1. Introduction

       Airports of Thailand Public Company Limited is aware of and recognize the importance of personal data protection of its visitors and service users (“you”). AOT shall handle and manage your personal data with transparency and justice according to the requirements of the personal data protection law as well as other applicable laws.

       This Privacy Notice (“Notice”) is to inform you of how AOT collects, uses, discloses, and protects your personal data.

       AOT advises you to read and understand this notice before providing your personal data to AOT. Should you have any concerns, inquiries, or questions regarding this notice, or other relevant notices and policies, please feel free to contact AOT through the channels provided at the end of this notice.

2. Your Personal Data

       Personal data is any information pertaining to data subject that enable to identify the data subject, whether directly or indirectly such as first name, last name, citizen identification card number, telephone number, birth date, passwords, photos, CCTV records, biometric data such as facial, fingerprint etc., but excluding the data of a deceased person.

       In general, AOT collects personal data provided by you to AOT directly such as filling out the form, giving information through telephone conversation or websites or applications provided by AOT. In some cases, AOT may obtain your personal data from third parties whom AOT honestly trusts that they have the right to collect and disclose your personal data to AOT, and furthermore AOT shall collect personal data only as necessary to fulfill the purpose under the law or as AOT is required by the law to collect personal data.

       AOT is required by the law to collect your personal data when you contact AOT or use a website or application of AOT such as the IP address. In order to facilitate the website or application service. AOT may use matic technologies to collect your usage data including cookies, web beacons, pixel tags, and other similar tracking technologies hereinafter referred to as “cookies” in which you may read the detail of the cookies on AOT website.

       As stipulated in the Personal Data Protection Law, some types of information are defined as sensitive data such as race, religion, sexual orientation, political opinion, disability, genetic data, biological data, and health record etc., which shall be collected according to the law and with your consent. AOT shall collect sensitive data only when necessary and clearly inform you of the reason as well as obtaining your consent to collect sensitive data in some cases.

       For personal data of a juvenile, quasi-incompetent, and incompetent person (“legal transaction restricted persons”), AOT shall process the personal data of such legal transaction restricted persons only when necessary and according to the Personal Data Protection Law. Furthermore, when it is necessary for AOT to process the personal data of legal transaction restricted persons for any activities, AOT shall obtain consent from their parents, guardians, caregivers, or governing bodies who are the legal representatives of such persons (as the case may be), except when processing the personal data of a juvenile who is over 10 years old and such processing is specific to the person, reasonable, and vital for their living, then the juvenile may give consent by themselves.

       AOT may collect your personal data as follows:

       1) When you contact AOT, join an activity, or receive any services of AOT. In case, surveys and researches are, conducted by AOT, the following personal-data may be collected:

       - Identity data such as name, surname, and ID card number.

       - Contact data such as your E-mail address, telephone number, address, social media, contact data and work location.

       - Work history such as occupation, job position, and organization.

       - Technical and usage data such as your IP address when you use an online service of AOT.

       - Other information voluntarily provided to AOT.

       2) When entering the premises of AOT, AOT may record your pictures by using a CCTV system. However, AOT has posted the warning signs for using CCTV system in its premises.

       3) When entering the premises of AOT where AOT holds a meeting, seminar, public hearing, or any activities. AOT may record pictures or videos of the activities for evidence or promotion of AOT. However, AOT has posted the warning signs for using CCTV system in such area.

3. Purpose of Personal Data Collection

       If necessary, AOT may have to collect, use, or disclose your personal data for the following purposes.

       1) To provide services or activities of AOT to you.

       2) To provide assistance and answer your questions or complaints.

       3) To survey and collect statistical data on electronic transactions for the country with anonymous analysis and an overall summary.

       4) To analyze and inspect activities or services for further improvement including conducting satisfaction surveys, research, and development of new innovations to provide you with more convenient and better service experience of AOT.

       5) To support the operations of the Electronic Transactions Committee and the Management Committee of the Electronic Transactions Development Agency.

       6) Job recruitment.

       7) Procurement and supply management of AOT.

       8) Receipt and disbursement or other financial and accounting operations of AOT.

       9) To promote the activities and news of AOT to you and invite you to join the activities of AOT.

       10) To prevent illegal actions by checking the records including CCTV records to maintain vigilance, detection, and prevent illegal actions.

       11) To perform duties under its policies, regulations, or applicable laws.

4. How AOT is Permitted to Collect, Use, and Disclose Your Personal Data?

       AOT shall collect, use, and disclose your personal data as necessary and in compliance with the Personal Data Protection Law which stipulates variety of principles and legal justifications for every different situation allowing AOT as a data controller under the law to collect, use, and disclose your personal data.

       In general, AOT shall collect, use, and disclose your personal data with a legal justification as follows:

       - When AOT obtain consent from you or your representative.

       - When necessary to fulfill contractual obligations made between you and AOT or to take step at your request before entering the contract with AOT.

       - When necessary to protect or suppress a danger to a person’s life, body or health.

       - When necessary to perform its public tasks or official authority.

       - When necessary for legitimate interests of AOT or any other persons or juristic persons, except where such interests are inferior to basic rights of your personal data.

       - When necessary to maintain public historical documents, archives, research, or statistical data with proper security measures to protect your rights and freedom according to the announcement of the Personal Data Protection Committee.

       - When necessary to fulfill its legal obligations.

       This notice defines the main principle and guideline (main notice). AOT conducts many activities and provides many services both internal and external some of which are legal obligations of AOT. Each activity requires AOT to collect, use, and disclose your personal data. A relevant department of AOT which is responsible for collecting your personal data shall explain and provide you with details of the collection, use, and disclosure of your personal data in each activity or service.

