Privacy Policy

The data controller under the Personal Data Protection Act of Thailand ("PDPA") is:
Company: CHANGAN Auto Sales (Thailand) Co., Ltd.
Address: Rooms No. 88 The Parq Building, Room No. 7E1-16 and 8E1-16, 7th and 8th Floors, Ratchadaphisek Road, Khlong Toei Sub-district, Khlong Toei District, Bangkok, 10110, Thailand.

Email of the Data Protection Officer ("DPO"): compliance@changan.co.th

General Rules

CHANGAN Automobile Sales (Thailand) Co., Ltd. (hereinafter referred to as "we", "us", "our") will strictly follow the provisions of Thailand Personal Data Protection Law B.E. 2562 (2019) ("PDPA") and adhere to the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability to protect your personal data and related rights. Through this CHANGAN Website Privacy Policy ("this Policy"), you will learn how we collect, use, store, disclose and protect your personal data when using products or services on CHANGAN Website.

Please understand that authorized dealers are independent entities and applications and other services provided by third parties have nothing to do with us. Please understand and be aware of the privacy policies of third parties. If you have any questions, please contact the third parties directly.

Some search engines, social media, links and other products or services may contain web links operated and maintained by third parties, but we have no control over such third parties. Please note that any data you provide to a third party will be subject to the terms of that third party's privacy policy or personal data protection policy.

This Policy applies to the data collection and processing implemented on CHANGAN Website, www.changan.co.th, including the use of our products and services.

Reminder:

If you are under 20 years old, please do not provide any personal data without the permissions of your parents or legal guardians.

In order to adapt to the current effective laws and regulations, functional services, etc., this Policy may be modified. We will notify you of the modification through a pop-up prompt to get the latest effective version.

We understand the importance of personal data to you, and we are committed to taking appropriate security measures to fully protect your personal data in accordance with the industry's mature security standards.

By checking or clicking on "Read", "Agree" or other actions with the same meaning on the page to which this Policy belongs, you are deemed to agree to the relevant content of this Policy and agree to our processing of your personal data in accordance with legal requirements and this Policy. If you do not agree to any content of this Policy, we will not process your personal data. In general, this will not affect your use of our products or services, unless the processing of relevant personal data is necessary to provide the products or services. Please read this Policy carefully before checking or clicking on "Read", "Agree" or other actions with the same meaning, accepting products or services we provide, and submitting personal data to ensure that you are fully aware and understand the meaning and corresponding legal consequences of its content. The CHANGAN Website can be used only after confirmation of full understanding and agreement.

We will identify, by bolding or other reasonable means, terms that are (potentially) materially related to your rights and interests, terms relating to sensitive personal data, etc., and you should focus on reading them. If you have any questions, comments, or suggestions about this Policy, you may contact us using the contact information provided in this Policy.

Please understand that our services are intended for the public. We will collect your personal data based on the functions and services you use.

Part 1. Definitions and Legal Basis

Section 1. Definitions

1. Personal Data means any information relating to a natural person (data subject) which enables the identification of such natural person, whether directly or indirectly. An identifiable natural person is one who is identified by his or her name, address, e-mail address, telephone number, identity card number, location data, online identification, or by reference to one or more elements of physical, physiological, genetic, psychological, economic, cultural, or social identity of that natural person, but does not include anonymized personal data.

2. Sensitive Personal Data means Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner (sensitive data), as well as the Personal Data of minors under 20 years old.

Section 2. Legal Basis

We collect and process your Personal Data in strict compliance with the PDPA. We do not normally collect Personal Data directly from any source other than the data subject and we collect and process your Personal Data for the purposes described in this Policy. In cases where the collection of Sensitive Personal Data, cross-border transfers of data, etc. are (potentially) of significant relevance to your rights and interests, we will notify you by means of enhanced notification or instant alerts (e.g., pop-up reminders) and obtain your explicit consent.

We will generally collect, use, disclose or otherwise process your Personal Data with your consent or in accordance with the law, for the purposes set out in this Policy, including but not limited to the following circumstances:

• We are required to comply with legal requirements and fulfill legal obligations; and
• We need to enter into or fulfill a contract with you;
• For our legitimate interests or the legitimate interests of any other person, including but not limited to the purposes set out in this Policy;
• For the prevention or suppression of danger to the life, body or health of persons;
• To disclose Personal Data on the basis of your express consent; and/or other lawful basis on which we may rely under applicable law.

