Personal Data Protection Policy

Robowealth Investment Advisory Securities Co., Ltd. Version dated 31 March 2022

Robowealth Investment Advisory Securities Co., Ltd. (the “Company”) places importance on respecting its clients' right to privacy and on keeping their personal data secure. It has therefore set policies, regulations and rules for its operations with strict measures for the security of personal data, so that clients can be confident that the personal data the Company receives will be used in line with their wishes and in accordance with the law.

1. Purpose

This policy sets out how the Company treats clients as owners of personal data, so that employees at every level of the Company, and clients, know the purposes and details of the collection, use and/or disclosure of personal data, as well as clients' legal rights relating to personal data.

2. Roles, duties and responsibilities

2.1 Board of Directors (BoD)

Responsible for setting policy on the collection, use and/or disclosure of personal data and on clients' legal rights relating to personal data, so that everyone working at the Company gives it the highest priority and strictly complies with the relevant laws, regulations and practices; for reviewing and updating that policy regularly; and for appointing a personal data protection working group and a Data Protection Officer to carry out duties under the Personal Data Protection Act.

2.2 Management Committee (MC) and department heads

Responsible for supervising and ensuring compliance with the laws on personal data protection, for jointly preparing regulations, operating manuals and procedures in line with this policy, and for supporting strict compliance.

2.3 Employees at every level

Must give importance to, and strictly comply with, this policy and all related rules and regulations.

2.4 Compliance department

Responsible for supporting management, taking part in risk assessment, and spot-checking operations for compliance with this policy.

2.5 Data Protection Officer (DPO)

Appointed by the Board of Directors, with the following duties under the Personal Data Protection Act:

To advise the data controller or data processor, and the employees or contractors of the data controller or data processor, on compliance with the Personal Data Protection Act

To monitor the operations of the data controller or data processor, and of the employees or contractors of the data controller or data processor, for compliance with the Personal Data Protection Act

To coordinate and cooperate with the Office of the Personal Data Protection Commission where problems arise with the processing of personal data by the data controller or data processor in complying with the Personal Data Protection Act

To keep confidential any personal data learned or obtained in the course of performing duties under the Personal Data Protection Act

3. Personal data the Company collects, uses and/or discloses

Personal data means information that can identify a person, directly or indirectly. This includes personal data that clients give to the Company directly, and personal data the Company receives or can access from sources other than the client, such as government agencies, companies in its financial business group, financial institutions, financial service providers, business partners, credit bureaus and data providers. The Company will collect data from other sources only with the client's consent as required by law, unless the Company has a need that the law permits.

Personal data of clients that the Company collects, uses and/or discloses includes:

– Personal details, such as first name, surname, age, date of birth, marital status, national ID number and passport number

– Contact details, such as home address, workplace, telephone number, email and LINE ID

– Financial data, such as income, expenses, bank account number, financial history and list of assets

– Transaction data, such as purchases and sales of investment units and deposits to and withdrawals from the Wallet

– Device or tool data, such as IP address, MAC address and Cookie ID

– Other data, such as website usage, voice, still images, moving images and any other data regarded as personal data under the personal data protection law

Sensitive personal data (Sensitive Data) is personal data specifically defined by law. The Company will collect, use and/or disclose sensitive personal data only with the client's explicit consent, or where the Company has a need that the law permits. The Company may need to collect, use and/or disclose biometric data, such as facial images, fingerprint templates, iris templates and voice identity data, for the purpose of verifying and confirming the identity of users who apply for services and/or carry out transactions through digital or other channels.

(In the rest of this policy, unless stated specifically, the personal data and sensitive personal data about clients described above are together called “personal data”.)

Personal data of any third party: where a client gives the Company personal data of any third party who is personnel of a legal entity and/or connected with that person, such as shareholders, directors, authorised signatories, family members, references, trading partners, guarantors, mortgagors, collateral providers, beneficiaries, estate administrators, emergency contacts and/or any other person named in the client's transaction documents, the client is asked to inform those persons of the details of this policy and to obtain their consent where necessary, or to establish another legal basis, so that the Company can collect, use and/or disclose the personal data of those third parties.