5. Your Right to Personal Data

       Data subjects have rights under the Personal Data Protection law. Also, it is of utmost importance that AOT protects and facilitates you as a data subject in exercising the following rights:

       1. The right to be informed: AOT shall announce its “Privacy Notice” with a clear purpose of the collection, use, and disclosure.

       2. The right to withdraw consent: You may revoke your consent given to AOT at any time.

       3. The right to access data: You may request to access to and obtain a copy of your personal data, and request AOT to disclose the acquisition of the personal data obtained.

       4. The right to correct data: You may request to correct, complete, and update your personal data to prevent misunderstandings.

       5. The right to delete data: You may request AOT to delete, destroy your personal data, or make it anonymous.

       6. The right to transfer data: If the information system of AOT supports formats readable by common or automatic devices and able to use or disclose personal data through electronic means, you may request to receive a copy of your personal data and request AOT to transfer the data to another data controller through automatic means and request to receive the transferred or sent data.

       7. The right to suspend data: You may request AOT to suspend the use of your personal data.

       8. The right to object to data processing: You may object to personal data processing.

       In some cases, AOT may deny such requests with a legal justification, in fulfilling a legal purpose, legal requirement, or court order, or when the request may harm the rights or freedom of the data subject or other persons.

       If you wish to exercise your rights, please follow the guidelines on the AOT website to check and exercise your rights.

6. To whom AOT Disclosed Your Personal Data?

       AOT shall not disseminate, distribute, give, exchange, transfer, or disclose your personal data collected by it to an outsider except in fulfilling the purpose provided herein, or with your consent, or upon your request, or in some situations as below:

       · When AOT honestly believes that it is following the law or the instruction of a competent authority, court warrant, court order, or justice process.

       · When AOT is sharing data with a reliable organization working for or on behalf of it under an agreement or contract binding the organization to follow the Personal Data Protection Law same as AOT. The data sharing may include the collection and use of your personal data in order to provide services to you or conduct activities or projects of AOT such as data analysis and survey, and promotion, etc.,

       · In a situation where AOT honestly believes with a good reason that disclosing your personal data is more important than protecting your personal data and it rarely occurs as follows:

             - For investigations, interrogations, crime suppression, anti-fraud, anti-corruption purposes, or;

             - For protection or response to against threats and acts that may harm the rights, assets, or safety of the public, AOT, and relevant persons.

             - For protection or response to acts of violations of the AOT usage agreement or the law.

       When AOT is concerned about your physical safety or deems that an action must be taken to protect you from a threat or act that may be harmful to you, AOT shall discuss it with you, and if possible, AOT will seek your permission to inform the situation you are facing to other persons who need to know before taking the action.

       In that case, AOT shall record the data disclosed for each reason and each circumstance for evidence and for your information on how AOT has taken action with your personal data.

7. How does AOT Protect Your Personal Data?

       AOT is aware that you provide your important information out of trust. As a data controller, AOT is required by the law to provide security measures and management to secure the data and allow the data subjects to access and check.

       However, please note that AOT cannot guarantee the security of your data when you transfer data through a public network, public computer, or even your own computer or communication device that has been infected with malware that may harm you by accessing, disclosing, or transferring your data without permission.

       Therefore, in recognizing the importance of data security, AOT determines control measures for information technology security management system that meets the ISO/IEC27001 standard and announces its AOT ICT Security Policy together with AOT ICT Security Guideline on www.airportthai.co.th where you can find more information.

8. Data Retention Period

       AOT stores, uses, and processes your personal data in a system based in Thailand. However, in some cases, it may be necessary to transfer the data to be stored or processed in another region or country which AOT shall always check to ensure that the transfer is secure and the data receiver has a data protection measure that meets the standard defined by the law, and third parties involved in the data transfer, storage, or processing are bound by a data protection agreement according to the requirements of AOT.

9. Personal Data Retention Period

       AOT shall retain your personal data for the duration necessary to perform its duties and services for legitimate purposes. The retention period may vary depending on the activity and service type. You may find the detail in each activity and service.

       However, AOT may need to retain your personal data for a longer period if AOT is notified or honestly believes that a breach of the AOT usage agreement, a violation of law, or a dispute has taken place, and an investigation, interrogation, or evidence collection is required for a legal process. AOT shall retain your personal data until the end of the legal process or as required by the applicable laws.

10. Link to Third Party Services

       Some services of AOT may link you to the third-party website, application, or service which is provided by AOT for your convenience only. If you choose to follow such links, you will exit from AOT services and enter another platform that is not associated with AOT. As a result, AOT may not verify or control the accuracy and reliability of such websites, applications, or services.

       This notice shall be applied to services of AOT only. If you follow such links to the third-party service not covered by this notice, please read and understand their personal data policy or notice before using the service.

11. Revisions of the Notice

       AOT may revise this notice from time to time to ensure that the content is suitable, updated, and in compliance with the Personal Data Protection Law and other applicable laws. If there is any revision to this notice, AOT shall display the latest version on AOT website and may notify you through proper channels. Please read and check this notice regularly, especially before sending your personal data through AOT services.

       If you continue to use a service of AOT after a revision has been made to this notice and displayed accordingly, it shall be deemed that you have agreed to and accepted the revised version.

12. Contact AOT

       Should you have any inquiries, suggestions, opinions, comments, or wish to learn more about this notice, please feel free to contact AOT through the following channels:

             Airports of Thailand Public Company Limited

             333 Cherdwutagard Road, Srikan, Don Mueang District, Bangkok 10210 Telephone 0 2535 1192 Fax 0 2535 3864, 0 2535 5685

             AOT Contact Center 1722

             Website: www.airportthai.co.th E-mail Address: aotpr@airportthai.co.th

                   Announced on June 1st, 2022