Content [ฉบับภาษาไทย]

1. Privacy Policy

1.1 Scope of Application

1.2 Definition

1.3 Collection, Use and Disclosure of Personal Data

1.4 Appropriate Security Measures for Personal Data

1.5 Records of the Data Controller and Records of Processing Activities

1.6 Data Processing Agreements and Data Sharing Agreements

1.7 Website Security and Cookies

1.8 Personal Data Breach Management

1.9 Communication, Awareness and Notification of Data Subject Rights

1.10 Other Measures

2. Privacy Notice for Visitor in Headquarter

3. Privacy Notice for Visitor in Samyan Mitrtown

4. Privacy Notice for Sales & Marketing Activities

5. Privacy Notice for Business Development & Licensing Activities

6. Personal Data Collected, Used and Disclosed Prior to the Effective Date of PDPA

7. Contact Details

Privacy Policy

OLIC (Thailand) Limited (the “Company”) is committed to respecting and protecting the privacy rights of Data Subjects. The Company seeks to ensure that Personal Data collected, used and disclosed by the Company is protected and processed in compliance with the Personal Data Protection Act B.E. 2562 (2019), all subordinate legislation issued thereunder, requirements relating to the management and security of Personal Data, and any rules, regulations or requirements prescribed by the Personal Data Protection Committee from time to time (collectively, the “Applicable Data Protection Laws”) in connection with the collection, use and disclosure of Personal Data.

Accordingly, the Company has established this Personal Data Protection Policy (“Privacy Policy”). This Privacy Policy also forms part of the privacy notice provided to Data Subjects.

1. Scope of Application

This Privacy Policy applies to the Company, its employees, and any persons involved in the Processing of Personal Data under the Company’s instructions or on behalf of the Company, including persons appointed to act as Data Processors.

2. Definitions

2.1 “Company” means OLIC (Thailand) Limited.

2.2 “Processing” means any operation performed on Personal Data, including collection, recording, organization, storage, updating, alteration, modification, retrieval, use, disclosure, transmission, dissemination, transfer, combination, separation, restriction or temporary unavailability, erasure, or permanent destruction.

2.3 “Personal Data” means any information relating to a natural person who is the Data Subject and which enables that person to be identified, whether directly or indirectly. Personal Data is categorized as follows:

(1) General Personal Data, such as first name, last name, national identification number, passport number, bank account number, employee wage or salary rates, employee provident fund contribution rates, employee welfare fund contribution rates, social security contribution rates, photographs, video recordings, audio recordings, addresses, email addresses, telephone numbers, LINE IDs used for contact, signatures of shareholders and Company directors, and employee-related information such as job interview results, probation evaluations, annual performance evaluations, disciplinary warning letters, termination letters and employee training records. This also includes Personal Data relating to personnel of business partners, job applicants, interns, service providers and visitors, as well as driving licence numbers, vehicle registration details, IP addresses, cookies, and any other Personal Data capable of identifying a particular Data Subject, such as codes, stamps, names or other identifying information.

(2) Sensitive Personal Data, such as race, religious or philosophical beliefs, political opinions, disability, criminal records, trade union data, sexual behavior, genetic data, health data (including medical certificates supporting employee sick leave, pre-employment medical examination results and annual employee health examination results), and biometric data, such as fingerprint templates or facial recognition templates used for time and attendance recording or access to areas subject to enhanced security measures.

2.4 “Data Subject” means a natural person to whom Personal Data relates and who can be identified, whether directly or indirectly. Data Subjects are principally divided into the following two categories:

(1) Data Subjects who are, or were, persons within the organization, including employees, shareholders and Company directors, as well as former employees, former shareholders and former Company directors.

(2) Data Subjects other than those specified in Clause 2.4 (1), including applicants who apply through any recruitment channel but are not selected for interview or employment; prospective job applicants; outsourced workers engaged under service contracts; personnel or employees of customers; consultants engaged by the Company; personnel of raw material or goods suppliers; personnel of various service providers, including financial institutions and food service providers; security personnel; lawyers; service recipients; clients; contractors; carriers; interns; business contacts; and personnel of government agencies, state enterprises or any other organizations that interact with the Company in any capacity, whether on behalf of such organization or in a personal capacity.

