PRIVACY POLICY

Appendix II.

Country specific provisions

Addendum to Privacy Policy for California

This Addendum to Privacy Policy for US (this “Addendum”) applies to the processing of your personal information collected from the U.S. This addendum explains the categories of personal data that we collect from you and how we collect and use personal data that is subject to the California Privacy Rights Act (the “CPRA”). It further describes the rights that California residents have with respect to their personal data. This addendum should be read together with the Privacy Policy, and in case of any conflict the terms of this addendum will prevail as to personal data of California residents that is subject to the CPRA. For purposes of this addendum, the term “personal data” includes all “personal information” as defined in the CPRA.

Your legal rights

In addition to the rights explained in the Privacy Policy, under certain circumstances, California residents have the following rights in relation to their personal data:

Right to opt-out: You have the right to opt out of any sale or “sharing” of your personal information (as the term “sharing” is defined under California law, which means a disclosure to a third party for purposes of cross-context behavioral advertising).

Right to non-discrimination: You have the right to exercise any of the rights listed above (and any other rights under CPRA) without discrimination by us.

Right to limit the use and disclosure of sensitive information:

To exercise your right to access or delete your personal information, you may submit a request via telephone at 82-1644-7119 or via email to the appropriate point of contact listed in the How to contact us section above.

For requests submitted via telephone, you must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal information and describe your request with sufficient detail to allow us to properly evaluate and respond to it. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.

Sources of, purposes for collecting, and categories of personal data collected and disclosed

We obtain your personal data mainly from or via you, and we collect and process personal data for a variety of business or commercial purposes. The Privacy Policy describes in greater detail the specific explanation of purposes, the specific pieces of personal data that we collect, and the categories of third parties with whom we share or may share personal data.

In the preceding twelve (12) months, we have collected the following categories of personal data from California residents. Please note that the following list represents categories of personal data across all California residents whose personal data we may have collected or received and does not necessarily represent information we have collected specifically about you. Please also note that the definition of “personal information” under CPRA is subject to certain exceptions as set forth therein and does not include information that is publicly available or has been aggregated or deidentified in accordance with CPRA.

Identifiers: This includes information such as name, email address, telephone number, IP address, national identification number (or unique identification data equivalent thereto) and other similar identifiers.

Personal information as defined by Cal. Civ. Code § 1798.80(e): The types of personal data in this category include several of the identifiers described above but also includes, among other things, information such as corporate credit card number.

Certain protected classifications: Information under this category may include religious affiliation.

Internet or network activity: The types of information in this category includes information that relates to IP address and access records.

Professional or employment-related information: This includes information such as name of company/department and job title.

Education Information: Educational background including majored fields of study.

General information such as date of birth, hobbies, office location.

In the preceding 12 months, we may have disclosed or shared to third parties for a business purpose the categories of personal data listed above. Please refer to the Privacy Policy for more information.

Sales of personal data

We do not sell your personal data for monetary consideration.

Addendum to Privacy Policy for EU(UK)

This Addendum to Privacy Policy for EU(UK) (this “Addendum”) applies to the processing of your personal information collected from EU(UK). This addendum explains more details of how we collect and use personal data subject to the GDPR. This addendum should be read together with the Privacy Policy, and in case of any conflict the terms of this addendum will prevail as to personal data processing of EU residents (and UK residents where applicable). For purposes of this addendum, the term “personal data” includes all “personal information” as defined in the GDPR.

Legal Basis for Processing

We process your personal data on the lawful basis under Art 6 of GDPR, mainly for the purpose of performance of a contract to which data subject is party, but we may choose other lawful basis such which seems proper according to the individual situations, such as consent of the data subject or necessity to comply with legal obligation imposed on us.

Data Transfer

As explained in the Privacy Policy, we may transfer your personal data.

Where the data recipients are located in a country outside the European Union or the European Economic Area ("Third Country"), we will rely on (where applicable) adequacy decisions issued by the European Commission declaring that the Third Country, or more specified sectors within that Third Country, in question ensures an adequate level of protection comparable to the GDPR ("Adequacy Decision).

Where the data recipients are located in Third Countries which are not covered by an Adequacy Decision, we will rely on appropriate safeguards within the meaning of Art. 46 (2) GDPR such as Standard Contractual Clauses which (where necessary are supplemented by additional contractual, technical or organizational measures) ensure an adequate level of data protection.

Your legal rights

In addition to the rights explained in the Privacy Policy, under certain circumstances, EU residents have the following rights in relation to their personal data:
Right to withdraw your consent, Art. 7 (3) GDPR
Right to lodge a complaint with the competent supervisory authority, Art 77 GDPR.

Automated individual decision-making, including profiling

We do not make decisions based solely on automated processing including profiling.

Addendum to Privacy Policy for Japan

This Addendum to Privacy Policy for Japan (this “Addendum”) applies to the processing of your personal information collected from Japan. This addendum explains more details of how we collect and use personal data subject to the Act on the Protection of Personal Information (“APPI”). This addendum should be read together with the Privacy Policy, and in case of any conflict the terms of this addendum will prevail as to personal data processing of Japan residents. For purposes of this addendum, the term “personal data” includes all “personal information” as defined in the APPI.