Part 2. The business features we offer and how we collect and process your Personal Data

Section 1. What Personal Data we collect about you

1. Basic Personal Data
Based on the purchase contract with you, the products or services provided to you, we may collect your Personal Data, such as name, Email, Location, cell phone number and other Personal Data that you disclose to us.

2. Other Personal Data
Based on the various products, services, activities, etc. provided to you, other Personal Data may also be collected.

Section 2. We will collect and process your Personal Data for the following purposes as set out in this Policy

We collect and process your Personal Data for the purpose of providing you with the products or services described below. The Personal Data described below is necessary to provide features or services on CHANGAN Website, and we do not automate decision-making or send you marketing messages via e-mail, telephone, etc. based on the Personal Data we collect from you. Therefore, if you do not provide and authorize us to process the Personal Data described below, we will not be able to provide you with products or services.

1. Personal data collected when you use CHANGAN Website.

2. In addition, when you contact us via e-mail, we collect the following types of personal data.

(1) Name-Surname
(2) Contact data such as your e-mail address
(3) Technical data such as your IP address
(4) Other data that you may disclose in your emails

3. The purposes and types of personal data we may collect from you

(1) We collect your data in order to satisfy your use of CHANGAN to access, share, retrieve, jump, copy, fill out forms, and other products or services. Specific scenarios include, but are not limited to, the following.

• Providing you with updated data on the services used.
• Responding to your requests via forms on our website and applications.
• Push notifications, alert data to you.
• Data analysis and statistical studies implemented for the purpose of updating and optimizing the order of our website or understanding our website users, research and analysis of our content and services.
• We collect data for data security reasons and to ensure the stability and reliability of our systems, as well as to protect them from possible external attacks.

(2) With your consent, certain data may be collected through cookies or similar technical means (such as IP address, connection and browser data, location data, etc.) as a result of your behavior on the Site.

(3) We may collect data about you, including but not limited to

• Web logs
  ① Site search content input content and search results
  ② IP address
  ③ Language used
  ④ Date and time of access to the service
  ⑤ Cookie (see detailed data in the Cookie Policy)
• Device or application data: such as that provided by the mobile device you are using, your browser, or other programs used to access CGTN.
  ① Configuration data
  ② Device version number
• Location data: When you turn on the device location function and use the services provided based on location, we use various data for location after obtaining your consent.
  ① IP address
  ② and other sensor data that can provide location data
• In order to provide you with better services and improve your user experience, CHANGAN may also record.
  ① Operating system version number

4. Personal data from third parties

To protect your rights and interests, fulfill our contractual obligations with you, comply with legal requirements or obtain your consent, we may receive your Personal Data from third parties, including but not limited to: our dealers, our service providers. We will strictly comply with the provisions of Article 25 of the PDPA to fulfill our obligations and protect your personal data and rights.

Section 3. We will only require your authorization to turn on the following permissions for you to use our products or services.

To provide the relevant products and services, in addition to the Personal Data provided by you, we may also need you to authorize the opening of the following permissions, and the refusal to open these permissions may result in us not being able to provide you with the relevant products or services.

These permissions include network and location, as shown in the table below:

Permissions	Descriptions	Purposes
Location	When you use the test drive service, we may need to enable the location permissions. We will not continuously collect your location information unless necessary for functionality or services.	Identify the nearest dealer.

We only collect the permissions mentioned in the above description and will not request additional permissions beyond the functional requirements. You can choose to turn off some or all permissions at any time in the device settings function; You can manage your permissions and refuse the collection of your Personal Data by having pop up notification for user to manage.

Part 3. How we disclose and store your Personal Data

Section 1. Disclosure

Under normal circumstances, we will not disclose your Personal Data to third party subjects. In order to protect your rights and interests, fulfill the contractual obligations signed with you, meet the legal requirements or obtain your consent, we may disclose your Personal Data to third-party subjects, and we will always comply with the legal requirements when disclosing your Personal Data, abide by the principles of purpose limitation and minimum necessity, and protect your Personal Data and related rights. The details are as follows:

1. Affiliated companies of CHANGAN Auto Sales (Thailand) Co., Ltd.
In order to protect your rights and interests, fulfill the legal obligations as well as the contractual obligations signed between us and you, and provide complete products or services, we may disclose your Personal Data to the affiliated subjects of CHANGAN Auto Sales (Thailand) Co., Ltd. and obtain your consent by means of this Policy or the privacy policies of other platforms of CHANGAN Auto Sales (Thailand) Co. consent. The disclosure is related to the purposes described in this Policy.

We may disclose your Personal Data to the following affiliates:

• CHANGAN Auto Southeast Asia Co.