2.5 “Data Controller” means a natural or legal person having the power and duty to make decisions regarding the collection, use or disclosure of Personal Data. For the purposes of this Privacy Policy, this term also includes management at all levels and employees who have been employed, assigned, delegated or appointed to perform duties in accordance with the organizational structure, orders, announcements or job descriptions, and who act as representatives of the Data Controller in relation to the work for which they are responsible.

2.6 “Data Processor” means a natural or legal person, being an external organization or person, who carries out the collection, use or disclosure of Personal Data pursuant to the instructions of, under an agreement with, or on behalf of the Data Controller. This also includes Company employees or personnel employed by a Data Processor who are responsible for, or have been assigned to act as, representatives of the Data Processor.

3. Collection, Use and Disclosure of Personal Data

3.1 The Company will collect and use Personal Data only to the extent necessary for the purposes notified to the Data Subject and will not disclose such Personal Data to persons who have no duties relating to the relevant Processing. Before or at the time of collecting Personal Data, the Company will provide the Data Subject with the following information, unless the Data Subject is already aware of such information:

(1) The specific purposes for which Personal Data is collected, used or disclosed, together with the applicable lawful basis, such as legal obligation, contractual necessity, legitimate interests or any other applicable legal basis. Consent may not be required, except in the case of Sensitive Personal Data where no statutory exception under the Personal Data Protection Act applies.

(2) Whether the provision of Personal Data is necessary for entering into or performing a contract, or for compliance with a legal requirement, including the possible consequences of failing to provide such Personal Data.

(3) The retention period for the relevant Personal Data. As a general principle, Personal Data will be retained for the period required under applicable laws, including retention requirements prescribed by the Revenue Department, applicable limitation periods for legal claims, and requirements imposed by the Department of Labour Protection and Welfare and other competent authorities. Where a specific period cannot be determined, the Company may establish a reasonably anticipated retention period in accordance with applicable retention standards. Further details are set out in the Company’s Data Retention Policy.

(4) The categories of persons or organizations to whom the collected Personal Data may be disclosed.

(5) Information concerning the Data Controller, its contact location and contact methods, and, where applicable, the contact details of its representative or Data Protection Officer (DPO).

(6) The rights of Data Subjects, including:

(6.1) Right to access to Personal Data

(6.2) Right to rectification of inaccurate Personal Data

(6.3) Right to withdraw consent

(6.4) Right to erasure of Personal Data

(6.5) Right to restriction of Processing

(6.6) Right to obtain a copy of Personal Data

(6.7) Right to data portability

(6.8) Right to object to Processing

(6.9) Right to lodge a complaint

A Data Subject wishing to exercise any of the above rights must submit a request through the form or channel designated by the Company and must verify their identity by presenting appropriate identification issued by a government authority or their affiliated organization, in order to prevent impersonation or unauthorized requests by another person.

3.2 The Company maintains different Personal Data management processes for different categories of Data Subjects, depending on the purposes for which their Personal Data is collected, used or disclosed. Detailed requirements and specific operating practices are prescribed separately in the relevant privacy notices and other related Company policies, in order to enable Company employees to perform their duties correctly and in compliance with the Applicable Data Protection Laws.

3.3 Still images, video footage and audio recordings captured by CCTV systems installed within the Company’s premises and buildings may be collected, used and disclosed on the basis of legitimate interests, legal obligations and vital interests, as applicable, for the following purposes:

(1) To protect and secure any areas, buildings, workplaces, vehicles or other property owned, possessed, operated, maintained or lawfully controlled by the Company, and to establish appropriate security measures for such property and for persons employed by, working for, visiting or otherwise contacting the Company, including job applicants and persons participating in Company-organized activities, events or customary functions.

(2) The Company may, as it considers appropriate, install systems for recording images and audio and may conduct individual temperature screening in order to protect safety and security and to enable verification of manufacturing processes, quality control, occupational safety and environmental management, as well as to prevent and control outbreaks of serious communicable diseases in the workplace.