Type of data

Examples of data the Company collects, uses and/or discloses

- Title, first name, middle name, surname, alias (if any)

- Sex, date of birth, age

- Marital status, family status, number of family members and number of children

- Relationship data (for example, between a main borrower and co-borrower, a main and supplementary cardholder, or you and a beneficiary)

- Nationality, country of residence

- Signature

- Information on documents issued by government agencies (for example, copies of national ID card, passport, visa, alien certificate, work permit, civil servant / state enterprise ID card, house registration, birth certificate, name change certificate, marriage certificate, divorce certificate, death certificate, driving licence, or similar documents used to identify and verify identity), and other KYC and CDD data

- Address on official documents, current residential address, address in the country of nationality, workplace

- Telephone number, mobile number, fax number, email

- Names or accounts used for electronic communication or social media (for example, LINE ID)

- Proof of residence in Thailand (for foreign nationals)

- Information on a copy of a student ID card, highest level of education

- Occupation and field of work

- Position, length of service in current job

- Job details, type of business

- Bank account number, deposit amount, interest

- Credit / debit card number

- Income, sources of income and expenses

- Information on salary certificates, pay slips / bonus slips or other proof of income, statements from other banks, appraised value of assets

- Taxpayer identification number and personal tax data

- Data on applications for channels, products and/or services

- Account type, deposit term, payment conditions, card type, account statements

- Investment data (for example, details of purchases or subscriptions of securities, investment risk level, data from the investment risk assessment, Client Suitability data, securities traded, value of securities, investment value, investment period)

- Transaction history, transaction details and purposes, data in transaction memos, transaction reference numbers, transaction channels

- Application usernames and passwords

- Other data relating to the use of products / services (for example, client code / client identification number (CIS), cheque data, bill of exchange data, credit lines, interest rates, currencies involved, credit application data, trade data, purchase orders, sale and purchase agreements and/or other contracts, guarantee details, US person / non-US person status declaration (FATCA))

- Application usage data

- Computer identification numbers (IP address or MAC address)

- Cookies (Cookie ID)

- Web beacons, Pixel Tags or Software Development Kits (SDK)

- Device ID

- Device model and type, network, connection data

- Access data, single sign-on (SSO) data

- Logs

- Log-in data, access times, use and duration of use of the application and website, search history, browsing data

- Time zone and Location Data

- Browser plug-in types and versions, operating system and platform, and other technologies on the device you use to access the platform

- Other technical data from use of the platform and operating system

- Records of communications or interactions between you and the Company, details of complaints or comments, requests to exercise rights, survey results, voice recordings, photographs, videos, audio clips, records of communication through Log / Chat-Bot, still or moving images from closed-circuit television (CCTV), information in court orders / the Royal Gazette relating to the transactions of the bank's clients or the bank's legal compliance (for example, receivership orders, orders appointing an estate administrator, orders declaring a person incompetent or quasi-incompetent, orders to produce documentary or material evidence), and any other data regarded as personal data under the personal data protection law

- Registration data for the Company's events

Use of cookies and/or similar technologies

The Company may collect and use cookies and/or other similar technologies when clients use the Company's website and/or application, including when they carry out transactions or use the Company's products and/or services through digital channels and the internet. Collecting cookies and/or using other similar technologies helps the Company remember clients' usage and preferences and analyse your interests, in order to improve and develop the performance of the Company's website and/or application to meet clients' needs and usage, so that clients have a good experience using the Company's website and/or application.

4. Purposes of collecting, using and/or disclosing clients' personal data

The Company will collect clients' personal data for the clients' benefit in using its products and/or services, to comply with any law that the Company or the client must comply with, and for the other purposes stated in this policy, as follows:

4.1 To let clients use the Company's products and/or services as they intend, and for other purposes necessary under the law

4.1.1 To let clients use the Company's products and/or services as they wish under a contract between the client and the Company, or to act on the client's request before using the Company's products and/or services (Contractual Basis), for example:

(1) Considering and approving the opening of securities accounts and electronic money accounts (e-wallet), the purchase and sale of mutual fund securities, and the withdrawal, transfer, exchange or payment of any related money or assets

(2) Any action related to providing products and/or services, such as processing, contacting, notifying, and assigning work to other persons who are external service providers

4.1.2 To perform duties under the relevant or applicable laws (Legal Obligation), for example:

(1) Complying with orders of legally authorised persons

(2) Complying with the financial institutions business law, securities and exchange law, tax law, anti-money laundering law, law on the prevention and suppression of financing of terrorism and proliferation of weapons of mass destruction, computer law, bankruptcy law, and other laws in Thailand and abroad that the Company must comply with, including notifications and regulations issued under those laws

Where the Company needs to use and/or disclose a client's personal data to perform its legal duties or to enter into a contract with the client, the Company may be unable to provide products and/or services to the client (or to continue providing them) if it cannot collect the client's personal data when requested.

