Privacy Policy

Olive Technology Co., Ltd. ("Olive", "the Company") recognizes and attaches great importance to the protection of the personal data of the data subject ("you") and strictly adheres to the principle of respecting your right to privacy.

This Personal Data Protection Policy ("Policy") is therefore created to inform you about the format, purpose, methods of collecting, using, or disclosing (collectively referred to as "processing") personal data, as well as your rights and the retention period of such personal data under the Personal Data Protection Act B.E. 2562 (2019) and related announcements and regulations.

In processing your personal data for the purposes outlined in this policy, the company acts as a Data Controller, meaning it has the authority and responsibility to decide on the collection, use, or disclosure of your personal data.

Definitions

"Policy" refers to the Personal Data Protection Policy of Olive Technology Co., Ltd.

"You" refers to the data subject.

"User" means anyone accessing the Company's website (including olive.co.th and oliveflow.io), mobile applications, software systems, platforms, and any other products or services of the Company (collectively referred to as "Services").

"Shareholder" means a person who holds shares or securities of a company. This includes authorized representatives or proxy holders of such persons.

"Director" refers to a person elected or appointed to the company's board of directors and various sub-committees.

"Board of Directors" refers to the persons who are the directors of the company.

"Sub-committees" refer to the persons who are members of various sub-committees, such as the Audit Committee, Risk Management Committee, Nomination and Remuneration Committee, Executive Committee, etc.

"Employee" means a person who performs work for the company and receives wages, benefits, or other compensation in return for their work, excluding contractors or service providers who are business partners of the company.

"Consultant" means a person or related person who engages in a profession, business, or provides consulting or advisory services in various fields such as engineering, architecture, urban planning, law, finance, environment, technology, etc., to the company.

"Internship" refers to an individual selected by the company from applicants for internship positions.

"Job Applicant" refers to an individual who expresses their desire to apply for a job, or an individual who may be selected as an employee of the company. The company may collect the applicant's personal information directly or obtain it from external parties.

"An Internship Applicant" refers to an individual who expresses their desire to apply for an internship with the company. The company may collect the applicant's personal information directly or obtain it from external parties.

"Landlord" refers to a person who owns the rights to the land and buildings and leases such space to the Company.

"Partners" refers to subcontractors, vendors, persons who supply goods and/or services to the Company, or bidders, as well as contracting parties or any persons involved in the Company's business operations, business partners, associates, and joint ventures, such as directors, employees, agents, or personnel of those related to the business partner, including those who are likely to become business partners.

"Visitor" refers to anyone entering the company premises, including individuals at the head office, branch offices, or construction sites where the company is building, as well as contacts to the company telephone number and participants in any company activities, whether such activities are organized by the company itself, by individuals hired by the company, or by the company in which it participates.

"Related Parties" refers to any person who is involved with or represents a potential business partner or existing business partner, such as directors, employees, agents, representatives, grantors, witnesses, or those acting on behalf of a legal entity. It also includes individuals whose personal information appears in documents related to the contractual process, such as suppliers or recipients of goods.

"Activity" refers to information related to the company's activities, such as information about activities or events you have participated in or registered for, details of your payments and financial transactions related to those activities, etc.

"Personal Data" refers to information about an individual that makes it possible to identify that person, directly or indirectly, but excludes information about deceased persons.

"Sensitive Personal Data" refers to personal data concerning race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal history, health information, disability, trade union information, genetic data, biometric data, or any other data that similarly affects the data subject, as determined by the Personal Data Protection Committee.

This policy is part of, and is subject to, Olive's Terms of Use ("Terms of Use"). By using the company's services, you acknowledge that you have read, understand, and accept this Privacy Policy.

1. The Company's Role as Data Controller and Data Processor

Generally, Olive operates in the following roles:

• Personal Data Controller: When the company collects and processes personal data for the company's own business purposes, such as website visitors, user account registration, marketing, and recruitment.
• Personal Data Processor: When the Company processes personal data on behalf of its business customers ("Customers") who use the Company's services in conducting their business.

In cases where Olive acts as a data processor, the company will only process personal data at the client's request. The client will remain the controller of their personal data and will be responsible for determining the legal basis and purpose of the data processing.

