Salus Bioceutical (Thailand) Co.,Ltd. operates in the business of cultivation, extraction, production, laboratory testing and marketing hemp and cannabis products with the goal of producing quality products that can be used as an ingredient in food products (Food Grade) and herbal and medicinal products (Pharmaceutical Grade).

Salus Bioceutical (Thailand) Co.,Ltd. and affiliated companies , including persons involved in the processing of the personal data on order or on behalf of Salus Bioceutical (Thailand) Co.,Ltd., (hereinafter collectively referred to as the "Company") realize the importance of personal data and other information about you (collectively referred to as “Information”). So you can be confident that the Company is transparent and responsible for collecting use or disclose your information in accordance with the Personal Data Protection Act B.E. 2562 (“PDPA”), relevant laws and regulations. This Privacy Policy (“Policy”) has been written to explain to you with the details about the collection use or disclose (collectively referred to as “Processing”) personal data processed by the Company , including officers and related persons acting on behalf of the Company with the content and conditions as follows.

This Policy applies to the personal data of individuals who have a relationship with the Company, both existing and possibly in the future, which personal data is processed by the Company, its officers, contractual employees, business entities or other forms of entities operated by the Company and including parties or third parties who process personal data on behalf of the Company (“personal data processors”) under products and services such as websites, systems, applications, documents or other forms of services regulated by the Company
(collectively referred to as the “Service”).

The Persons who are related to the Company under the provisions of the first paragraph include;

• Individual customers
• Officers or operator, employees
• Partners and service providers who are natural persons
• Directors, attorney-in-fact, representatives, shareholders, employees or other persons having similar relationship of the juristic person having relationship with the Company.
• Users of the company's products or services
• Visitors or users of the website www.salusbioceutical.co.th including any other application, device or communication channel controlled by the Company.
• Other persons whom the Company collects personal data such as job applicants, family of officers, guarantors, beneficiaries of insurance policies, etc. Articles 1) to 6) collectively referred to as “You”.

In addition to this Policy, the Company may require a Privacy Notice (“Notice”) for products or services of the Company to inform the Personal Data Subject who is a User of the Personal Data being processed, purpose and legitimate reasons for processing, the retention period of personal data includes the personal data rights that the personal data subject has in a particular product or service. In the event of a material conflict between the terms of Privacy Notice and this Policy subject to the Privacy Notice of that Service.

• Personal Data means any information relating to a person which enables the identification of such person, whether directly or indirectly, but not including the information of deceased persons in particular.
• Sensitive Personal Data means personal data as provided for in Section 26 of the Personal Data Protection Act B.E. 2565 which includes data regarding racial or ethnic origin, political opinions, cults, religious or philosophical beliefs, sexual behavior, criminal records, health data, disabilities, trade union information, genetic data and biometric data or any other information which affects the owner of personal data in a similar way as announced by the Personal Data Protection Committee.
• Processing of personal data means any processing of personal data such as collecting, recording, copying, organizing, keeping, improving, changing, using, recovering, disclosing, forwarding, disseminating, transferring, merging, deleting, destroying, etc.
• Personal Data Subject means an individual who owns personal data that the Company collects, uses or discloses.
• Data Controller means a Person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data.
• Data Processor means a person or a juristic person who operates in relation to the collection, use, or disclosure of the Personal Data pursuant to the orders given by or on behalf of a Data Controller, whereby such Person or juristic person is not the Data Controller.

The Company may collect or obtain various types of personal data from the following sources:

• Personal data that the Company collects directly from the personal data subject to provide services such as the application process, registration, job application, contract, memorandum, cooperation memorandum, customer list, distributor, documents, conduct surveys or use products, services or other service channels supervised by the Company, or when the subject of personal data communicates with the Company at the office or through other communication channels supervised by the Company, etc.
• Data that the Company collects from the personal data subject accessing the website, other products or services under contract or mission, such as website behavior tracking, products or services of the Company through the use of cookies (Cookies) or from software on the device of the Personal Data Subject, etc.
• Personal Data that the Company collects from sources other than the Personal Data Subject, where such data sources have the authority, legitimate reasons or have already obtained the consent of the Personal Data Subject in disclosing data to the Company. For example, the linking of digital services by government agencies to provide comprehensive public benefit services to the personal data subject, receiving personal data from other government agencies as the Company is obliged by its mission to establish a central data exchange center to support the operation of government agencies in providing digital services to citizens. Including out of necessity to provide contractual services in which personal data may be exchanged with contractual entities.
  

