EVOLUTION WELLNESS (THAILAND) COMPANY LIMITED (“the Company”) has installed CCTV inside and around the compound area to secure the property, as well as to protect the directors, executives, business partners, employees, clients, and other Individuals who enter into contact with the Company (hereby refers as “You”). The Company realizes the importance of this procedure as well as its responsibility under the Personal Data Protection Act B.E. 2562. The Company respects individuals’ rights to privacy in regard to CCTV and is committed to protecting your security and privacy and ensuring that your personal data will be protected as required by Personal Data Protection law and other relevant laws. Therefore, the Company has prepared this Privacy Notice regarding the use of CCTV to provide information about the collection, use or disclosure of Personal Data including your various rights.

Purposes for Collecting Personal Data
     The Company collects Personal Data for the following purposes:

1. to protect your health, safety and your belongings.
2. to protect Company buildings, facilities, and property from damage, obstruction, destruction or other crimes.
3. to support law enforcement agencies in deterring, preventing, detecting, and taking legal action.
4. to assist in dispute resolution, or processes that occur during disciplinary or complaint proceedings.
5. to assist in the investigation process or the process of filing complaints.
6. to assist in the process of initiating or preventing civil litigation including, legal proceedings including but not limited to the process related to employment.

2. Lawful Basis for Processing Personal Data
     The Company collects your Personal Data under the following lawful basis:

1. For the Legitimate Interest of the Company under your reasonable expectation that does not violate any fundamental rights or freedoms.
2. Legal Obligation to perform duties as required by law, such as criminal, civil procedure law, criminal procedure law, etc.

3. Personal Data Collected by The Company
     The company has installed CCTV in clearly visible locations where surveillance is deemed necessary. There are appropriate warning signs indicating the use of CCTV at entrance and exit areas. The Company will collect your Personal Data as belows

• Photographs
• Video clips
• Audio clips
• Photos of your assets such as vehicles, jewelry, bags, hats, apparel, etc.

However, the Company will not install CCTV in areas that may unduly infringe upon fundamental rights, such as bathrooms, showers, or rest areas for workers.

4. Disclosure of Personal Data
     The Company will keep CCTV data confidential and will not disclose it unless it is necessary for the Company to achieve the surveillance objectives set forth in this Privacy Notice. The Company may disclose information on CCTV to the following persons or entities.

1. Relevant internal departments or personnel that have related duties for specific purposes. These personnel or departments will be allowed to access Personal Data only as necessary and appropriate.
2. Law enforcement agencies that assist and support investigations, inquiries and/or litigations.

5. How the Company Protects Personal Data
     The Company prioritizes the security of Personal Data such as encryption and restriction of access to Personal Data to ensure that our personnel and any third parties acting on our behalf have complied with appropriate Personal Data protection standards. This includes the responsibility to prevent data leakage. The Company takes appropriate security measures for the processing of Personal Data.
     The Company keeps Personal Data discreetly in accordance with technical and organizational measures to secure proper processing and to prevent Personal Data breaches. The Company has established policies, rules, and regulations for Personal Data Protection. These include measures to prevent the recipients of Personal Data from the Company from using or disclosing data exceeding the authorized purpose and prevent unauthorized or wrongful use of the data. In addition, the Company's executives, employees, contractors, representatives, consultants, and recipients of Personal Data from the Company are obliged to maintain the confidentiality of Personal Data in accordance with the confidentiality measures determined by the Company
     The Company periodically review, updates Personal Data Protection procedures and measures regulations. This allows the Company to maintain appropriate levels of security and ensure the continued confidentiality, integrity and availability of Personal Data. Such updates also insure continued protection against data loss as well as unauthorized collection, access, use, or modification. The Company applies these various measures to maintain the security of Personal Data whether in electronic or document format.

6. Retention Periods of Personal Data
     In order to achieve the objectives of surveillance in using CCTV as specified in this Privacy Notice, the Company will retain your Personal Data for the required period in compliance with applicable laws, except in the cases that the Company may retain your personal data for a longer period, such as in the event where court proceedings are in progress, legal claims are being exercised, or disciplinary action is being taken. In the event that the Company is not required to keep such data for these purposes, the Company will subsequently delete and destroy this data.
     In order to achieve the objectives of CCTV Surveillance as Specified in this Privacy Notice, the Company will retain CCTV Surveillance Data for 30 days. This period will commence on the date of recording. The Company will delete and destroy the relevant CCTV Surveillance Personal Data after the expiration of the said period.
     (According to Section 26 of The Computer Crime Act B.E. 2550, it is required to maintain computer traffic data (log files) for not less than ninety days from the date the data was entered into the computer system.)