3.4 If the Company needs to collect, use or disclose a Data Subject’s Personal Data beyond the notified purposes or applicable lawful basis, the Company will carry out such Processing only after obtaining the Data Subject’s explicit consent or where such Processing is otherwise permitted by law.

3.5 Disclosure of Personal Data

The Company will disclose Personal Data only where an applicable lawful basis exists and appropriate Personal Data security measures are in place. Personal Data will not be disclosed to persons who have no relevant duties or authority to access it.

Subject to the Applicable Data Protection Laws, Personal Data may be disclosed to competent government authorities, courts, agencies under the Ministry of Labour, the Revenue Department, the Ministry of Public Health and other relevant authorities. Disclosure may also be necessary in connection with employment contracts, terms and conditions of employment, employee benefits, personnel development or external training, or to other persons or legal entities, such as providers of annual health examinations, health or accident insurance providers, banks used by the Company for payment of wages, salaries or other compensation, and banks, customers, creditors, business partners, or service providers where the Company is required to provide business contact information corresponding to an employee’s position, duties and responsibilities. This may also include collection, use and disclosure for the original purposes established prior to the Personal Data Protection Act B.E. 2562 (2019) coming into force.

3.6 Cross-Border Transfer of Personal Data

Where it is necessary to transfer Personal Data to an affiliated company or another person located outside Thailand, for example, transferring Personal Data to the parent company for the investigation of a whistleblowing report, the Company will comply with the requirements of the Applicable Data Protection Laws. Specific details of such transfers will be provided in the relevant privacy notice applicable to each category of Data Subject.

4. Appropriate Security Measures for Personal Data

The Company requires each department that conducts Data Discovery and maintains a Data Inventory relating to the collection, use or disclosure of Personal Data to establish appropriate Personal Data security measures where such measures are considered necessary following a risk assessment, in accordance with the Applicable Data Protection Laws.

5. Records of the Data Controller and Records of Processing Activities

The Company requires every department that carries out activities involving the collection, use or disclosure of Personal Data to maintain records of the Data Controller and Records of Processing Activities (ROPA), so that such records may be examined by Data Subjects and the Office of the Personal Data Protection Committee in accordance with the Applicable Data Protection Laws.

6. Data Processing Agreements and Data Sharing Agreements

Where the Company, as Data Controller, instructs, delegates or engages an external legal entity or individual to Process Personal Data on its behalf, the Company will enter into an appropriate Data Processing Agreement with the relevant Data Processor in order to maintain the security of the Personal Data and ensure that the Processing is carried out for the purposes notified by the Company to the Data Subject, as appropriate, necessary or required by law.

Where the Company needs to disclose or share Personal Data with another person or legal entity that is not acting as a Data Processor, in order to achieve the purposes notified to the Data Subject, the Company will enter into an appropriate Data Sharing Agreement for the protection of such Personal Data.

7. Website Security and Cookies

The Company recognizes the importance of protecting the security of its website and Personal Data collected through it, including cookies. Cookies are small computer files that may temporarily store information as necessary to facilitate efficient communication. The Company also implements measures to prevent unauthorized access, alteration, destruction or unavailability of such information using standard security technologies, including effective firewalls and antivirus software that are reviewed regularly.

8. Personal Data Breach Management

If a Personal Data breach occurs within the Company and is likely to result in a risk to the rights and freedoms of Data Subjects, employees and relevant personnel must coordinate to take appropriate action in accordance with the Applicable Data Protection Laws. The Company will notify the Office of the Personal Data Protection Committee of such breach without undue delay and, where feasible, within 72 hours after becoming aware of it. Where the breach is likely to result in a high risk to the rights and freedoms of Data Subjects, the Company will also notify the affected Data Subjects of the breach and the relevant remedial measures without undue delay.