  This also includes in the event that you provide personal data of the third party to the Company as follows: You are responsible for providing details under this policy or announcements of products or services, as the case may be let the person know as well as obtaining consent from that person if it is a case where consent to disclose data to the Company is required.

  In the event that the personal data subject refuses to provide data that is necessary to provide the Company's services, it may result in the Company being unable to provide that service to the personal data subject in whole or in part.

Providing your personal data is voluntary. You have the right to refuse to provide data requested by the Company but failure to provide such data may result in the Company being unable to provide you with certain benefits, or the Company is unable to perform the contract with you or you may not receive the service that you want.

Some of the data that the Company collects may be regarded as “Sensitive Data”

The Company intends to collect sensitive data from you only if you have given your express consent and to the extent that it is reasonably necessary to operate the Company. Or in the event that the law, court or the government agency has ordered the collection of such data or in the event that you have intentionally disclosed that data to the public only and aims to share Sensitive Data only if the Company deems it necessary to collect, use or disclose that data.

The Company shall not collect Personal Data without the consent of the data subject, unless:

• it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
• it is for preventing or suppressing a danger to a Person’s life, body of the individual to whom the data subject is unable to give consent for whatever reason.
• It is necessary for compliance with a law to achieve the purposes with respect to:
  • preventive medicine or occupational medicine, the assessment of working capacity of the employee, medical diagnosis, the provision of health or social care, medical treatment, the management of health or social care systems and services. In the event that it is not for compliance with the law, and such Personal Data is under the responsibility of the occupational or profession practitioner or person having the duty to keep such Personal Data as confidential under the law, it must be for compliance with the contract between the data subject and the medical practitioner;
  • public interest in public health, such as protecting against cross-border dangerous contagious disease or epidemics which may be contagious or pestilent, or ensuring standards or quality of medicines, medicinal products or medical devices, on the basis that there is a provision of suitable and specific measures to safeguard the rights and freedom of the data subject, in particular maintaining the confidentiality of Personal Data in accordance with the duties or professional ethics;
  • employment protection, social security, national health security, social health welfare of the entitled person by law, the road accident victims protection, or social protection in which the collection of Personal Data is necessary for exercising the rights or carrying out the obligations of the Data Controller or the data subject, by providing the suitable measures to protect the fundamental rights and interest of the data subject;
  • it is for the scientific, historical, or statistic research purposes, or other public interests which must be carried out only to the extent necessary to achieve such purposes, and the suitable measures have been provided to protect the fundamental rights and interest of the data subject as prescribed by the Committee;
  • Significant public interest.
• For the legitimate interests of the Company, In case of necessity for the legitimate interests of the Company's operations. The Company will consider the rights of the data subject as important as to prevent fraud, network security protection of freedom and the benefit of the data subject, etc.
• For research studies or statistics, In the case of historical documents or archives for the public interest or related to research studies or statistics where appropriate safeguards are in place to protect the rights and freedom of data subjects.
• For carry out the mission of the state, In the event that it is necessary to carry out the mission for the public interest or the performance of duties under the powers of the state that the Company has been assigned.

In the event that it is necessary for the Company to collect your personal data for the performance of the contract performance of duties under the law or for the necessity of entering into a contract. If you refuse to provide personal data or object to processing for the purpose of the activity, it may result in the Company being unable to perform or provide the services you have requested in whole or in part.