4.1.3 For operations necessary under the legitimate interests of the Company or of another person or legal entity, within the scope the client can reasonably expect (Legitimate Interest), for example:

(1) Call Center voice recording

(2) Maintaining client relationships, such as handling complaints, assessing satisfaction, client care by the Company's employees, and notifying or offering products and/or services of the same type the client already has with the Company that benefit the client

(3) Risk management, compliance monitoring and internal management, including passing data to companies in the same group for these purposes under the group's personal data protection policy (Binding Corporate Rules)

(4) Making personal data into data that cannot identify a person (Anonymous Data)

(5) Preventing, responding to and reducing the risk of fraud, cyber threats, default or breach of contract (for example, bankruptcy data) and unlawful acts (for example, money laundering, financing of terrorism and proliferation of weapons of mass destruction, and offences against property, life, body, liberty or reputation), including sharing personal data to raise the standards of companies in the same group / business in preventing, responding to and reducing these risks

(6) Collecting, using and/or disclosing the personal data of directors, authorised signatories and representatives of corporate clients

(7) Contact, photography and audio recording relating to meetings, training, recreation or exhibition booths

(8) Collecting, using and/or disclosing the personal data of persons placed under a receivership order by a court

(9) Sending and receiving parcels

4.2 To let clients benefit from the use of products and/or services, as the client has chosen to consent, for example:

4.2.1 So that clients receive better products and/or services that match their needs

4.2.2 So that clients receive offers, special privileges, recommendations and news, including the right to take part in special events

This applies whether the products and/or services, privileges, promotions, news or special events are the Company's own, those of companies in its financial business group, those of persons for whom the Company acts as agent, broker or distributor, those of its business partners, or those of third parties connected with the Company, in each case as the client has consented.

5. Disclosure of clients' personal data

The Company may disclose clients' personal data to others with the client's consent or under rules by which the law permits disclosure. The persons or organisations receiving that data will collect, use and/or disclose the client's personal data within the scope the client has consented to or the scope set out in this policy.

The Company may disclose clients' personal data for various purposes, such as providing services to clients, analysing and improving products and/or services, research or statistics, the Company's sales promotion and public relations, business management, fraud prevention, having others provide support services to the Company, and verifying clients' identity. The Company may disclose it to persons or organisations such as companies in its financial business group, personal data processors, business partners issuing co-branded products, external service providers, the Company's agents, subcontractors, financial institutions, auditors, external inspectors, credit rating agencies, asset management companies, credit bureaus, legally authorised persons, prospective transferees and/or transferees of rights in the Company's transactions or mergers, and any legal entity or person with a relationship or contract with the Company, including the executives, employees, staff, contractors, agents and advisors of the Company and of the persons or organisations receiving that data.

Where the Company discloses clients' personal data to others for the recipient's marketing purposes, such as sales promotion, public relations or offering the recipient's products and/or services to the client, the Company will tell the client who the recipients are so that the client can decide whether to consent.

6. Sending or transferring clients' personal data abroad

The Company may need to send or transfer clients' personal data to companies in the same group / business located abroad, or to other recipients as part of its normal business, such as sending or transferring personal data for storage on servers / cloud in other countries.

Where the destination country does not have adequate standards, the Company will ensure that the sending or transfer of personal data is carried out as required by law, and will put in place personal data protection measures it considers necessary and appropriate in line with confidentiality standards, such as confidentiality agreements with recipients in that country. Where the recipient is a company in the same group / business, the Company may instead adopt a personal data protection policy that has been reviewed and certified by the relevant legally authorised persons, and carry out the sending or transfer of personal data to companies in the same group / business abroad under that policy in place of the procedures set by law.

7. Retention of clients' personal data

The Company will retain clients' personal data for as long as necessary while the client is a client of, or has a relationship with, the Company, or for as long as necessary to achieve the purposes set out in this policy. It may need to retain the data after that where the law requires or permits, for example under the anti-money laundering law, or to prove and examine possible disputes within the limitation period set by law, for no more than 10 years.

The Company will delete or destroy the personal data, or make it data that cannot identify the client, when it is no longer needed or when that period ends.