9. Communication, Awareness and Notification of Data Subject Rights

9.1 The Company will communicate and provide appropriate notices to Data Subjects and Data Processors appointed, instructed or assigned by the Company so that they are informed of the meaning of Personal Data, the applicable practices and importance of the Applicable Data Protection Laws, Data Subject rights, this Privacy Policy and relevant Personal Data security measures.

9.2 The Company will provide training to its employees regarding Personal Data and Data Subject rights and will promote awareness of the importance of Personal Data protection. The Company will ensure that all relevant employees receive appropriate training and have sufficient knowledge and understanding of Personal Data protection, do not unlawfully collect, use or disclose the Personal Data of another person or Personal Data obtained in the course of performing their duties, and are able to comply correctly with the Company’s Privacy Policy.

10. Other Measures

10.1 Disposal and Erasure of Personal Data

The Company will establish a Disposal Policy governing the deletion or destruction of all categories of Personal Data, taking into account any statutory retention periods applicable to documents or electronic records containing Personal Data, generally accepted retention standards where a specific period cannot be determined, and applicable business arrangements or contractual obligations.

The Company will establish retention periods under its Data Retention Policy and will delete or destroy Personal Data upon expiry of the applicable retention period under this Privacy Policy. A Data Subject may exercise the right to request access to or review of their Personal Data, or request its deletion or destruction before the scheduled date, by submitting a request to the Company. The Company will consider and process the request in accordance with the Data Subject’s rights, provided that doing so does not adversely affect the rights and freedoms of other Data Subjects or conflict with applicable legal requirements.

10.2 The Company may periodically review and update this Privacy Policy, privacy notices, operational bases and Personal Data security measures, guidelines and other documents relating to Personal Data protection in order to keep them appropriate, current and consistent with applicable laws and circumstances.

Privacy Notice for Visitors in Headquarter

1. Scope of Application

This Privacy Notice applies to external visitors, including persons interested in job application, job applicants, outsourced workers/personnel, customers, raw material/product suppliers, service providers, service recipients, clients, contractors, logistics/transportation personnel, trainees/interns, business contacts, and persons associated with the Company who wish to request permission to enter the Company's premises and buildings to conduct any business with the Company and/or the Company's employees, at the head office and branch offices located within the same premises.

2. Categories of Personal Data Collected, Used, or Disclosed

(1) General Personal Data: Such as full name, signature, National Identification Card number, driver's license number, or other government-issued identification cards or cards deemed appropriate by security personnel to be used instead, personal telephone number for emergency contacts, details and license plate numbers of vehicles brought onto the premises, still images, moving images (video), and audio recorded by CCTV cameras installed within the Company's premises and buildings, and other personal data that you provide to the Company or that is recorded by devices in the entry permit document or recorded electronically in the Company’s computer system.

(2) Sensitive Personal Data: Such as epidemic vaccination records, COVID-19 or other communicable disease test results, and biometric data.

Furthermore, if the Company needs to collect, use, or disclose any type of your personal data beyond the scope of specified purposes and legal bases, the Company will process such data only upon obtaining your explicit consent or as permitted by law.

3. Purposes of Collection, Use, or Disclosure

The Company collects, uses, or discloses your personal data for the following purposes:

4. Necessity of Collection and Possible Consequences of Failure to Provide Personal Data

The Company may find it necessary to maintain the security of assets located within the Company's premises and grounds, align with the Company's internal management systems, and prevent or suppress untoward events. Therefore, it is necessary for the Company to collect, use, or disclose your personal data to fulfill the aforementioned purposes for your benefit and that of the Company.

You have the freedom and right to withhold consent or decline to fill out or provide partial or complete personal data in the entry permit form or through any other methods designated by the Company. However, if insufficient information is provided for decision-making, security personnel may not permit entry into the Company's premises and buildings.

5. Personal Data Retention Period

The Company will retain your personal data for as long as necessary to fulfill the purposes stated above, categorized by type of data as follows:

5.1 Still images, video footage and audio recorded by closed-circuit television (CCTV) cameras installed within the Company's office premises will be retained for no longer than 30 days from the date of recording or within the period as determined in the Company’s standard operating procedure, as the case maybe.

