under applicable law.

4. Purposes and Legal Bases for Processing Personal Data

The Company will collect, use, or disclose your Personal Data under an applicable legal basis and only to the extent necessary for the purposes set out in this Privacy Policy or as otherwise notified to you at the time of collection.

The legal bases on which the Company may rely include contractual necessity, compliance with legal obligations, legitimate interests, consent, and any other legal basis permitted under applicable law.

4.1 Purposes for Customers and Individuals Related to Customers

4.2 Purposes for Vendors, Suppliers, Business Partners, and Individuals Related to Them

4.3 Purposes for Other Individuals Contacting or Interacting with the Company, such as Shareholders, Visitors, and Event Participants

Use of Advanced Technologies

In order to achieve the purposes described in Sections 4.1, 4.2, and 4.3, the Company currently uses, or may in the future use, advanced technologies and innovations in connection with the collection, use, and disclosure of your Personal Data.

Such technologies may include, without limitation:

• Analytical Artificial Intelligence (Analytical AI);
• Generative Artificial Intelligence (Generative AI);
• Big Data Analytics technologies;
• Fraud Detection systems; and
• Electronic identification and verification technologies.

5. Disclosure of Personal Data and Data Recipients

The Company will not disclose your personal data to any third party unless there is a lawful basis for such disclosure or your consent has been obtained. Any disclosure of personal data will be limited to what is necessary for the purposes specified in this Privacy Notice and as communicated to you. Your personal data may be disclosed to the following recipients:

6. Cookie Policy and Similar Technologies

The Company uses cookies and similar technologies ("Cookies") to enable its websites and applications to operate effectively, enhance the performance of its services, analyze website and application usage, and improve your user experience.

Further details regarding the types of Cookies used, the purposes for which they are used, and the applicable retention periods can be found in the Cookie Notice https://www.ttbbank.com/en/policy/cookie-notice

In accordance with applicable laws, the Company will obtain your consent before placing or using any non-essential Cookies. You may give, withdraw, or change your consent preferences at any time through the Cookie Banner or Cookie Settings available on the website, or by accessing the Cookie Notice https://www.ttbbank.com/en/policy/cookie-notice

7. Privacy Notice for Human Resources Management

The Company maintains a Privacy Notice for Human Resources Management (HR Privacy Notice), which provides information regarding the collection, use, and disclosure of personal data, together with the rights of data subjects, for individuals associated with human resources management, including directors, management personnel, employees, job applicants, interns, former employees, and other related persons.

The applicable Human Resources Privacy Notice for each company within the Group is available as follows:

• TMBThanachart Bank Public Company Limited: Privacy Notice for Human Resources Management
• TMBThanachart Broker Company Limited: Privacy Notice for Human Resources Management
• Phahonyothin Asset Management Company Limited: Privacy Notice for Human Resources Management
• TTB Consumer Company Limited: Privacy Notice for Human Resources Management
• TTB Wealth Securities Public Company Limited: Privacy Notice for Human Resources Management
• TTB Leasing Company Limited: Privacy Notice for Human Resources Management

8. Personal Data Protection Measures

The Company has established policies, guidelines, and minimum standards for the management of personal data and has implemented appropriate security measures as required by applicable laws. Such measures include administrative safeguards, technical safeguards, and physical safeguards to prevent the loss of unauthorized access to, use of, alteration of, or disclosure of personal data.

The Company requires its employees, personnel, and external service providers to maintain the confidentiality of personal data, process personal data in accordance with the Company's instructions, and implement appropriate security measures as required by applicable laws.

In addition, the Company has established measures and procedures for managing personal data breach incidents, including notifying the relevant supervisory authorities and data subjects within the timeframes and under the conditions prescribed by applicable laws.

The Company will periodically review and update such measures to ensure compliance with applicable laws and to address relevant risks.

9. Cross-Border Transfer of Personal Data

The Company may need to transfer or transmit your personal data to recipients located in foreign countries as part of its business operations. Such transfers may occur, for example, in connection with the use of information technology systems that store data on cloud platforms or servers located overseas, the execution of international financial transactions, the use of payment service providers, business partners, social media service providers, or foreign governmental authorities.

Such transfers may be made to service providers, data processors, or companies within the TTB Group located outside Thailand. In connection with any cross-border transfer of personal data, the relevant company acting as the data controller will ensure that such transfer is carried out in accordance with the requirements and conditions prescribed by applicable laws, including, where appropriate, the following measures:

• Where the destination country or international organization has an adequate standard of personal data protection as prescribed by applicable law, the Company will carry out the transfer in accordance with such legal requirements.
• Where the destination country or international organization has a lower standard of personal data protection than that required under applicable law, the Company will implement appropriate safeguards, such as entering into a Data Transfer Agreement or adopting other measures as required by law, to ensure that your personal data receives a level of protection equivalent to that provided under Thai law.
• Where an exemption for cross-border transfers applies under applicable law, the Company may transfer personal data in accordance with the applicable legal exemption.
  In all cases, the Company will transfer personal data only to the extent necessary for the specified purposes and will implement appropriate safeguards to protect personal data and the rights of data subjects as required by applicable law.

10. Rights of Data Subjects

Subject to applicable laws, you, as a data subject, have the right to request that the Company take the following actions with respect to your personal data:

• Right to Withdraw Consent
  You have the right to withdraw any consent previously given to the Company at any time, unless such withdrawal is restricted by law or contractual obligations.

The withdrawal of consent shall not affect the lawfulness of any processing carried out prior to such withdrawal. However, withdrawing consent may result in your inability to receive certain services, such as marketing communications and promotional information.