2. Personal Data Collected by the Company

2.1 Information You Provide Directly to the Company

The Company may collect personal data that you voluntarily provide, including but not limited to:

• Personal details such as title, first name, last name, national identification number, nationality, signature, address, and identifying information.
• Contact information such as address and telephone number, fax number, email, Line ID, emergency contact information, and reference information, online chat, social media, etc.
• Account information such as bank account number, account name, bank/branch where the account was opened, and other information appearing on the bank passbook.
• Information from the business card, such as occupation, job title, and workplace.
• Information regarding shareholdings or securities, such as the number of shares, bank accounts used for dividend payments, etc.
• Information for directors, such as compensation details, training, activities, marital status, information about spouses/partners, children, parents, siblings, blood type, bank account numbers, email addresses, educational background, occupation, work history, and positions held as a director or in other companies or businesses, attending board meetings or sub-committee meetings, or shareholder meetings, directors' remuneration, information on securities holdings, names of securities companies, directors' performance results, and other information as required by law or good corporate governance principles, including benefits and the use of such benefits; information on joining and leaving the company; disbursement of expenses and advances; attending meetings; voting; expressing opinions; and casting votes at meetings.
• Information for employees, consultants, and interns, such as marital status, military status, family information, educational and training information, qualification certificates (e.g., educational institution, faculty, academic year, etc.), diplomas, transcripts, language proficiency, computer skills, work potential assessments, test results, information on participation in activities during studies, etc.
• Information related to job applications, such as resumes, work history, educational background, and information appearing in the job application documents and employee recruitment documents of the company; interview information; letters and documents containing information in the interview evaluation form, etc. (e.g., information evaluating knowledge, skills, experience, personality, teamwork, and work performance, etc.)
• Information related to various company legal transactions, such as copies of national identification cards, power of attorney documents, contracts, etc.
• Information related to work and performance evaluation, such as employee ID, position, department, and chain of command. Information on the use of the employer's communication and information systems, performance evaluations, performance evaluation results and evaluator's comments, information on work behavior, past work history, employee loan information, training information, resignation letters and reasons for resignation, company entry and exit records, expense claims and advances, approval of tasks under one's responsibility, access to, printing, and copying of data stored in the company's systems, and use of email systems, absences or leave, exercise of rights under labor protection laws or company welfare benefits, complaints, warnings, and disciplinary actions, and termination of employment (e.g., resignation/termination, reasons for termination, termination date, start date, probationary period end date, number of working hours, leave history and reasons for leave, login records of various company systems, etc.).
• Information related to benefits and compensation, such as salary, wages, compensation, welfare, bonuses, bank account numbers, beneficiary information, social security information, provident fund information, amounts deducted for various funds, tax information, and health benefits information (including family information). Information related to company benefits, leave history, loan eligibility, salary deduction consent, invoices, receipts related to employee benefits, etc.
• Information for reporting conflicts of interest, such as shareholding information, information on relationships between company employees and personnel, and company business partners, etc. Other personal information that you have provided to the company, such as other personal information of related parties, which you certify to the company that you have obtained consent from the related parties to disclose the information to the company, including consent for the company to process the personal information of that person for the purposes specified in this announcement.
• Internship information: The company may collect additional personal information such as information about parents or guardians, bank accounts for payment (if any), and information related to the internship (e.g., personality, behavior, attitude, skills, ability to work with others, or other information to be used in evaluating the internship).
• Information of job applicants and interns, such as information about education, training, experience, professional information, certificates, qualifications, transcripts or scores demonstrating language proficiency or other relevant skills, computer skills, and other information provided in your resume (CV), etc. Information related to job or internship applications (as applicable), such as personal history, work history, educational background, and information appearing in the job application documents and supporting documents for employment with the company (e.g., copy of national ID card, copy of name change certificate, copy of house registration, copy of birth certificate, social security registration form, consent form for background check, employment contract, etc.), job interview information, including documents and feedback forms found in interview evaluations, etc.
• Information for the land lessor, such as information appearing on the leased land title deed (e.g., title deed number, land number, land plan), details of transferred water and electricity meters, the leased property, and the leased area and site plan, information on buildings, the lease agreement, supporting lease documents, a copy of the land title deed, and information about the land and buildings, such as building permits or other permits.
• Information identifying the status of business representation, such as guarantors, collateral providers, senior management positions, directors, authorized signatories, shareholders, or representatives, sub-representatives, operators, agents, employees, and staff of legal entities that have participated in or will participate in various transactions with the company.
• Information used as supporting evidence for registering as a business partner with the company or for various transactions, such as personal information appearing in copies of national ID cards, name change certificates, and household registration documents. Copies of power of attorney documents, company registration certificates, invoices, receipts, payment vouchers, and any other documents used for identification and identity verification.
• Upon entering the company premises, images will be captured by closed-circuit television cameras ("CCTV cameras"). The company will post signs indicating that CCTV cameras are in use within the company premises. The collection of personal data will be in accordance with the Privacy Notice for CCTV cameras.
• Visitor records, including identifying information such as name and surname, national identification number, photograph, signature, vehicle registration number, as well as information related to the company's activities.

