Whistle-Blowing Privacy Notice

MFEC Public Company Limited (the “Company”)

In case that you contact MFEC Public Company Limited (the “Company”) pursuant to the Whistle-Blowing Policy that the Company have announced via the designated communication channel, the Company would like to inform you that the Company would need to collect and use your personal data as defined under this Whistle-Blowing Privacy Notice (the “Notice”).

Personal Data to be processed for the Whistle-Blowing process

The Company would need to collect and use the following personal data of you: full name, contact information (i.e., telephone number or email) and any other personal data that you may submit to the Company in relation to the whistle-blowing complaint made. All of your personal data may be collected directly from you or may be compiled by the Company during the investigation or the communication between the Company and you.

Objective of the Personal Data Processing

The Company would need to process your personal data for the following purposes:

(1) to manage the whistle-blowing complaint that you have raised to the Company through the process specifically defined in the Whistle-Blowing policy announced by the Company;

(2) to record the whistle-blowing process in the internal document for the purpose of future work improvement, quality control, problem analysis and future improvement of the whistle-blowing process itself.

Retention Period

The Company would need to collect and retain your personal data for the defined purposes for the period of time that the Company would need to proceed with the whistle-blowing issues raised by you and for the additional period of time as necessary for the Company to monitor and to take any action needed to protect the Company’s legitimate interest; provided that, in all circumstances, the Company commits not to cause excessive impact on you as the data subject.

Disclosure of your personal data

Generally, your personal data shall be kept confidential; however, in these necessary circumstances, the Company may need to disclose your personal data to the legal counsel of the Company being engaged to assist the Company in the legal proceeding to protect the legitimate interest; provided that the Company commits to only disclose your personal data only on the necessary basis and to ensure that the data recipient shall maintain the same level of confidentiality measures as the Company.

Company’s assurance of the Information Security

The Company represent to implement the appropriate information security measures that would match with the sensitivity of your personal data in order to prevent the unauthorized access, use, change, amendment or disclosure of your personal data and the Company shall review those measures from time to time pursuant to the relevant laws.

Data Subject Rights

The Company respect your rights as the data subject as defined under the relevant laws, please feel free to contact us in case you would like to exercise any of the following rights, right to access and request for copy, right to request for information updates, right to object or suspend the personal data processing, right to data portability or right to delete or de-identify the personal data in case there is no further necessity for the Company to process your personal data at: 02 821 7999 or dpo@mfec.co.th and the Company would process your request within the due period of time as defined under the relevant laws.