Privacy Statement

Updated as of 24 April 2021

The Minor Food Group PCL respects your privacy and is committed to protecting your personal data. This privacy statement will inform you as to how we look after your personal data when you visit our restaurants or websites, tell you about the privacy rights and how the law protects you. For the purpose of this privacy statement, personal data, or personal information, means any information about an individual from which that person can be identified.

This privacy statement applies to our online channels, such as mobile applications, websites, and other online platforms that are owned or operated by the Company ("Sites"), and offline channels such as our restaurants and call centers (collectively, " Services"). This statement applies to our customers, business partners, agents, contractors, and service providers.

It is important that you read this privacy statement together with any other privacy statement (if any) which we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy statement supplements other notices and privacy policies (if any) and is not intended to override them. When using our Sites or Services, you accept, consent, and agree to the terms and conditions in this privacy statement.

1. Data controller

This privacy statement is issued on behalf of The Minor Food Group PCL. and brands within the Group. The Minor Food Group PCL is a company registered and existing under the laws of Thailand, having its registered company at 11th Floor, 88 The PARQ Building, Ratchadaphisek Road, Khlong Toei, Bangkok 10110, Thailand (hereinafter the “Company,” “we,” “us,” or “our”).

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy statement of every website you visit.

2. How we collect personal data

This privacy statement aims to give you information on how we collect and process your personal data through your use of our website, and other Services from which you are accessing this privacy statement, including any data you may provide:

• When you create an account on a Site operated by the Company;
• When you visit our restaurants, call our call center, request online delivery or purchase any products or use Services through our platforms or otherwise;
• When you participate in activities held by us, take a survey, or interact with us in any other way; and
• When you contact us to inquire about our products or Services, submit requests or claims.

We may automatically collect online use information when you visit our Sites or use our Services. This may include information about your Internet service provider, operating system, browser type, domain name, Internet protocol (IP) address, your access times, the website that referred you to us, the web pages you requested, and the date and time of those requests. Our collection of online use information may involve the use of cookies and Web beacons. Cookies are small data files stored on your hard drive by a website. Among other things, cookies help us improve our Sites and your experience. We use cookies to see which areas and features are popular and to count visits to our Sites. Web beacons are electronic images that may be used on our Sites and emails.

We may also obtain your personal data from an internet service provider when you use your device to access complimentary internet at our restaurants.

We may also collect aggregated data or anonymized data that does not directly identify you. We may combine information we collect about you with information we receive from third parties. In some instances, we may combine other information with personal data. If such combined information can identify an individual, such information will be treated by us as personal data.

3. Purposes for which your personal data is collected

We only process your personal data as described in this privacy statement and always in compliance with the applicable Thai data protection law, as follows:

• Where we obtained your consent (as required by law);
• To take steps at your request before entering into a contract and to perform contractual obligations between you and the Company;
• Where it is necessary for legitimate interests of the Company or any other persons or juristic persons, except where your fundamental rights override such interests;
• To comply with laws to which the Company is subject;
• Where it is necessary to prevent or suppress a danger to a person's life, body, or health (if any).

We collect, use, or disclose your personal data to the extent permitted or required under applicable law, for the following purposes:

• Perform our contract with you, process and manage your purchases or use of the Company's products and Services, including customer or member registration, identity verification process, sales order creation, order adjustment or cancellation, order delivery, point redemption, your accounts, and program participation, your use of the Sites and the Services via both online and offline channels.
• Respond to your customer service inquiries, handle the complaint management process which you have raised, or take other actions in response to your inquiries or other Site activities or other customer service platforms.
• Communicate with you by post, telephone, email, SMS, and via our Live Chat about your orders or purchases, your services, accounts and program participation, a contest or sweepstakes you have entered, and your requests for information.
• Give information and communicate with you by SMS, email, via our Sites and other online channels about our brands, products, news, and events, and offer our products, services, and promotions, including co-branded offers and Group of Companies and business partner offers.
• Conduct personalized marketing and promotions.
• Request feedback or participation in surveys (including customer satisfaction survey), conduct market research and/or analysis for us to review, develop and improve the quality of our products and Services, and test and improve our systems, and prevent the misuse or improper use of our Services.
• Improve our products, Services, and relevant processes.
• Conduct business planning, reporting and forecasting.
• Manage risks and undertake internal audit and administration, for example, to prevent fraud or undertake detection, to investigate requests for use of our internal information systems.
• Comply with laws, regulations, orders, legal requirements and obligations of the Company, or report or disclose information to government authorities as required by laws, for example, Revenue Department, or upon receiving an order or a writ of attachment from police officers, government authorities, courts, or other competent authorities, undertake detection and investigation under legal procedures and other regulations including establishment, compliance or exercise of the rights to legal claims or defense against the rights to legal claims.
• Assign rights, obligations and any benefits under a contract between you and the Company which have been done legally, for example, merger or transfer of the contract.

In the case where it is necessary for the Company to process your sensitive personal data, the Company shall obtain your explicit consent, unless the explicit consent is not required by law.

If the personal data is required for the purpose of performance of a contract or to comply with applicable laws, and if you do not provide us with such necessary personal data, the Company will not be able to provide you with the Services.

4. What personal data we collect

We may collect, use, store and transfer different kinds of personal data about you which we have arranged according to the different purposes as follows:

• Personal identification: your full name, nickname, age, date of birth, gender, photos
• User account information: your username, account number, password;
• Contact information: address, email, telephone numbers;
• Geolocation information;
• Social media contact information: social media account;
• Financial and transaction information: credit card number, debit card number;
• Commercial information: information about your past transactions;
• Communication data: your voice recordings when communicating with us;
• Others: information about point collection, membership information, interest in any products and marketing activities, demographics information, your comments, feedback, questions or suggestions, and information about subjects that may interest you.

We do not collect the following special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Minor, incompetent individual, and quasi-competent individual

Our website is intended only for persons who are more than 10 years old. If you are an individual under 20 years of age (“Minor”) or individuals who are not legally competent to give consent, you confirm that you have obtained consent from (on case by case basis):

1. a) The legal representative of the Minor when the Minor is not entitled to act alone or when the Minor is not more than 10 years of age;
2. b) The guardian who has the power to act on behalf of the data subject who is an incompetent individual;
3. c) The curator who has the power to act on behalf of the data subject who is a quasi-competent individual.

5. To whom we may disclose your personal data

We may disclose personal data with the following third parties:

• Service providers
  We may share your personal data with third-party service providers who provide data processing services to us, such as credit card and payment processing, business analytics, customer service, marketing, or distribution of surveys, to facilitate the delivery of our products and online services and advertising tailored to your interests, or fraud prevention. Our third-party service providers will only process personal data as needed to perform their functions. They are not permitted to share or use the personal data for any other purpose.

• Business partners
  เWe may share your personal data with business partners with whom we may jointly offer products or services, or whose products or services may be offered on our Sites. You can tell when a third-party business partner is involved in a product or service you have requested because their name will appear, either alone or with ours. If you choose to access these optional services, we will share your personal data with those partners. An example of a business partner would be a third-party loyalty program that you will earn points through the use of the Services.

• Group of Companies
  We may share your personal data among our Group of Companies to send marketing communications, perform the service requested by you (including customer services) and internal (audit/compliance) investigations.

• Governmental Bodies
  We may share your personal data where required or permitted by applicable laws – upon lawful request, in response to legal process, or when required to comply with laws, and to protect ourselves against liability or legitimate interests or to share your personal data to the purchasers in connection with any sale, assignment, or other transfer of all or a part of our business or company, to enforce or apply the terms and conditions applicable to our services or to protect the rights, property, or safety of the Company, our users, or others.

• Business Reorganization
  We may share your personal data in case of any sale, assignment, or other transfer of our business or transition of service to another provider. We will ask for your consent if required by applicable law.

We provide appropriate protections for such sharing of personal data as required by the applicable law to prohibit third parties from using your personal data for their own purposes and to address the security and confidentiality of your personal data. Except as specified above, we will not disclose your personal data to third parties without your consent.

6. International Transfers

We may transfer your personal data to the countries outside of Thailand to our Group of Companies and our third-party service providers as part of our normal business operations to perform our Services (i.e., our IT service provider). In such case, we shall provide adequate protection and security measures and comply with the applicable Thai data protection law.

7. Data retention

Your personal data collected, used, or disclosed for the purposes described here will be stored only to the extent necessary during the term of your participation in the Services with us, or for the period necessary to fulfill the purposes outlined in this, including during a transition period (e.g. for the compliance of our obligations regarding data retention as established in applicable laws), if any. We will retain your personal data as long as required or permitted by applicable law. Afterward, we will remove your personal data from our systems and records or take steps to anonymize it so that you can no longer be identified from it.

8. Your rights

You have the following rights under the conditions set out under applicable law:

• Request access to your personal data
  You are entitled at any time to obtain your personal data that we store, in accordance with applicable law and without any fee. However, in exceptional cases, we may ask you to pay reasonable fees before we provide the information if permitted by applicable law.

• Request correction of your personal data
  You may request that we rectify any of your personal data that is incomplete or incorrect.

• Request erasure of your personal data
  You may request that we delete your account and your personal data.

• Object to processing of your personal data
  You have the right to object to collection, use or disclosure of personal data, which is carried out to protect our legitimate interests or for the performance of tasks in the public interest, at any time, in accordance with the statutory provisions. If you file an objection, we will continue to collect, use or disclose your personal data only if we can document mandatory and legitimate reasons that outweigh your interests, rights and freedoms, or if collection, use or disclosure is for the establishment, compliance or exercise of legal claims or defense of legal claims, as may be applicable.

• Request restriction of processing your personal data
  You may ask us to restrict the use of your personal data, for example, if you have objected to the processing and the existence of legitimate grounds is still under consideration.

• Request transfer of your personal data
  If applicable, you may request us to send you your personal data, which we store in a commonly used and machine-readable format, or to send or transfer your personal data in such format to other data controllers as provided by the law.

• Right to withdraw consent
  You have the right to withdraw your consent at any time, without affecting the lawfulness of our processing based on such consent before it was withdrawn.

• Right to file a complaint
  You have the right to file a complaint with the supervisory authority under the Personal Data Protection Act (“PDPA”) anytime the Company violates or does not comply with the PDPA.

To protect your privacy and security, we will verify your identity before responding to such a request, and your request will be answered within a reasonable timeframe. We may not be able to allow you to access certain personal data in some cases, e.g., if your personal data is connected with the personal data of other persons or for legal reasons. In such cases, we will provide you with an explanation why you cannot obtain this information. We may also deny your request for deletion or rectification of your personal data due to statutory provisions, especially those affecting our accounting processes, processing of claims for fraud detection or prevention purposes, and mandatory data retention, which may prohibit deletion or anonymization.

9. Our Contact Details

If you want to exercise your data subject rights, please contact us:

by post: The Minor Food Group PCL., 11th Floor, 88 The PARQ Building, Ratchadaphisek Road, Khlong Toei, Bangkok 10110, Thailand

by email: Privacy.Food@minor.com

For any queries about this Privacy Statement or our privacy practices, please contact our Data Protection Officer at Pdpo@minor.com

10. Security of your Personal Data

We maintain reasonable physical, electronic, and organizational security measures to protect your personal data against accidental or unlawful destruction or accidental loss, alteration, or unauthorized disclosure or access.

11. Cookies

We use cookies (small text files stored in your browser) and other techniques such as web beacons (small, clear picture files used to follow your movements on our website). These collect information that tells us how you use our website and web-related services. We use these to compile statistical reports on website activity.

This helps us make our website relevant to your interests and needs. We may use a persistent cookie (a cookie that stays linked to your browser) to record your details so we can recognize you if you visit our website again.

You can choose to refuse cookies or set your browser to let you know each time a website tries to set a cookie. For further information on cookie, visit www.aboutcookies.org or www.allaboutcookies.org where you can also find information on how to turn them off.

The type of cookies we use on this site include:

1. Strictly Necessary Cookies: These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

2. Analytics Cookies: We use these cookies to analyse and identify the behaviour of our web visitors. We will track the IP address on the device you are using to identify you when visiting our website. When possible, we combine your online web behaviour data with the personal data that you have previously supplied to us. This data will be used to analyse behaviour on our website and to personalise your experience.

3. Advertising Cookies: These cookies may be set through our site by our advertising partners. They can be used and shared by those companies to build a profile of your interests and show you relevant adverts on other sites. This is based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

4. Engagement Cookies: These cookies are used to provide additional functionality to the site and may affect your experience if they are turned off. They are used to allow enhancement widgets for live chat to provide customer support or alert widgets drawing your attention to updates and exclusive offers. These cookies may track your customer journey to personalise the support and messaging given.

If you wish to block the cookies, please visit:

• Google AdWords - http://www.google.com/settings/ads

• Facebook Pixel - You may disable any of these cookies or similar technologies via your browser settings.

• Twitter Advertising - You may disable tailored advertisements via your Twitter settings by visiting the “Promoted content” and “Personalization” sections.

• Google Analytics - You may disable any of these cookies via your browser settings or by downloading a browser add-in: https://tools.google.com/dlpage/gaoptout

You may disable any of these cookies via your browser settings or change your cookies settings.

12. Liability

If you are providing personal data of third parties to the Company, you guarantee that their authorization has been obtained to provide their data to the Company for the purposes in this privacy statement.

You will be liable for any false or inaccurate information provided and for direct or indirect damage caused to the Company or to third parties.

13. Changes to this privacy statement

We reserve the right to update, amend and change this privacy statement at any time. The changes will have immediate effect once announced on the Site. Therefore, we recommend that you check this privacy statement for any changes periodically.