5.2 Personal data contained in the Entry Permit form/visitor registration system, and other personal data referred to in Clause 2 (1) and (2), collected for security purposes, will be retained for no longer than 6 years from the date of your most recent visit to the Company's premises.

5.3 The personal data referred to in Clauses 5.1 and 5.2 above may be retained beyond the periods specified therein in the following circumstances:

(a) where an undesirable incident or serious event has occurred in connection with such data, in which case the data will be retained until the relevant investigation or legal proceedings have concluded; or

(b) where necessary for compliance with applicable law, for the protection of the Company's legitimate rights, or to defend the Company against any claim or allegation, even where no specific incident or dispute has yet arisen, in which case the data will be retained for as long as necessary to fulfill such purposes and/or within the period prescribed by law.

6. Categories of Persons or Entities to Whom Personal Data May Be Disclosed

Your personal data may be disclosed to security personnel and supervisors, Human Resources and Administrative personnel responsible for overseeing the security unit, Information Technology officers including technical and cloud service providers, Company executives, legal and compliance officers, Data Processors, police officers, or statutory authorities where necessary or in the event of untoward incidents.

7. Cross-Border Data Transfer

In fulfilling the purposes of security maintenance and visitor management, the Company may need to send or transfer your personal data to overseas affiliates of the Company. In such cases, the Company will carry out the transfer under conditions and adequate personal data protection measures as prescribed by law to ensure that your Personal Data remains continuously protected even after cross-border transfer.

Privacy Notice for Visitors - Samyan Mitrtown

1. Scope of Application

This Privacy Notice applies to external visitors, including persons interested in job application, job applicants, outsourced workers/personnel, customers, raw material/product suppliers, service providers, service recipients, clients, contractors, logistics/transportation personnel, trainees/interns, business contacts, and persons associated with the Company who wish to request permission to enter the Company's premises and offices to conduct any business with the Company and/or the Company's employees, at the Company’s Samyan Mitrtown branch office.

2. Categories of Personal Data Collected, Used, or Disclosed

(1) General Personal Data: Such as full name, signature, National Identification Card number, driver's license number, or other government-issued identification cards or cards deemed appropriate by security personnel to be used instead, personal telephone number for emergency contacts, details and license plate numbers of vehicles brought onto the premises, still images, moving images (video), and audio recorded by CCTV cameras installed within the Company's premises and offices, and other personal data that you provide to the Company or that is recorded by devices in the Company’s computer system.

(2) Sensitive Personal Data: The Company does not collect sensitive personal data of external visitors under Section 26 of the Personal Data Protection Act B.E. 2562 (2019) (such as biometric data derived from facial recognition systems, health data, or religious data) in connection with the security procedures and entry/exit registration process described in this notice. Should the Company need to collect any additional sensitive personal data in the future, it will amend this notice accordingly and notify you prior to doing so.

Furthermore, if the Company needs to collect, use, or disclose any type of your personal data beyond the scope of specified purposes and legal bases, the Company will process such data only upon obtaining your explicit consent or as permitted by law.

3. Purposes of Collection, Use, or Disclosure

The Company collects, uses, or discloses your personal data for the following purposes:

4. Necessity of Collection and Possible Consequences of Failure to Provide Personal Data

The Company may find it necessary to maintain the security of assets located within the Company's premises and grounds, align with the Company's internal management systems, and prevent or suppress untoward events. Therefore, it is necessary for the Company to collect, use, or disclose your personal data to fulfill the aforementioned purposes for your benefit and that of the Company.

You have the freedom and right to withhold consent or decline to fill out or provide partial or complete personal data for the Company. However, if insufficient information is provided for decision-making, the Company may not permit entry into its premises and offices.

5. Personal Data Retention Period

The Company will retain your personal data for as long as necessary to fulfill the purposes stated above, categorized by type of data as follows:

5.1 Still images, video footage and audio recorded by closed-circuit television (CCTV) cameras installed within the Company's office premises will be retained for no longer than 30 days from the date of recording or within the period as determined in the Company’s standard operating procedure, as the case maybe.