2.2 Data Automatically Collected

When you use our services, the company may automatically collect the following data:

• System log and usage data — Such as Internet Protocol (IP) address, browser type, Operating System (OS), access date and time, and usage pattern.
• Location data — If enabled on your device, the company may collect location data, such as GPS coordinates, for logistics services, route planning, or vehicle tracking. You can disable access to such data through your device settings.
• Cookies and analytics — Information collected through cookies or similar technologies, including analytics services such as Google Analytics.

2.3 Data from Other Sources

The Company may receive personal data from third parties if you choose to connect your Olive account with third-party services (e.g., Single Sign-On) under that third party's policy.

3. Legal Basis for Data Processing

The Company processes personal data under one of the following legal bases:

• 3.1 Contractual Compliance — To fulfill contracts to which you are a party, such as lease agreements, service agreements, central service agreements, contracts for services, various service contracts, or any other contracts, or to perform duties according to or prior to entering into a contract, as the case may be.
• 3.2 Legal Compliance — To perform duties as required by law, such as tax laws, computer laws, and other laws that the company is obligated to comply with.
• 3.3 Legitimate Interest — For the legitimate interests of the company, within the limits that you can reasonably expect, and without violating your fundamental rights or freedoms.
• 3.4 Prevention or Suppression of Harm — For the purpose of preventing or suppressing potential harm to the life, body, or health of individuals, such as emergency contact, control of infectious diseases, recording temperature, and recording your travel history.
• 3.5 Consent — The company will request your consent if required by law or if there is no reason for the company to use the aforementioned processing bases to process the personal data collected from you.

4. Purposes of Using Personal Data

The company uses personal data for the following purposes, based on appropriate legal basis in each case:

4.1 Service Users

• Providing and managing user accounts, including creating, managing, and maintaining accounts, as well as providing related services appropriately and continuously.
• Communicating and supporting customers, such as answering questions, providing advice, and assisting with various issues.
• Marketing and public relations with consent: To send news, special offers, or other related marketing information. You can withdraw your consent at any time through the channels specified by the company.
• Security, legal compliance, and enforcement of terms and conditions: To prevent malicious acts, and to conduct security checks, compliance with relevant laws, and enforcement of terms and conditions.
• Other purposes as declared at the data collection point, including specific purposes for which you provided consent at the time of data collection.