7. Your Rights Under Personal Data
Protection Act B.E. 2562
     The Personal Data Protection Act B.E. 2562 aims to put Personal Data more under the Individual person’s control. In this regard, Individuals can exercise their rights when the provision relating to Data Subject’s rights comes into force. The Data Subjects have the following rights.
     • Right to withdraw consent
     You are entitled to withdraw the consent previously given to the Company to collect, use and disclose your Personal Data (whether such consent has been given prior to or after the Personal Data Protection Law was enacted). You may withdraw consent at any time when it is being held by the Company unless there is a rights restriction by law or valid contract.
     However, be informed that withdrawing consent may affect in using of products and/or services such as you will be unable to receive benefits, new promotions or offers, unable to receive better products or services that suit to your preferences or unable to receive useful information, etc. It is therefore advised to inquire about the impact before taking this step.
     • Right to access of Personal Data
     You are entitled to have access to your Personal Data and to request the Company to provide copies of these documents and also have the right to request to reveal how your Personal Data was obtained. However, the Company is entitled to reject such a request based on applicable laws or court orders, or if such a request will adversely affect the rights and freedoms of other individuals.
     • Right to Data portability
     You are entitled to have the right to obtain your Personal Data which has been processed by the Company in a format that is readable or useable with an automated device and can be used or disclosed via automated means. You also have the right to request the Company to transfer your personal data in such format to another Data Controller if it can be processed via the automated means and to request Personal Data of said format which is directly sent or transferred by the Company to other data controllers unless it cannot be processed due to technical difficulties.
     However, the above Personal Data must be Personal Data that you have given consent to the company for collecting, using and/or disclosing or Personal Data that the Company is required to collect, use and/ or disclose in order to use products or services according your wishes that you are a party to the contract with the company or to comply with your request prior the usage of the Company’s products or services or Personal Data as determined by competent authorities.
     • Right to object
     You are entitled to lodge an objection to the collection, use or disclosure of your Personal Data at any time. However, if this collection, use, or disclosure is undertaken for the legitimate interests of the Company or other persons or entities under your reasonable expectation, or for public interest. If you have lodged an objection, the Company shall continue to collect, use and/or disclose this Personal Data. In this case, the Company must provide compelling and legitimate grounds for such collection, use and/or disclosure that are more important than your fundamental rights or to verify the right according to the law, to comply in accordance with applicable laws or for the litigations as the case may be.
     In addition, you are entitled to lodge an objection to the collection, use and/or disclosure of your Personal Data if it was collected/used/disclosed for direct marketing purposes or for the purpose of scientific, historical or statistical studies and research.
     • Right to erasure
     You are entitled to request the Company to delete or destroy your Personal Data or make it anonymous if you believe that it has been collected, used and/or disclosed illegitimately and is not in compliance with applicable laws or contend that it is no longer necessary for the Company to keep such data according to the objectives of this Privacy Notice or when you have withdrawn consent or lodged an objection. This would apply unless the Company is obliged to collect this Personal Data for the purpose of compliance with the law or establish a legal claim related to the retention of such data.
     • Right to restriction
     You are entitled to request the Company to restrict or suspend the use of your Personal Data if the Company is conducting an investigation per your request. This also applies in cases where it is no longer necessary for the Company to keep this Personal Data and must delete or destroy your Personal Data in accordance with applicable laws but you request for the restriction instead.
     • Right to rectification
     You are entitled to correct your Personal Data to keep it accurate, up-to-date, complete and not misleading.
     • Right to file a complaint
     You are entitled to file a complaint to relevant authorities if you believe that the collection, use and disclosure of your Personal Data violates applicable laws.
     If you have concerns or inquiries about the Company's policies related to your personal data, please contact the Company by using the contact details in Clause 9 of this CCTV Privacy Notice. If there is a reason to believe that the Company has violated data protection laws, you have the right to file a complaint with the proper legal authorities or authorities appointed by the Personal Data Protection Committee.
     If the Data Subject submits a request to exercise the rights under the Personal Data Protection Law, the Company will proceed with such request within the period specified by law. In addition, the Company reserves the right to refuse or not act upon such request if it is not required by law.
     The Company has all rights and sole discretion to accept and process your request or to reject it. Exercising the rights may be restricted by applicable laws, and, in certain cases, there may be compelling reasons for the Company to deny your request or that prevent the Company from complying with your request. These may include compliance with laws, court orders, for the purpose of public benefit or, potentially violate another person’s rights or freedoms. If a request is denied, the Company shall provide the reason(s) for such denial.

8. Changes to CCTV Privacy Notice
     The Company will review this CCTV Privacy Notice for Individuals regularly to be in line with related procedures, laws, and regulations. The Company shall keep Individuals informed of important changes, or revisions of this CCTV Privacy Notice. Individuals are encouraged to periodically check for updates to this Privacy Notice at the Company website.

9. Contacts
     If you believe that the processing of your Personal Data is not in compliance with the laws of the Personal Data Protection Act B.E. 2562, you are entitled to complain to the Data Protection Officer as below.