PRIVACY NOTICE FOR BUSINESS PARTNERS

JFE Steel Galvanizing (Thailand) Ltd. (“Company”) is committed to protecting the privacy and security of Principals' Personal Data of customers and business partners ("Principals").

This Privacy Notice describes how we collect and use Personal Data and how long it is stored, based on the Thai Personal Data Protection Act BE 2562 (2019) and its sub-regulations (“The Data Protection Act.”).

“Personal Data” means any information relating to an individual, which enables the identification of such person, whether directly or indirectly, but not including the information of the deceased persons in particular. Examples of the Personal Data may include full name, passport number, photograph or video image of an individual, mobile telephone number, personal e-mail address, thumbprint, and any combination of data, which may be used to identify an individual.

This Privacy Notice applies to Principals, who provide Personal Data to the Company through business interaction.

Legal basis of processing

As a general rule, the Company will process Personal Data on any of the following legal basis:

・When the Company receives the consent from you to process Personal Data for a specific purpose;

・To perform the contract with Principal;

・To take action at Principal's request before concluding the contract;

・When it is necessary for the legitimate interests of the Company, or individuals or corporations other than the Company;

・When it is required by laws and regulations applicable to the Company;

・To prevent or suppress danger to human life, body or health; or

・When it is necessary for the public interest.

Purpose of processing

The Company collects and processes Principals' Personal Data for the purposes of its business activities including but not limited to business communication, customerrelationmanagement, supplier management, contractor management and payment of bills.

Except when the Personal Data has been processed under the consent basis as the case may be, if Principal fails to provide certain requested information, we may not be able to perform the contract the Company have entered into with Principal (such as providing goods and services), or the Company may be prevented from complying with our legal obligations.

The Company will process the Personal Data of Principal for the above identified, clear and legitimate purposes and will not further process that Personal Data in a way that does not fit these purposes.

If the Company intends to process the collected data for another purpose, the Company will inform Principal about such new purpose and will ensure that there is a valid legal basis for such processing of Personal Data.

 Principals have the right to withdraw their consent to the collection and processing of Personal Data at any time. However, this does not affect the legality of actions based on consent prior to withdrawal.

Sharing of Personal Data

The Company will share Principals' Personal Data with third parties when required by law, when required for performance of a contract between the Company and Principal, when required for an execution of transaction with Principals or a company to which Principals belong, or for other legal basis as permitted by the Data Protection Act.

In addition, the Company may share Principals' Personal Data with the relevant regulatory authority when requested by the regulatory authority or when required by law.

When the Company shares Personal Data with data processors, the company will take proper and legal steps to transfer and processing of data which are in compliance with the Data Protection Act.

If the Company transfers Principals' Personal Data to a third party abroad, the Company ensures that it shall be carried out in accordance with the rules prescribed under the Data Protection Act and will take steps permitted by the Data Protection Act.

Retention period for Personal Data

The Company will retain Principals' Personal Data only for the period necessary for the purposes for which it has been collected, to comply with our legal obligations, to fulfill our contracts with Principals, for the purpose of establishment, compliance or exercise of legal claims or defense of legal claims or other purposes as permitted by the Data Protection Act.

Records on Personal Data processing

Where the Company is the data controller or processor under the Data Protection Act, the Company shall maintain records of the processing of Personal Data as required by the Data Protection Act and its relevant rules.

Security of Personal Data

The Company endeavors to maintain the security of the acquired Personal Data and takes necessary and appropriate security measures to prevent unauthorized or unlawful access, use, alteration, disclosure to Personal Data, leakage, loss, falsification or damage of Personal Data.

If by any chance the Company is aware of any breach of Personal Data, the Company will without delay notify and take action as necessary and as required by the Data Protection Act.

Principals' rights

Principal has the following rights regarding Personal Data collected and processed by the Company.

If Principal wishes to exercise the rights listed below, please refer to the contact information described below.

Principal has the right to file a complaint with the competent authority at any time.

①right to access and obtain Principal's Personal Data.

②right to request for correction or deletion of Principal's Personal Data.

③right to restrict our processing of Principal's Personal Data.

④right to request for transfer of Personal Data the Company has to third parties for utilization.

⑤right to object to our processing of Personal Data.

When the Company receives a request to exercise Principal's rights above, the Company will fulfill the request without delay provided that the request is carried out in accordance with the Data Protection Act. If there is a legitimate reason for the Company to reject such request as permitted by law, the Company will inform Principal on rejection and record such rejection of request together with reasons of rejection.

Contact

The Company will respond to all legitimate inquiries regarding the processing of Personal Data.

If Principal wants to make any inquiry regarding this Privacy Notice or the processing of Principal's Personal Data, please contact below.

Address : 500/94 Moo 3, T. Ta Sit, A. Pluak Dang, Rayong, Thailand 21140

Telephone: 033-010-715 to 7 ext. 171

Mail : [email protected]

Addressee : Mr. Prasert Boonkong Deputy General Manager, Administration Department

Privacy Management Manager