5.2 Personal data contained in the Entry Permit form/visitor registration system, and other personal data referred to in Clause 2 (1), collected for security purposes, will be retained for no longer than 6 year from the date of your most recent visit to the Company's premises.

5.3 Vehicle details and license plate information used to process the reimbursement of parking fees will be retained for no less than 10 years from the date such reimbursement is completed.

5.4 The personal data referred to in Clauses 5.1, 5.2 and 5.3 above may be retained beyond the periods specified therein in the following circumstances:

(a) where an undesirable incident or serious event has occurred in connection with such data, in which case the data will be retained until the relevant investigation or legal proceedings have concluded; or

(b) where necessary for compliance with applicable law, for the protection of the Company's legitimate rights, or to defend the Company against any claim or allegation, even where no specific incident or dispute has yet arisen, in which case the data will be retained for as long as necessary to fulfill such purposes and/or within the period prescribed by law.

6. Categories of Persons or Entities to Whom Personal Data May Be Disclosed

Your personal data may be disclosed to security personnel and supervisors, Human Resources and Administrative personnel responsible for overseeing the security unit, Information Technology officers including technical and computer system/data storage service providers, Company executives, legal and compliance officers, accounting and finance personnel, Data Processors, police officers, or statutory authorities where necessary or in the event of untoward incidents.

7. Cross-Border Data Transfer

In fulfilling the purposes of security maintenance and visitor management, the Company may need to send or transfer your personal data to overseas affiliates of the Company. In such cases, the Company will carry out the transfer under conditions and adequate personal data protection measures as prescribed by law to ensure that your personal data remains continuously protected even after cross-border transfer.

Privacy Notice for Sales & Marketing Activities

1. Scope of Application

This privacy notice is intended to inform individuals involved in the Company's sales and marketing activities, such as pharmacists and pharmacy staff, physicians and medical personnel, pharmacy operator, hospital procurement officers, influencer, individual customers, participants as well as business partners, service providers, event organizer, and other individuals with whom the Company conducts business in relation to sales and marketing, whether contacted via the head office, branch offices, online channels, exhibitions and sales promotional activities, or academic conferences, both in Thailand and abroad.

2. Categories of Personal Data Collected, Used, or Disclosed

(1) General Personal Data: Such as first name and last name, date of birth, nationality, job title, name of healthcare institution/pharmacy/affiliated organization, national identification number, tax identification number, medical/pharmaceutical professional license number, telephone number, email, LINE IDs used for contact and business contact address, signatures on contract documents or payment vouchers, bank account details, attendance records of conferences/seminars or marketing activities, sales/order volume data in responsible territories (Territory Data) related to business operations, still photos and motion pictures recorded at conferences/seminars, exhibitions, or promotional activities, and for overseas business travel or exhibition attendance, namely passport details, itinerary, and accommodation details, to the extent necessary.

(2) Sensitive Personal Data: Such as food allergy details, dietary or health restrictions for catering at conferences/seminars and information regarding Adverse Events.

In this regard, information regarding Adverse Events associated with product use received by the Company through sales and marketing activities is received in a form that does not identify individual patients and cannot be linked back to the patient; therefore, it does not constitute personal data under the Personal Data Protection Act B.E. 2562 (2019). However, if the Company receives data that can identify a patient, the Company will proceed in accordance with its Pharmacovigilance Policy and process such data on a legal basis.

Furthermore, if the Company needs to collect, use, or disclose any type of your personal data beyond the scope of specified purposes and legal bases, the Company will process such data only upon obtaining your explicit consent or as permitted by law.

3. Purposes of Collection, Use, or Disclosure

The Company collects, uses, or discloses your personal data for the following purposes:

4. Necessity of Collection and Possible Consequences of Non-Provision of Personal Data

The Company needs to collect, use, or disclose your personal data to fulfill the purposes mentioned above, for the benefit of business communication, product information services, product delivery, remuneration payment, and marketing activity management.