Data Transfer

As explained in the Privacy Policy, we may transfer your personal data.

The Company ensures that the recipient will treat the disclosed personal data in accordance with the spirit of the requirements for handling personal data under the APPI. By following methods, the Company ensures that the overseas recipient continuously takes equivalent measures:

The Company will periodically confirm the implementation status of the equivalent measures taken by the recipient and the presence or absence of a system in the foreign country that might affect the implementation of the equivalent measures.

The Company will take necessary and appropriate measures if the implementation of the equivalent measures by the recipient party is interfered with in some way and to suspend the provision of personal data if it becomes difficult to ensure the continuous implementation of the equivalent measures.

The Company stores your personal data in data servers operated by its outsourcee, Salesforce, Inc. The Republic of Korea is a participating country in the APEC Cross Border Privacy Rules (CBPR) System and has obtained an adequacy decision from the European Commission indicating that it ensures an adequate level of data protection comparable to the GDPR.

Please visit (ppc.go.jp/) for more information on the data protection and privacy laws in the Republic of Korea.

Your legal rights

In addition to the rights explained in the Privacy Policy, under certain circumstances, Japan residents have the following rights in relation to their personal data:

You have the right to request access to the transfer history of their personal data that has been shared with third parties, except when public or other interests may be harmed by such disclosure.

You have the right to choose how you would like to receive the requested information, including in electronic form.

Addendum to Privacy Policy for Singapore

This Addendum to Privacy Policy for Singapore (this “Addendum”) applies to the processing of your personal information collected from Singapore. This Addendum supplements and constitutes an integral part of the Privacy Policy. The terms in this Addendum shall have the same meaning defined under the Privacy Policy unless otherwise clearly specified.

Accuracy of your personal data

When you submit personal data through the Website, you should ensure such personal data is accurate. You should also review your personal data from time to time and let us know if there are changes or updates to your personal data so that we do not hold any inaccurate personal data about you.

Your rights

Your rights under the Singapore Personal Data Protection Act 2012 (“PDPA”). If you are using the Website from Singapore, you have the following rights in accordance with the PDPA:

Withdrawing consent

You may withdraw your consent and request us to stop collecting, using, disclosing and/or processing your personal data for any or all of the purposes listed above in the Privacy Policy, by contacting The Company privacy team for assistance.

Upon receipt of your request to withdraw your consent, we may require a reasonable period of time to process and respond to your request.

Whilst we respect your decision to withdraw your consent, please note that if you withdraw your consent to the use of your personal data, you may not be able to use relevant Services. We will, in such circumstances, notify you before completing the processing of your request.

Please note that withdrawing consent does not affect our right to continue to collect, use, disclose or process your personal data where such collection, use, disclosure, and Processing without consent is permitted or required under applicable laws.

Accessing and Correcting your Personal Data

If you wish to make:

an access request for access to a copy of the personal data which we hold about you or information about the ways in which we had used or disclosed your personal data in the one (1) year prior to the date of your request, or a correction request to correct or update any of your personal data which we hold about you, you may submit your request via email to our privacy team.

We will respond to your request as soon as reasonably possible. Should we not be able to respond to your request within thirty (30) days after receiving your request, we will inform you in writing within thirty (30) days of the time by which we will be able to respond to your request.

If we are unable to provide you with any personal data or to make a correction requested by you, we shall generally inform you of the reasons why we are unable to do so (except where we are not required to do so under the applicable laws).

How to exercise your data privacy rights: We take your privacy seriously. You can exercise your rights by contacting our privacy team for assistance.

In submitting a request, we may ask you to verify your identity so that we can protect you against fraudulent requests for your information. Thus, we may ask you to sign into your account, to provide information about the Services, or provide other confirming information.

International Transfer of your Personal Data

Where we are required to transfer your personal data out of Singapore, we will ensure that the data recipient is bound by legally enforceable obligations (for example, by entering into data transfer agreements or agreements of a similar nature with the data recipient) to ensure that your personal data receives a comparable standard of protection as that which it would receive under the PDPA in Singapore.

Retention Periods

We may retain your personal data for as long as it is necessary to fulfil the purpose for which it was collected, or as required or permitted by applicable laws.

We will cease to retain your personal data or remove the means by which the data can be associated with you, as soon as it is reasonable to assume that such retention no longer serves the purpose for which the personal data was collected and is no longer necessary for legal or business purposes.

Addendum to Privacy Policy for India

This Addendum to Privacy Policy for India (this “Addendum”) applies to the processing of your personal information collected from India. This Addendum supplements and constitutes an integral part of the Privacy Policy. The terms in this Addendum shall have the same meaning defined under the Privacy Policy unless otherwise clearly specified. We collect and process your Personal Data including sensitive personal data (if any) in accordance with the Information Technology Act, 2000 and Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (collectively, “Indian Data Protection Rules”), as applicable and as amended from time to time.

Your Rights
If you are using the Platform from India, you have the right to access, review and correct your sensitive personal data if and as provided to us, in accordance with the Indian Data Protection Rules.

Changes to this Privacy Policy
We reserve the right to change this privacy policy from time to time in our sole discretion. If material changes are made to the privacy policy, we will notify you by placing a prominent notice on the Services or via email at the email address we have on file for you. We encourage you to periodically review this privacy policy to keep up to date on how we are handling your personal information. Your continued access to or use of the Service after the date of the updated Privacy Policy constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated Privacy Policy, you must stop accessing or using the Services.

Security
To protect your Personal Data from unauthorized access, use, or similar risks, we have implemented reasonable security practices and procedures, details of which are available here. You agree that such security practices and measures are reasonable.

Grievance Officer
If you have any grievances, inquiries or wish to make any request relating to your sensitive personal data, you may contact our privacy team for assistance.

Addendum to Privacy Policy for Thailand

This Addendum to Privacy Policy for Thailand (this “Addendum”) applies to the processing (as defined below) of your personal data located in Thailand. This Addendum supplements and constitutes an integral part of the Privacy Policy.

Definition and Interpretation
1. The term "process/processing" as used in the Privacy Policy shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as the collection, use, disclosure or cross-border transfer of the personal data.
2. The terms "personal data", "data controller", "data protection officer" and "representative" as used in the Privacy Policy shall have the meanings as defined in the Personal Data Protection Act B.E. 2562 (2019) ("PDPA").
3. All references to the term "personal information" in the Privacy Policy shall be replaced with the term "personal data".
4. The terms used in this Addendum shall have the same meanings as defined under the Privacy Policy unless otherwise defined in this Addendum.

Identity and Contact Details of the Representative
We take your privacy seriously. That is why we create a special form for you to exercise your privacy rights. You can exercise your rights by contacting our privacy team for assistance.

The Information We Process
The personal data as mentioned in this Privacy Policy is collected mainly if you choose to provide it, although some personal data has to be provided. If mandatory information is not provided, to the extent permitted by law, may affect our ability to perform our contractual or legal obligations. In some instances, failure to provide personal data may also result in us not being able to process your HR Service.

How We Process Information
We process your personal data on the following legal bases: (a) consent; (b) contractual basis (e.g., for our performance of or fulfilment of obligations under a contract with you); (c) legal obligation (for the fulfilment of our legal obligations); (d) legitimate interests (for the purpose of our legitimate interests and the legitimate interests of third parties, in proportion to your interest and fundamental rights and freedoms in relation to the protection of your personal data); (e) vital interest (such as preventing or suppressing a danger to a person’s life, body or health); (f) public interest (for the performance of a task carried out in the public interest or for the exercise of official authorities); (g) establishment of, compliance with, exercise of or defense against legal claims; or (h) any other basis permitted by applicable laws, including the PDPA.
In certain limited circumstances and where required under the PDPA, we may need to ask for your specific consent separately to process your personal data in a particular way. However, in most cases we will process your personal data for the reasons set out in this Privacy Policy and it will not be appropriate or necessary for you to provide consent.

Your Rights
Your rights under the PDPA. If you are using the Platform in Thailand, you have the following rights in accordance with the PDPA:
Right to access under Section 30 of the PDPA;
Right to rectification under Section 36 of the PDPA;
Right to erasure under Section 33 of the PDPA;
Right to restriction under Section 34 of the PDPA;
Right to data portability under Section 31 of the PDPA;
Right to object to the data processing under Section 32 of the PDPA;
Right to withdraw your consent under Section 19 of the PDPA; and
Right to lodge a complaint with the competent supervisory authority under Section 73 of the PDPA.

Where is your Information - International Transfer of Information
Where the data recipients are located in a country outside of Thailand ("Third Country"), we rely on (where applicable) the adequacy decisions issued by the Personal Data Protection Committee declaring that the Third Country in question ensures an adequate level of protection comparable to the PDPA ("Adequacy Decision").
Where the data recipients are located in Third Countries which are not covered by an Adequacy Decision, we will rely on the appropriate safeguards within the meaning of Section 29 of the PDPA, such as Standard Contractual Clauses which (as supplemented by additional contractual, technical or organizational measures, where necessary) ensure an adequate level of data protection. You can contact our DPO in order to obtain more information about our international data transfers and the appropriate safeguards we rely on.

Security
In order to prevent unauthorized or unlawful loss, access, use, alteration, correction or disclosure of your personal data, we have established and/or opted to use a system to process personal data, whether in hard copy, electronic files and/or any other form, with appropriate security measures, including organizational, technical and physical measures, covering the components of the relevant information system, taking into account the security implementation specified by the applicable laws on personal data protection in order to properly maintain confidentiality, integrity, and availability of the personal data according to the relevant level of risk. This includes controlling access to personal data and critical information system components, appropriate handling of user access, determining user's responsibilities, and putting in place appropriate measures for audit logging to detect access, alteration, correction or deletion of personal data. We also arrange the enhancement of knowledge and understanding related to personal data protection and security of the personnel concerned.