4.2 Directors, Shareholders, Board of Directors, and Various Sub-committees

• Calling, arranging, and conducting shareholder/board meetings, including identity verification, sending relevant documents, and implementing resolutions or activities of the meeting, as well as complying with orders of authorized government agencies, in accordance with the Public Company Limited Act B.E. 2535 and other relevant laws.
• Management of registration, proxy voting, management of shareholder rights and obligations, capital increase/decrease, business restructuring, changes to registration details, shareholder meetings, nomination and appointment of company directors, board meetings, accounting and reporting, document verification according to law, and delivery of documents or letters, including legal obligations of limited companies, public limited companies, or companies listed on the Stock Exchange of Thailand (as applicable).
• Recording meeting minutes, preparing meeting reports, and submitting them to relevant agencies (e.g., the Stock Exchange of Thailand, the Securities and Exchange Commission, the Department of Business Development, the company's legal counsel, shareholders), including publishing details on the company's website or communication channels as necessary.
• Payment of dividends to shareholders, repayment of principal and/or interest, issuance of financial and tax documents such as tax invoices, receipts, invoices, or other documents as required by law.
• The selection process, qualification verification, preparation and implementation of contracts related to directors, including the payment of compensation and granting of various benefits.
• Communicating and providing necessary information for company management and investor relations, including using information for the selection process of eligible participants in activities as deemed appropriate by the company.
• Preparing, recording, and reporting on various activities as evidence of participation, registration for meetings, and voting.
• Recording of photographs or videos (including CCTV) for security measures. Reporting and publicizing activities through electronic and print media, which may include images of you participating in the event, and may include your name as necessary for the purposes of the event.
• Analyzing data to plan activities and provide facilities such as venue arrangements, food and beverages, transportation, and souvenirs (if any), including arranging insurance or travel insurance if necessary.
• Company management, risk management, internal control, oversight, internal audit, good corporate governance, fraud monitoring and prevention, and the exercise of legal rights. Litigation and compliance with subpoenas, court orders, or orders from government agencies or independent organizations with authority.
• Maintaining a database of the company's stakeholders and/or using the data for relationship management or related communication with the company.
• Preventing and mitigating harm to your life, body, or the health of others, such as contacting relevant parties in emergency situations or implementing disease control measures as required by law.

4.3 Employees, Consultants, and Interns

• Pre-employment and contractual procedures; onboarding/internship; performing duties according to the employment contract or agreement; payroll approval; benefits and perks; training; transfer to other company departments or projects; performance evaluation; data processing for payroll, salaries, bonuses, compensation, or other benefits; as well as health and safety care.
• Creating and updating databases/registrations, coordinating communication, preparing certificates, internal publications, preparing reports, handling registration procedures, and delegating authority as needed.
• Preparing and submitting applications for licenses, petitions, or official documents to relevant government agencies; storing licenses/official documents; preparing, amending, changing, or canceling various contracts and conducting any legal transactions on behalf of the company, including demanding payments, receiving payments, and making payments; auditing the company's operations by external individuals or legal entities as necessary; and disclosing necessary information to such individuals or agencies.
• Handling cash receipt and disbursement processes, issuing accounting/tax documents, and submitting necessary information to relevant agencies.
• Compliance with the provisions of applicable laws, regulations, and rules (e.g., labor law, labor relations law, social security law, provident fund law, tax law, occupational safety, health and working environment law, etc.), including reporting or disclosing information to regulatory authorities as necessary.
• The establishment, use, or contesting of claims; the initiation of litigation; and the enforcement of legal judgments.
• Information security; monitoring, maintaining peace and order, and ensuring the safety of company personnel and property (including access control to areas/buildings and the use of CCTV systems as necessary); investigating complaints and fraud; disciplinary measures and disciplinary records; conducting employee opinion and satisfaction surveys; and providing facilities.
• Preventing and mitigating harm to life, body, or health; handling emergency situations; implementing disease control measures; and recording your temperature or travel history as necessary and appropriate.
• Specific purposes as informed by the company at the time of data collection or as you have given your consent.

4.4 Job Applicants and Internship Applicants

• Recruitment and communication related to job positions or internship programs, selection and evaluation of qualifications, scheduling interviews, preparing internship or employment contracts if selected, and maintaining order and security for company personnel and property as needed.
• Compliance with the provisions of applicable laws, regulations, and bylaws (e.g., occupational safety, health, and working environment laws), including actions related to legal processes or litigation.
• Preventing and mitigating harm to your life, body, or the health of others, such as emergency contact, infectious disease control measures, temperature recording, and travel history, as necessary.
• Specific purposes as stated during data collection or as per your consent (if applicable).