You have full freedom and the right to withhold consent for providing partial or all personal data. However, if you do not provide necessary personal data, the Company may be unable to communicate with you, provide product information, deliver products, pay remuneration, allow you to participate in relevant marketing activities, or arrange travel and registration for overseas exhibitions.

5. Personal Data Retention Period

The Company will retain your personal data only for as long as necessary to fulfill the purposes specified in Clause 3, as follows:

5.1 General Business Communication and Marketing Data: Personal data will be retained for no longer than 1 year from the date the business relationship between you and the Company ends.

5.2 Data Appearing in Contracts, Accounting and Tax Documents, Product Delivery Documents, and Governance Records: Personal data will be retained for a period of 10 years from the date of contract expiration, accounting closure date, or product delivery date, as the case may be, to comply with applicable statutory prescription periods and accounting laws.

5.3 Data Relating to Disputes, Complaints, or Legal Proceedings: Personal data will be retained until such dispute or case reaches a final conclusion, and for an additional period of 1 year thereafter.

5.4 Other Cases: The Company will retain your personal data for a reasonable period as necessary for the aforementioned purposes depending on each category of personal data collected, or for the period prescribed by applicable law, as the case may be.

6. Categories of Persons or Entities to Whom Personal Data May Be Disclosed

The Company may disclose your personal data to sales and marketing personnel, finance and accounting personnel, legal and compliance personnel, marketing event service providers, logistics/transportation providers, airlines, hotels, ticketing and visa agencies, exhibition organizers and venue owners both domestically and internationally, affiliated companies, or other Data Processors engaged by the Company, regulatory authorities governing pharmaceutical promotions, the Revenue Department or auditors, and officers authorized by law, strictly to the extent necessary of the purposes specified in Clause 3.

7. Cross-Border Personal Data Transfer

The Company primarily stores your personal data within Thailand. However, because the Company participates in trade exhibitions and marketing activities overseas, the Company may need to send or transfer your personal data to foreign countries in the following cases:

(1) Transferring data of Company representatives, participants, or speakers to organizers, venue owners, or regulatory authorities in the host country for registration and participation purposes;

(2) Managing travel, visa applications, and overseas accommodation bookings;

(3) Submitting documents and contracts related to sales and marketing activities to the Company's Board of Directors, authorized approving authorities, or group affiliates for consideration and approval prior to entering into contracts, and for subsequent audit in accordance with corporate governance principles of the corporate group.

In carrying out the aforementioned actions, the Company will disclose only such personal data as is strictly necessary for consideration, and will redact or erase personal data that is not necessary for the audit prior to such disclosure.

Privacy Notice for Business Development & Licensing Activities

1. Scope of Application

This privacy notice is intended to inform individuals involved in the Company's business development and licensing activities, such as representatives from the Business Development, Regulatory Affairs, Supply Chain, Quality Assurance, or Sales functions of manufacturers and distributors, persons submitting complaints or reporting pharmaceutical product quality issues, business partners, and other individuals with whom the Company conducts business in relation to business development and licensing, whether contacted via the head office, branch offices, trade exhibitions, business meetings, or other locations, both in Thailand and abroad.

2. Categories of Personal Data Collected, Used, or Disclosed

General Personal Data: Such as first name and last name, job title, telephone number, email, business contact address, signatures on contract documents, payment vouchers or licenses, and information concerning persons submitting complaints or reporting pharmaceutical product quality issues.

Furthermore, if the Company needs to collect, use, or disclose any other type of your personal data beyond the scope of specified purposes and legal bases, the Company will process such data only upon obtaining your explicit consent or as permitted by law.

3. Purposes of Collection, Use, or Disclosure

The Company collects, uses, or discloses your personal data for the following purposes:

4. Necessity of Collection and Possible Consequences of Non-Provision of Personal Data

The Company needs to collect, use, or disclose your personal data to fulfill the purposes mentioned above, for the benefit of business communication and coordination, receipt of product samples, pharmaceutical product registration and license applications, management of purchase agreements, distribution agreements or license agreements, and other activities related to the Company's business operations.