To collect and keep personal data, the Company shall use lawful means and only limited to the extent necessary for the Company's operating objectives. which consists of;

Normally, the Company collects personal data from you directly, such as a job application form or any documents for personnel or directors or executives of the Company, documents or registration system as a service provider or seller/buyer with the Company, channels for filling in data through the Company's system or the Company's website, including any verbal notices to the Company such as by telephone or video/virtual conference, channel for sending data via
e-mail or other communications between the Company and you including obtaining data through applications for mobile devices provided or made available by the Company.

The Company does not collect personal data from visitors to the Company's website. Unless you provide the data by yourself or technical data as stated in this Privacy Policy.

From time to time, other people may provide your personal data to the Company. You may or may not be directly involved in such cases. For example, the Company may collect your personal data from:

• Your employer
• Employees in the Company's affiliates through advice, whether by phone, e-mail, or other communication.
• Contractors, vendors, service providers.
• Bank and payment service providers such as credit or debit card companies.
• The Revenue Department, Department of Labor Protection immigration agency and the customs.
• Government agencies regulators and other agencies as permitted or required by law.
• Your representative
• Publicly available resources, mailing list contact data and marketing that is open to the public and made for commercial use by both the private sector, any trade association and/or government agency (such as websites) as well as other social media such as Facebook LinkedIn, etc.

The Company may collect and use cookies and other similar technologies on websites under its supervision, such as www.salusbioceutical.co.th or on your device depending on the service you use. However, for the safety of the Company's services and to provide you with the convenience and good experience in using the Company's services. And these data will be used to improve the Company's website to better meet your needs. You can manually set or delete the use of cookies from the settings in your Web Browser.

The Company collects your personal data for multiple purposes depending on the type of product or service or activities with which you have a relationship with the Company. Both entering into contracts or negotiating business dealings as well as the nature of your relationship with the Company, or considerations in each context. The purposes stated below are the general framework for the Company's use of personal data.
Only the purposes related to the products or services you use or have a relationship with shall apply to your data.

• To enter into the contract or perform duties under the contract between the Company and the data subject or perform duties under the contract between the Company and third parties for the benefit of the data subject;
• To answer the question and provide assistance to data subjects;
• To develop and improve the company's products and services to better respond to the demand of the data subject;
• To provide information and recommend products, services or public relations for marketing campaigns or benefits through contact channels received from the data subject as the data subject has given consent to the Company;
• To survey opinions, analyze, conduct research and produce statistical data for marketing or development and improvement of the Company's operations as you have given consent to the Company;
• For the benefit of managing the Company's internal operations necessary under the legitimate interests;
• To monitor, supervise and secure around the building or premises of the Company;
• For compliance with the law related to the operations of the Company such as withholding tax;
• To provide information to government agencies with statutory authority as requested by government agencies such as the National Police, Anti-Money Laundering Office, Revenue Department, Court;
• To carry out any accounting and financial activities such as auditing Notification and collection of debts, the use of various welfare rights, taxes and evidence of transactions as required by law;
• For the legitimate interests of the Company such as recording conversations through the Call Center system, recording images through CCTV;
• To investigate and comply with the laws, regulations or legal duties of the Company;
• Use the data to verify the identity of the customer;
• Other purposes with your express consent.

The company shall not disclose and forward your personal data to outside agencies. Unless received your express consent or according to the following cases:

• For achieve the purposes stated in this Privacy Policy, the Company may be required to disclose or share specific information as necessary to a partner, service provider or external entity, whereby the Company will enter into a personal data processing agreement as required by law.
• The Company may disclose or share personal data with its affiliates. It shall only process the data for the purposes stated in this Privacy Policy.
• The law or legal process requires disclosure or disclosure to a government official or competent authority in order to comply with a lawful order or request.

The Company may transmit or transfer personal data abroad. This will ensure that the destination country or the destination authority has adequate privacy standards and policies.

The Company will retain your personal data only for as long as it is necessary for the purpose for which it was collected, as detailed in the policy, notice or in accordance with the relevant laws. However, after the expiration of the period and your personal data is no longer necessary for the aforementioned purposes, the Company will delete and destroy your personal data or make your personal data more identifiable according to the form and standard of erasure of personal data. In case of dispute, exercise of rights or lawsuits related to your personal data, the Company reserves the right to retain such data until the dispute has been final order or a final judgment.