4.5 The Lessor of the Space

• To create and maintain the company's database and related communications.
• To prepare and submit applications for licenses, petitions, or any documents to relevant government agencies, including the filing of licenses and official documents, and the registration of lease rights.
• Contracts and legal transactions: To prepare, amend, change, or cancel various contracts and perform any legal transactions on behalf of the company, including related authorizations. To request, collect, receive and make payments, and issue/receive necessary financial and tax documents.
• To audit the company's operations in various areas by external individuals or entities as necessary, including disclosing personal information as required to such individuals or entities.
• To comply with the provisions of laws, regulations, rules, and lawful orders of relevant government agencies or officials, including actions related to legal processes or litigation.
• To prevent and suppress danger to your life, body, or health, or the health of others, such as emergency contact, disease control measures, temperature recording, and travel history checks, as necessary.
• The specific purposes for which the company has informed you when collecting data, or for which you have given your consent.

4.6 Business Partners

• Pre-contract and business continuity: Communication, suitability and qualification assessment, requesting/receiving proposals, bidding, and tendering.
• Partner registration and electronic transactions: Request processing, approval, identity verification, partner registration/updating, signing and using electronic transaction services.
• Procurement and Contract Management: Preparing/receiving goods and services, project tracking, relationship management, auditing and evaluating work according to purchase orders, contracts, or other related documents.
• Contract Document and Registry Maintenance: Maintaining, editing/updating the list and history of business transactions between the company and its partners; storing contracts and related documents in the company's registry.
• Finance, Accounting, and Taxation: Account creation, payment receipts and disbursements, account debiting, reconciliation, and auditing. Maintaining account/bank account numbers (and credit/debit card numbers where necessary), refunds, issuing receipts, invoices, billing, and other account-related operations.
• Debt collection, dispute resolution, and rights protection: Managing claims and disputes; establishing, exercising, or contesting claims; litigation; and legal enforcement.
• Governance, risk, and auditing: Corporate structure management; reporting; internal controls; risk management; security; auditing; finance and accounting; systems; and business continuity procedures.
• Fraud prevention and trustworthiness verification: Monitoring, preventing, identifying, and verifying fraud, money laundering, terrorism, or other related offenses, including verifying the trustworthiness of individuals in relation to trading partners, as necessary.
• Corporate transactions: Transfers, mergers, business restructuring, or similar events that may require disclosing or transferring your personal information to third parties involved in such transactions, as necessary.
• Future contract analysis and management: Using this data as a basis for analysis, preparing activities, implementing contracts, and managing future contracts or subsequent contract extensions.
• Stakeholder database and relationship management: Maintaining a database of the company's stakeholders and/or using the data for relationship management and related communication.
• Compliance with laws and disclosure to relevant authorities: Compliance with the provisions of laws, regulations, rules, and lawful orders of relevant government agencies or officials, including actions related to legal processes or litigation, and reporting/disclosure of information to regulatory authorities as required.
• Health, Safety, and Emergencies: Preventing and mitigating harm to your life, body, or the health of others when entering the company premises, such as emergency contact procedures, infectious disease control measures, temperature recording, and travel history checks as necessary.
• Purpose as declared at data collection point: The specific purpose for which the company has informed you at the time of data collection or as you have given your consent.

4.7 Visitors

• Controlling building/area access, security, crime detection/prevention, and CCTV footage collection as needed and for appropriate periods.
• Compliance with relevant laws (e.g., safety, occupational health and environment, infectious disease control) and legal processes.
• Other purposes requiring consent.
• Contacting in emergency situations and taking actions to prevent harm to life, body, or health.

5. Disclosure of Personal Information

The company does not sell or exchange your personal information for commercial purposes and will only disclose information when necessary for the stated purposes and under the following conditions:

1. External service providers involved in providing such services. The Company may disclose information to external service providers, such as information technology service providers, payment service providers, or system support service providers, to provide you with efficient services.
2. Subsidiary companies or in cases of business restructuring. This includes mergers, acquisitions, transfers of rights, business sales, or organizational restructuring. Information will be disclosed as necessary to support such processes.
3. Complying with laws or orders from government agencies. When the company is required to disclose information to comply with laws, regulations, court orders, or orders of legally authorized agencies.
4. Upon obtaining your consent. In cases where consent is required, the company will only disclose information after receiving your explicit consent, and you can withdraw your consent at any time.