8. Protection of personal data

The Company will keep clients' personal data securely under appropriate Technical Measures and Organizational Measures to maintain the security of personal data processing and to prevent personal data breaches. The Company has set policies and practices for protecting personal data to prevent recipients of data from the Company from using or disclosing it beyond the purpose, without authority or unlawfully, and it updates those policies and practices from time to time as necessary and appropriate.

In addition, the Company's executives, employees, staff, contractors, agents, advisors and recipients of data from the Company must keep personal data confidential under the confidentiality measures set by the Company.

9. Clients' rights over personal data

Clients have legal rights they should know about, which the Company must communicate to them through its channels. Clients may exercise these rights under the provisions of the law and the policy as it stands now or as amended in future. Where a client is under 20 years of age or has restricted legal capacity, the client may exercise these rights through their father and mother, a person exercising parental authority, or an authorised representative.

The rights the Company must tell clients about are as follows:

9.1 Right to withdraw consent:

If the client has consented to the Company collecting, using and/or disclosing their personal data (whether that consent was given before or after the personal data protection law came into force), the client has the right to withdraw consent at any time while the Company holds their personal data, unless that right is restricted by law or by a contract that benefits the client.

Withdrawing consent may affect the client's use of products and/or services. For example, the client may no longer receive privileges, promotions or new offers, better products or services that match their needs, or useful news and information. For the client's benefit, the Company should ask the client to study, and should explain, the effects before consent is withdrawn.

9.2 Right of access:

The client has the right to access their personal data held by the Company, to ask the Company to make a copy of that data for them, and to ask the Company to disclose how it obtained their personal data.

9.3 Right to data portability:

The client has the right to receive their personal data where the Company has put it in a format that can be read or used by automated tools or devices and can be used or disclosed by automated means. The client also has the right to ask the Company to send or transfer personal data in that format to another data controller where this can be done by automated means, and to receive the personal data the Company sends or transfers in that format directly to another data controller, unless this cannot be done for technical reasons.

The personal data above must be personal data that the client has consented to the Company collecting, using and/or disclosing, or personal data the Company needs to collect, use and/or disclose so that the client can use its products and/or services as they wish under a contract with the Company, or to act on the client's request before using its products and/or services, or other personal data as specified by legally authorised persons.

9.4 Right to object:

The client has the right to object at any time to the collection, use and/or disclosure of their personal data where it is carried out for operations necessary under the legitimate interests of the Company or of another person or legal entity, within the scope the client can reasonably expect, or to carry out a task in the public interest. If the client objects, the Company will continue to collect, use and/or disclose the client's personal data only where it can show legal grounds that are more important than the client's fundamental rights, or where this is for establishing, complying with or defending legal claims, as the case may be.

The client also has the right to object to the collection, use and/or disclosure of their personal data for marketing purposes, or for scientific, historical or statistical research.

9.5 Right to erasure or destruction:

The client has the right to ask for their personal data to be deleted or destroyed, or made into data that cannot identify them, if the client believes their personal data has been collected, used and/or disclosed unlawfully, or considers that the Company no longer needs to keep it for the purposes in this policy, or after the client has exercised the right to withdraw consent or to object as described above.

9.6 Right to restrict processing:

The client has the right to ask for the use of their personal data to be suspended temporarily while the Company is examining the client's request to correct their personal data or their objection, or in any other case where the Company no longer needs the data and must delete or destroy it under the relevant law but the client asks the Company to suspend its use instead.

9.7 Right to rectification:

The client has the right to have their personal data corrected so that it is accurate, up to date, complete and not misleading.

9.8 Right to complain:

The client has the right to complain to the relevant legally authorised persons if the client believes the collection, use and/or disclosure of their personal data violates or does not comply with the relevant law.

10. Exercising clients' rights

Clients' exercise of their rights may be limited under the relevant law, and in some cases the Company may have a necessary reason to refuse or be unable to act on a client's request, for example to comply with the law or a court order, in the public interest, or where exercising the right may infringe the rights or freedoms of others. If the Company refuses a request, it will tell the client the reason for the refusal.

Clients can exercise their rights by downloading the rights request form here

and sending the form by email to: [email protected]

Once the request and complete supporting documents have been received, requests will be processed within the following times:

Right to withdraw consent: within 30 business days

Right to rectification: within 1 business day

Rights other than (1) and (2): within 30 business days

Data Protection Officer, email [email protected]

Clients may exercise these rights from 1 June 2022 onwards.