The Company will take technical measures and proper management to protect and secure for your personal data. It provides encryption for transmitting data over the Internet and controls access to your personal data only for those involved. both the data stored in the document and electronic form.

The Company's services may contain links to third-party websites or services. Such websites or services may have a personal data protection policy, that is different from this policy. The Company recommends that you consult the privacy policy of that website or service to know in detail before using it. The Company is not associated and has no control over the privacy protection measures of such websites or services and cannot be held responsible for the content, policies, damage or actions caused by third party websites or services.

You can apply for various rights as required by law and as specified in this announcement as follows:

• Right to withdraw consent.You have the right to withdraw your consent at any time. Unless otherwise required by law, such withdrawal of consent will not affect the processing of personal data for which you have lawfully given consent prior to such withdrawal.
• Right to delete or destroy personal data.You have the right to request that the Company to take action to delete or destroy your personal data in possession or the control of the Company or make it non-identifiable data.
• Right to data transfer.You have the right to request that the Company transfer your personal data in a readable format or general use with tools or devices that run automatically to other personal data controllers, subject to exceptions as required by law.
• Right to object.You have the right to object the collection, use or disclosure of your personal data or request the Company to suspend the use of that personal data.
  The Company will process the request in accordance with the provisions of the relevant law.
• Right to request a temporary suspension of the use of your personal data. Right to restriction of data processing.You have the right to request to limited companies to process data. The data controller can continue to collect personal data but can no longer be used to process the data. Unless the employee gives consent or is granted exemption as required by law.
• Right to access data.You have the right to request access and obtain a copy of your personal data. The Company will process your request within 30 days from the date of receiving the request. unless the law stipulates otherwise.
• Right to correct data.You have the right to request the Company to ensure that your personal data is accurate, complete and up-to-date. In every operation process, The Company will conduct investigations as far as possible to ensure that the user's personal data is accurate, complete and up-to-date.
• Right to complaint.You have the right to complain to the authorities or a supervisory agency for the protection of personal data. In the event that you find that the Company or personnel of the Company use or disclose your data not in accordance with your consent or not processing as legally entitled, you have the right to complain to the Personal Data Protection Committee.

Failure to comply with the policy may result in an offense and subject to disciplinary action in accordance with the Company’s rules (for officers or employees of the Company). Or in accordance with the personal data processing agreement (for processors of personal data) However, depending on the case and relationship that you have with the Company and may be subject to penalties as prescribed by the Personal Data Protection Act B.E. 2562 including secondary laws, rules, regulations, and relevant orders.

The Company may consider updating, amending or changing this Policy at its sole discretion and will inform you through the Company's website or announcements within the Company whether the announcement is closed or published online with the effective date of each revised version. However, the Company encourages you to check regularly for new policies through specific channels of activities carried out by the Company, especially before you disclose personal data to the Company.

The Access to the Company's products or services, including business dealings or entering into a contract, any memorandum that arises after the enforcement of the new policy. This is considered an acknowledgment under the terms of the new policy.

If you have any questions, suggestions or concerns about the Company's collection, use and disclosure of personal data or about this policy, or you wish to request to exercise your rights under the Personal Data Protection Law, please contact us through the following channels:

• Name : Salus Bioceutical (Thailand) Company Limited
• Address :
  
  Head Office No. 87 M. Thai Tower (All Seasons Complex), 22nd Floor, Unit 1, Wireless Road, Lumpini, Pathumwan, Bangkok. Branch Office No. 320, Village No. 2, Choeng Doi, Doi Saket District Chiang Mai.
• Tel. : (+66)(52)-135073, (52)-135073

Please provide the following information for the request to exercise the rights of the personal data subject.

• First name-Surname, ID card number/passport number.
• Question about personal data or the rights that you wish to legally exercise.
• Telephone numbers, addresses and email addresses.