6. Cookies and Similar Technologies

The company uses cookies and similar technologies to provide services, analyze data, improve performance, and enhance your user experience. You can configure your browser to reject or limit the use of cookies, but blocking certain types of cookies may result in some services not functioning fully.

7. Data Security

The company employs appropriate administrative, technical, and physical measures, such as data encryption, access control, and other security measures, to protect your personal data. However, even with these appropriate standards, complete security cannot be guaranteed in all cases.

8. Data Retention Period

The company will retain your personal data for only as necessary for the purposes of processing and for the period required by law. Once the data is no longer needed, the company will permanently delete, destroy, or anonymize it.

9. Rights of Data Subjects under the PDPA

The Personal Data Protection Act B.E. 2562 (2019) stipulates that you have various rights to inspect, control, and protect your personal data to a greater extent. You can exercise these rights according to the principles, methods, and conditions prescribed by law, as follows:

9.1 Right to Withdraw Consent

If the processing of your personal data relies on your consent, you have the right to withdraw your consent at any time while the company retains your data. However, withdrawing consent will not affect processing that has already been carried out prior to the withdrawal.

9.2 Right to Access Personal Data

You have the right to request access to your personal data, to request a copy, and to request that the company disclose the source of personal data that has been collected, used, or disclosed without requiring your consent, except where the company has the right to refuse by law, court order, or where the request may affect the rights and freedoms of other individuals.

9.3 Right to Transfer Personal Data

You have the right to request personal data in a format that can be automatically read or used, and you have the right to have the Company send such data to another data controller or send it directly to you, unless there are technical limitations that prevent this from being done.

9.4 Right to Object to the Processing of Personal Data

You have the right to object to the processing of your personal data if the processing is based on legitimate interest or for the public interest, unless the Company can provide more legitimate reasons or reasons necessary for the establishment of a claim, compliance, or defense of a legal claim.

You also have the right to object immediately if you wish to refuse processing for direct marketing purposes.

9.5 Right to Delete or Destroy Personal Data

You have the right to request the Company to delete, destroy, or anonymize your data if the data is no longer needed for the intended purpose, you withdraw your consent and there is no other legal basis to support it, the processing is unlawful, you object to the processing and there is no more valid legal reason.

9.6 Right to Suspend the Use of Personal Data

You may request the company to suspend the processing of your personal data in the following cases: Your request is being verified; the data needs to be deleted or destroyed, but you wish to have its use suspended instead; the company no longer needs the data, but you wish to use it for establishing, complying with, or exercising legal rights.

9.7 Right to Correct Personal Data

You have the right to request that the company correct your personal data to ensure it is accurate, complete, up-to-date, and does not cause misunderstanding.

9.8 Right to File a Complaint

If you believe that the company has processed your personal data in violation of or without compliance with the law, you have the right to file a complaint with the Office of the Personal Data Protection Commission.

If you wish to exercise your rights, you can do so through the "Data Subject Right Request Form," which can be obtained from the Data Protection Officer (DPO) of the company.

Processing Time After You Exercise Your Rights

We reserve the right to refuse the request as described above in the following cases:

• The law grants the company the right to refuse your request.
• The requested personal data is anonymous or does not adequately identify the data subject.
• The requester lacks proof that they are the data subject or are authorized/have a vested interest in acting on behalf of the data subject.
• No personal data is stored or collected by the company.
• The data subject or an authorized person/stakeholder has requested the company to perform the same actions or provide the same content repeatedly, excessively, or without reasonable justification.

10. Information of Minors

The company's services are not intended for minors as defined by law, and the company does not collect personal data of minors without proper consent.

11. International Data Transfer

Your personal data may be transferred to other countries. The company employs appropriate data protection measures, including contractual, technical, and security measures, to comply with applicable laws and protect your rights.

12. Changes to the Personal Data Protection Policy

The company will modify its security measures to enhance the security of personal data in a manner appropriate to and in accordance with legal standards.

If a company changes its personal data protection policy, the company will notify the data subject by publishing it on the company's website, on bulletin boards, electronic media, or other appropriate channels for communicating with the data subject.

13. Contact and Data Protection Officer (DPO)

For any inquiries, requests, or complaints, please contact: