Privacy Notice for Token Holder and Employees
Real Estate Exponential Company Limited

Real Estate Exponential Company Limited (the “Company”) places great emphasis on rights to privacy and protecting personal data of the Token Holder and Employees (“You”, “you”, “Your”, or “your”). The Company has, therefore, established this privacy notice (the “Notice”) for the purpose of informing you of the details of collection, use, and disclosure of your personal data, the Company’s personal data protection practices, as well as your rights as data subject, in order for you to be ensured that your personal data is protected in accordance with Personal Data Protection Act B.E. 2562.

Regardless, the Company kindly advised you to thoroughly read and understand about the provisions of this Notice; details are as follows:

1. Definition

The terms available under this Notice have the following definition:

“Personal Data Protection Law” means Personal Data Protection Act B.E. 2562 and any amendments, including other relevant subordinate law and any future amendment.

“Personal Data” means any information relating to natural person, which enables the identification of such Person, but not including the notification of the deceased person in particular.

“Sensitive Personal Data” means Personal Data relating to race, ethnic origin, political opinion, cult, religious, or philosophical belief, sexual behavior, criminal record, health data, disability, trade union information, genetic data, Biometric Data or any other data which may impact the Data Subject in a similar manner, as prescribed by the Personal Data Protection Committee.

“Biometric Data” means Personal Data derived from the use of techniques or technologies related to physical or behavioral characteristics of a person, enabling the verification of that person's identity as distinct from others, such as facial recognition data, iris scan data, or fingerprint data.

“Data Subject” means a natural person who has been identified by the Personal Data, whether directly or indirectly.

“Data Controller” means a natural person or a juristic person having the power and duties to make decisions regarding processing of the Personal Data.

“Data Processor” means a natural person or a juristic person who operates in relation to the processing of the Personal Data pursuant to the orders given by or on behalf of a Data Controller, whereby such natural person or juristic person is not the Data Controller.

“Process”, “process”, “Processing” or “processing” means any operation done to Personal Data, whether by automated means or not, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure (by transmission, transfer, dissemination or making available by any means), alignment or combination, blocking or restriction, erasure or destruction.

2. Personal Data that the Company collected

The Company collects your Personal Data to the degree necessary and relevant for achieving the purpose of Personal Data Processing as specified in this Notice; whereby, the Personal Data that the Company collected are as follows:

2.1 Identifiable Information, such as title, first name, last name, signature, photograph, national identification number, taxpayer identification number, etc.

2.2 Contact Information, such as current address, address as stated in official documents, telephone number, email address, social media contact channels, etc.

2.3 Financial, Benefits, and Compensation Information, such as salary, bank account, bank account number etc.

2.4 Legal Documentation and Supporting Documents, such as copies of national identification card, copies of passport etc.

Generally, the Company does not intend to process Sensitive Personal Data appearing on copies of identification cards or other documents you submit to the Company, such as religious belief or blood type. We kindly request that you redact such Sensitive Personal Data yourself. Regardless, if you do not redact the Sensitive Personal Data, the Company will deem that you have authorized us to redact it on your behalf. Any document you submit to the Company with Sensitive Personal Data already redacted will be considered complete and legally enforceable. If the Company is unable to redact such Sensitive Personal Data due to technical limitations or other issues, the Company will process the Sensitive Personal Data solely for identity verification purposes.

3. Source of Personal Data

In general, the Company will collect your Personal Data directly from you, which may be in the form of hard copy, or soft copy. Regardless, the Company may process your Personal Data which is not obtained directly from you in some cases. The detail of source of Personal Data are as follows:

3.1 Personal Data that you directly disclose to the Company, such as filling out information in the Company’s form, submitting any relevant document that has your Personal Data, whether through hard copy or soft copy, replying to questionnaire or satisfaction survey responses, communication with the Company through any other means.

3.2 Personal Data that the Company automatically processes, whereas the Company may collect your Personal Data automatically through usage of information technology systems, such as cookie, IP Address, computer traffic data (log).

2.3 Personal Data from other sources, whereas the Company may receive personal data from third parties, other data controllers, or data processors outside of the Company, where such sources have the authority to process your personal data and disclose your personal data to the Company, such as receiving data from organizations that serve as intermediary platforms for Token trading, among others.

4. Personal Data of Minor, Incompetent Person, or Quasi-Incompetent Person

In the event that the Company has necessity to process Personal Data of Minor, Incompetent Person, or Quasi-Incompetent Person (collectively referred to as “Limited Capacity Person”) and such processing required consent and could not rely on other lawful basis for Personal Data Processing, the Company will not process such Personal Data, unless the Company has obtained consent from the Legal Representative, Guardian, or Curator, as the case maybe.

In the event that the Company has processed the Personal Data of Limited Capacity Person, and the company acknowledged later of the status of Limited Capacity Person, the Company will promptly erase or destroy such Personal Data, unless the Company can rely on other lawful basis for processing of such Personal Data without having to obtain consent.

5. Personal Data of the Third Person

In the event that you disclose Personal Data of the third person to the Company, you have the obligations to inform such person of details of Personal Data Processing under this Notice, and obtain consent in case that such Personal Data Processing required consent and could not rely on other lawful basis, together with certify the accuracy of such Personal Data.

6. Lawful Basis for Processing Personal Data

In processing Personal Data, the Company will limit the Processing of your Personal Data to the extent that it is adequate, relevant, and sufficient for achieving the purpose of Personal Data Processing as specified in this Notice. In general, the Company will explicitly request your consent prior to or during Personal Data Processing, unless in the following circumstances which the Company can process your Personal Data without obtaining consent:

6.1 necessary for the performance of a contract to which you are a party, or in order to take steps at the request by you prior to entering into a contract;

6.2 necessary for legitimate interests of the Company or any other natural persons or juristic persons other than the Company, except where such interests are overridden by the fundamental rights of the Data Subject of his or her Personal Data;

6.3 necessary for compliance with a law to which the Company is subjected.

In case that the Company's processing of Personal Data is for the performance of a contract or in order to take steps prior to entering into a contract, or for compliance with a law, if you do not disclose your Personal Data to the Company, it may result in the Company being unable to fulfill its legal obligation, or unable to fulfill contractual obligations, provide benefits or services, whether in whole or in part, or unable to enter into a contract with you, as the case may be. In such instances, the Company may refuse to enter into a contract with you or to provide benefits or services to you.

7. Purpose of Personal Data Processing

The Company processes your Personal Data for the purposes, relying on the lawful basis for processing of Personal Data, details are as follows:

Generally, whether you are a Token Holder and Employees, the Company will process your Personal Data for the purposes, relying on the lawful basis for processing of Personal Data, with the following details:

8. Disclosure of Personal Data

For achieving the purpose of Personal Data Processing, the Company may disclose your Personal Data to the natural person or juristic person as follows:

8.1 External Service Provider, whereby the Company may disclose Personal Data to external service provider to support the Company’s operation and the rendering of service, such as information technology system service provider.

8.2 Professional Consultants, whereby the Company may disclose Personal Data to support the professional consultant’s operation for legitimate interests of the Company in consultation, such as external audit, legal consultants, lawyers, and financial advisors.

8.3 Government Agents, Regulatory Authorities, Competent Officials, whereby the Company shall disclose Personal Data according to the law or to comply with lawful order, such as Royal Thai Revenue Department, inquiry officers, prosecutors, executing officers, Royal Thai Police, Office of the Attorney General, Legal Execution Department, Revenue Department, Department of Skill Development, Social Security Office, Office of the Personal Data Protection Committee.

The Company will assign the recipients of your Personal Data to implement appropriate security measures to safeguard your Personal Data and to process your Personal Data to the extent necessary. The Company will undertake actions to prevent unauthorized or unlawful Personal Data Processing and will ensure that such processing is carried out in strict adherence to the purpose as specified in this Notice or Personal Data Protection Law. In the event that consent is required to process your Personal Data according to the Personal Data Protection Law, the Company will explicitly notify you and request your consent specifically.

9. Transfer of Personal Data to Foreign Country

To achieve the Company’s purpose as specified in this Notice, the Company may transfer Personal Data to the recipients located in foreign country. The Company will undertake measures to ensure that the destination country, international organization, or recipients of Personal Data located in foreign countries have adequate Personal Data protection standards, or to ensure that transferring of Personal Data to foreign country is in accordance with Personal Data Protection Law. In certain event, the Company may request your consent for transferring your Personal Data to a foreign country.

The Company may store your Personal Data on computers, servers, or cloud, provided by third parties, and may utilize third party program or application in the form of software as a service and platform as a service for processing your Personal Data. In this regard, the Company will not permit unauthorized person to access Personal Data and require such third parties to implement appropriate security measures for safeguarding Personal Data.

10. Personal Data Retention Period

The Company will retain your Personal Data for a period necessary to achieve the purpose in Personal Data Processing as specified in this Notice, taking into account the relationship between you and the Company, prescription for legal proceedings, along with the guideline of the Company and the relevant business sector. Generally, the Company will retain your Personal Data for a period of 10 years from the date the Company received your Personal Data.

Upon expiration of the aforementioned period or when it is no longer necessary to retain your Personal Data, the Company will promptly erase, destroy, or anonymize your Personal Data. Nonetheless, the Company may retain all or part of your Personal Data exceeding the aforementioned period for compliance with laws or legitimate orders.

11. Personal Data Security Measure

The Company has implemented appropriate Personal Data security measures, including organizational measures, technical measures, and physical measures, to maintain the confidentiality, integrity, and availability of your Personal Data and to protect it from loss, unauthorized access, use, alteration, modification, or disclosure, whether unauthorized or unlawful. These measures are in accordance with the criteria prescribed by Personal Data Protection Law.

The Company will regularly review, update, and enhance its Personal Data security measures to align with the change in criteria prescribed by Personal Data Protection Law and advancements in Personal Data security technology.

12. Your Rights as Data Subject

The Company places great emphasis on exercising your rights as a Data Subject, and the Company will promptly proceed according to criteria or practices prescribed in Personal Data Protection Law upon receiving request. You have the right to proceed with your Personal Data as follows:

12.1 Right to withdraw consent

In case the Company processes your Personal Data by relying on your consent, you have the right to withdraw consent at any time that the Personal Data is retained at the Company, unless there are any legal restrictions or any contradiction to the contract that benefits you.

Regardless, the withdrawal of consent does not affect any lawful Personal Data Processing conducted prior to the withdrawal of consent, and such withdrawal of consent may result in the Company being unable to fulfill the purpose of Personal Data Processing specified in this Notice, which may impact certain benefits you are entitled to. The Company encourages you to review the consequence of withdrawal of consent, including inquiring the Company to consult regarding the withdrawal of consent.

12.2 Right of access and retrieve a copy of Personal Data

You have the right to request an access to your Personal Data that the company collected and retrieve a copy of your Personal Data, along with right to inquire the Company to disclose of the source of Personal Data that you did not consent, unless the Company is subjected to the law or the court’s order or it violates the rights and freedoms of other people.

12.3 Right to data portability

You have the right to request the Company to send or transfer your Personal Data in an easily accessible and intelligible form using automated tools or equipment and in the format that can be used or disclosed using automated tools or equipment to other Data Controller, and you may request for Personal Data in such format that the Company sent or transferred to other Data Controller, unless it is technically unfeasible to so, or it violates the rights and freedoms of other people, or the Company has any other reasons to refuse your rights according to Personal Data Protection Law.

12.4 Right to object to processing

You have the right to object to Personal Data Processing in the event that the Company carried out for the legitimate interests of the Company or any other person, along with the purpose of direct marketing or the purpose of scientific, historical or statistical research.