You have full freedom and the right to withhold consent for providing partial or all personal data. However, if you do not provide necessary personal data, the Company may be unable to communicate or coordinate with you, receive product samples, process pharmaceutical product registrations or license applications, manage agreements involving you, or carry out other activities related to the Company's business operations.

5. Personal Data Retention Period

The Company will retain your personal data only for as long as necessary to fulfill the purposes specified in Clause 3, as follows:

5.1 Business Communication, Coordination, and Business Operations Data: Personal data will be retained for as long as necessary and in accordance with applicable laws.

5.2 Data Appearing in Contracts, Accounting and Tax Documents, Product Delivery Documents, and Governance Records: Personal data will be retained for a period of 10 years from the date of contract expiration, accounting closure date, or product delivery date, as the case may be, to comply with applicable statutory prescription periods and accounting laws.

5.3 Data Relating to Product Quality Complaints, Disputes, or Legal Proceedings: Where a product quality complaint is under review, or there is a dispute or legal proceeding, the relevant personal data will be retained for as long as necessary for the review, dispute resolution, or legal proceeding until completion, including any period for which applicable law requires such data to be retained.

5.4 Other Cases: The Company will retain your personal data for a reasonable period as necessary for the aforementioned purposes depending on each category of personal data collected, or for the period prescribed by applicable law, as the case may be.

6. Categories of Persons or Entities to Whom Personal Data May Be Disclosed

The Company may disclose your personal data to business development and licensing personnel, finance and accounting personnel, purchasing and logistics personnel, warehouse personnel, Regulatory Affairs personnel, Quality Assurance personnel, sales and marketing personnel, legal and compliance personnel, other Company departments or personnel, affiliated companies, manufacturers, distributors, business partners, competent government authorities regulating pharmaceuticals, and officers authorized by law who are responsible for or involved in the Company's operations, strictly to the extent necessary for the purposes specified in Clause 3.

7. Cross-Border Personal Data Transfer

The Company primarily stores your personal data within Thailand. However, because the Company participates in activities overseas, the Company may need to send or transfer your personal data to foreign countries in the following cases:

(1) Because most manufacturers, distributors, and business partners with whom the Business Development and Licensing function works are located overseas, the Company generally needs to transfer your personal data to manufacturers, distributors, and business partners abroad for the purposes specified in Clause 3;

(2) Where responsibility for a product quality complaint is addressed in accordance with the specified conditions, the Company may transfer a summary of the incident (such as the production lot number and number of affected units) to the overseas manufacturer for negotiation. Such summary generally does not constitute personal data, except where it is necessary to include general characteristics of affected persons (such as sex and age range) for purposes of making a product liability insurance claim;

(3) Submitting documents and contracts related to business development and licensing activities to the Company's Board of Directors, authorized approving authorities, or group affiliates for consideration and approval prior to entering into contracts, and for subsequent audit in accordance with corporate governance principles of the corporate group.

In carrying out the aforementioned actions, the Company will disclose only such personal data as is strictly necessary for consideration, and will redact or erase personal data that is not necessary for the audit prior to such disclosure.

Personal Data Collected, Used and Disclosed Prior to the Effective Date of the Personal Data Protection Act B.E. 2562 (2019)

The Company hereby informs you that the Company will continue to collect, use or disclose existing personal data for its original purposes. You may withdraw your consent by submitting a written request in accordance with the Company's Regulations on Personal Data Access and Rights. If it becomes necessary for the Company to disclose such personal data, the Company will proceed in accordance with applicable legal requirements.

Contact Details

To exercise Data Subject rights, submit an identity verification request, or for any questions regarding personal data protection, please contact us at:

Data Controller: OLIC (Thailand) Limited

Address: 166 Moo 16, Bangpa-in Industrial Estate, Udomsorayuth Road, Bang Krasan

Subdistrict, Bangpa-in District, Phra Nakhon Si Ayutthaya Province 13160,

Thailand

Telephone: 035-221031-6 Ext. 0

Email: pdpa@olic-thailand.com

The Company hereby notifies you of your rights and privacy. Any amendments or updates to this notice will be announced, posted, or communicated to you accordingly.