• Right to Object to the Processing of Personal Data
  You have the right to object to the processing of your personal data where the Company relies on its legitimate interests as the legal basis for processing or where your personal data is processed for direct marketing purposes.
• Right to Lodge a Complaint
  You have the right to lodge a complaint with the competent authority if you believe that the collection, use, or disclosure of your personal data is not in compliance with applicable laws.
• Right to Rectification
  You have the right to request that the Company rectify your personal data to ensure that it is accurate, complete, and up to date, and to prevent any misunderstanding arising from inaccurate or incomplete information.
• Right of Access
  You have the right to access and obtain a copy of your personal data, as well as to request disclosure of the source from which the Company obtained such personal data where you did not provide the data directly to the Company, except where otherwise restricted by law or where such disclosure may adversely affect the rights and freedoms of other persons.

The Company may charge a reasonable fee permitted by law, if you are informed in advance. Any such request will be processed in accordance with the conditions, procedures, and timeframes prescribed by applicable laws.

• Right to Data Portability
  You have the right to receive your personal data in a structured, commonly used, and machine-readable format and, where technically feasible, request that the Company transmit or transfer such data to another data controller.
• Right to be forgotten
  You have the right to request that your personal data be erased, destroyed, or anonymized where the data is no longer necessary for the purposes for which it was collected, has been unlawfully collected or processed, or where otherwise required or permitted by applicable law.
• Right to Restriction of Processing
  You have the right to request the restriction of the processing of your personal data while the accuracy of the data is being verified or in other circumstances prescribed by applicable law.

If you are below the age required by applicable law or are otherwise unable to exercise your rights on your own behalf, your lawful representative may exercise such rights on your behalf.

The Company may refuse your request to exercise certain rights were permitted or required by law, where the request may adversely affect the rights and freedoms of others, or where compliance with the request is not possible due to legal or technical limitations. In such cases, the Company will inform you of the reasons for its decision.

11. Retention of Personal Data

The Company will retain your personal data only for as long as necessary to achieve the purposes for which the personal data is processed or for such longer period as may be required or permitted by applicable laws. Retention periods may vary depending on the nature of the personal data, the purposes of processing, and applicable legal and regulatory requirements, including statutory limitation periods and requirements imposed by supervisory authorities.

For example, the Company may retain personal data relating to financial transactions for a period of up to ten (10) years following the termination of the relevant relationship, as applicable.

Upon expiry of the applicable retention period, the Company will delete, destroy, or anonymize the relevant personal data in accordance with its internal policies, procedures, and standards.

The Company has established policies, guidelines, and standards for data retention and disposal and has implemented appropriate security measures to safeguard personal data in compliance with applicable laws.

12. Use of Personal Data for the Original Purpose of Collection

The Company may collect, use, or disclose your personal data obtained prior to the effective date of the applicable personal data protection legislation, provided that such processing is carried out solely for the original purposes for which the personal data was collected and pursuant to the relevant legal basis.

Where the Company intends to process such personal data for a purpose other than the original purpose of collection, the Company will proceed in accordance with the requirements of applicable law and, where necessary, obtain your consent prior to such processing.

If you do not wish the Company to continue processing your personal data, you may exercise your right to withdraw consent through the channels specified in Section 13 of this Privacy Notice.

Please note that the withdrawal of consent may result in the Company being unable to provide certain products, services, or related benefits to you.

13. Channels for Exercising Data Subject Rights

You may submit a request to exercise your rights as a data subject through the channels designated below. Upon receipt of your request, it will be forwarded to the relevant company for processing in accordance with the applicable legal requirements, conditions, and prescribed timeframes.

Note:
1. The channels listed above are centralized channels for the receipt of data subject rights requests. Requests submitted through these channels will be forwarded to the relevant company within the TTB Group that acts as the data controller responsible for the relevant personal data for further consideration and action.
2. The exercise of certain data subject rights may require the completion of a prescribed request form and the submission of identification documents or other supporting evidence as required by the relevant company. The company will respond to and process such requests within the period prescribed by applicable law, commencing from the date on which all information and documentation necessary for consideration have been duly received. Where the company is unable to comply with a request, it will provide the data subject with the reasons for such decision.

14. Personal Data Breach Management

The Company recognizes the importance of protecting personal data and has established appropriate measures and procedures for the prevention, detection, management, and response to personal data breach incidents.

In the event of a personal data breach, the Company will promptly assess the incident and take appropriate measures to contain and mitigate its impact. Where the breach is likely to result in a risk to the rights and freedoms of data subjects, the Company will notify the Office of the Personal Data Protection Committee (PDPC Office) within seventy-two (72) hours of becoming aware of the breach.

Where the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, the Company will notify the affected data subjects without undue delay and provide information regarding the corrective actions and measures available to mitigate the potential adverse effects arising from the breach.

The Company will periodically review and update its information security and personal data protection measures to ensure continued compliance with applicable laws and alignment with relevant risks.

15. Contact Details of the Data Protection Officer (DPO)

The Company has appointed a Data Protection Officer (DPO) to oversee the processing of personal data and to serve as the central point of contact and coordination on behalf of the Company.

You may contact the DPO for further information or to exercise your rights relating to personal data through the following channels:

The Company may review and update this Privacy Notice from time to time to ensure compliance with applicable laws, regulations, and notifications issued by the relevant authorities. The latest version of this Privacy Notice will be made available on the Company's website at https://www.ttbbank.com/en/policy/privacy or through other appropriate communication channels.

Version: October 2026