Unless the Company can demonstrate that there is a compelling legitimate ground that is more important than your fundamental rights, or it is carried out for the establishment, compliance or exercise of legal claims, or defense of legal claims, or it is carried out for reasons of public interest.

12.5 Right to erasure

You have the right to request the Company to erase, destroy, or anonymize your Personal Data in case that you believe that the Company has unlawfully processed your Personal Data, or you believe that the Company cease the necessity to retain your Personal Data according to the Company’s purpose as specified in this Notice, or you have exercised right to withdraw consent or right to object to processing, unless the Company has reason to refuse such rights according to Personal Data Protection Law.

12.6 Right to restriction of processing

You have the right to request the Company to restrict the use of Personal Data in the following case:

(1) The Company is pending examination process in accordance with the right to rectification or in accordance with the right to object to processing in order to refuse such right;

(2) It is Personal Data which the Company shall erase, destroy, or anonymize, but you request to restrict the processing instead;

(3) It is Personal Data which the Company ceases its necessity to retain under the purpose specified in this Notice, but you request the Company to retain it for establishment, compliance or exercise of legal claims, or defense of legal claims.

12.7 Right to rectification

In case you have modified or changed your Personal Data resulted in the Personal Data you previously provided to the Company is no longer current, does not reflect the reality, or you believe that the Company possesses your Personal Data that is incorrect, incomplete, or may cause misunderstanding, you have the right to request the Company to rectify your Personal Data to be accurate, up-to-date, complete, and not cause any misunderstanding.

12.8 Right to complain

In case you believe that the Company or the Data Processor, as well as employees, staff, authorized representatives of the Company or of the Data Processor, have violated or failed to comply with Personal Data Protection Law, you have the right to lodge a complaint with relevant government agencies, including the Office of the Personal Data Protection Committee.

Prior to making such a complaint, the Company kindly requests that you contact the Company first so that the Company is informed of the facts and your concerns, and allowing the Company to provide an explanation and undertake preliminary action to resolve your concerns.

13. Exercising Data Subject Rights

You can submit requests to exercise your rights at any time by contacting the Company through the channels specified in Clause 16. Regardless, upon submitting requests, the Company needs to collect certain Personal Data from you for identity verification and to confirm your rights as a Data Subject to ensure that your Personal Data will not be disclosed to unauthorized individuals.

The Company will process your request within 30 days from the date that the Company receives your request. The Company may take longer than 30 days to process your request if it is complex or if there are numerous requests. In case of delay, the Company will notify you of the cause of such a delay and status of processing your request.

The Company will not charge any fees for processing your requests, unless such requests are unreasonable, such as when the Company does not collect that Personal Data, or the request is excessive, such as repetitive requests of the same nature or content without reasonable cause. In such cases, the Company reserves the right to charge appropriate fees or to refuse such requests accordingly.

The Company may refuse your rights request according to the criteria prescribed by Personal Data Protection Law. In case that the Company refuses your request, the Company will inform you of the reasons for such refusal.

14. Personal Data Processing Under Original Purpose

The Company reserves the right to continue processing your Personal Data that was collected prior to the effective date of the Personal Data Protection Act B.E. 2562 in accordance with its original purposes. If you do not wish for the Company to continue such processing, you may exercise your right to withdraw your consent.

15. Amendment to this Notice

The Company reserves the right to review, amend, or update this Notice from time to time to reflect changes in Personal Data Protection Law or the Company’s Personal Data protection practices. Any updates will be published on the Company’s official website.

16. Contacting the Company

If you have any inquiry regarding the provisions of this Notice, or require further information about the protection of your Personal Data, or wish to exercise your rights as a Data Subject under Clause 12, you may contact the Company through the following channels

Name: Real Estate Exponential Company Limited

Address: 989 Siam Piwat Tower Floor 12A Rama I Rd. Pathumwan, Bangkok

Phone Number: 0812030000

E-mail: [email protected]

17. Applicable Law

This Notice is governed by and construed in accordance with Thai Law. Any dispute arising out of or in connection with this Notice shall be submitted to the exclusive jurisdiction of the courts of Thailand.