2. Service providers of CHANGAN Auto Sales (Thailand) Co., Ltd
We may disclose your personal data to service providers in order to protect your rights and interests, fulfill our statutory obligations and contractual obligations entered into between us and you, and to provide complete products or services. We will provide Personal Data to the minimum extent necessary for them to provide the service and sign a contract requiring the service provider not to use your Personal Data for any purpose other than the purpose agreed with us and to take technical, organizational, and administrative measures to protect your Personal Data. Service providers include but are not limited to: (1) IT service providers; (2) logistics and freight service providers; (3) data storage and cloud service providers; (4) event management service providers; (5) call center service providers.

3. Business partners of CHANGAN Auto Sales (Thailand) Co., Ltd
In order to protect your rights and interests, fulfill our legal obligations and contractual obligations with you, and provide complete products or services, we may disclose your Personal Data to our business partners. We will provide Personal Data to the minimum extent necessary for their business cooperation and sign an agreement requiring the business partners not to use your Personal Data for any purpose other than the one agreed with us and to take technical, organizational, and administrative measures to protect your Personal Data. Partners include but are not limited to dealers and other partners.

4. Third parties required by law
We may have to disclose your Personal Data under certain legal requirements, such as: legal obligations that we need to fulfill or rights that need to be protected.

5. If we are required by law to obtain your consent, we will first obtain your consent.

Section 2. Storage

The Personal Data we collect and generate about you while operating and managing CHANGAN Website in Thailand is stored in a database server room located in Thailand.

We store your Personal Data for a different period of time depending on the purpose of the processing, legal requirements, your rights and etc., but not longer than is necessary for the processing of the Personal Data. After the expiration of the storage period, we will delete your Personal Data or make it impossible to identify you directly or indirectly.

We have applied a series of technical, administrative, and organizational measures to protect the stored Personal Data and to minimize the risk of unauthorized use, disclosure, and inaccessibility. The security measures we have taken include, but are not limited to data desensitization, data encryption, firewalls, and data access authorization controls.

Part 4. How we process your Personal Data globally

To protect your Personal Data, we do not normally process your Personal Data outside of Thailand. However, in order to comply with legal requirements, fulfill our contractual obligations with you, fulfill your functional use and ensure the safe and stable operation of your vehicle, provide other assistance services, provide other assistance services, etc., we may transfer your Personal Data to a third country outside of Thailand, or to be accessed by our affiliates in a third country, and your Personal Data may be transferred or disclosed within the company group.

If the data protection standard in the third country are lower than those in Thailand or in a country recognized by the relevant Thai authorities as an equivalent country for the protection of Personal Data, we will take protection measures comparable to the PDPA to ensure that Personal Data transferred to the third country will be protected to the same standard of data protection as that required in Thailand; for example, we will enter into a contract or establish binding corporate rules with the third-country recipient; or we will take technical measures so that the Personal Data cannot be directly or indirectly identified to you.

If you would like more information about how your Personal Data is protected outside of Thailand, please contact us using the contact information provided in this Policy.

Part 5. How we protect your Personal Data

We will provide appropriate security measures to prevent unauthorized or illegal access to, use, correction, or disclosure of your Personal Data. We will regularly check and update the security mechanisms used to protect data to provide effective protection against data abuse.

We use encryption to ensure the confidentiality of Personal Data; we use trusted protection mechanisms to prevent malicious attacks on data; and we deploy access control mechanisms to ensure that only authorized personnel have access to Personal Data. We have established a special privacy compliance organization and a management system for employees, third parties, etc. We will regularly hold security and privacy protection training courses to enhance employees' awareness of the importance of protecting Personal Data. We will carefully select service providers and business partners and conduct regular Personal Data protection audits.

In the event of a data breach, we will notify the Office of the Personal Data Protection Commission of Thailand in accordance with the PDPA, where practicable, within 72 hours of becoming aware of a data breach, unless it is unlikely that such a breach of Personal Data would pose a risk to your rights and freedoms. If the Personal Data breach is likely to pose a high risk to your rights and freedoms, we will immediately notify you of the remedial measures taken in relation to the Personal Data breach and notify the affected parties and relevant authorities.

If you believe that the security of your Personal Data has been compromised, or if you want to know more about our data protection measures, please contact us using the contact information provided in this Policy.

Part 6. How we protect your rights

We want to make sure that you are fully aware of all your rights as a data subject. In accordance with the relevant laws and regulations of Thailand, as well as common practices in other countries and regions, you have the following legal rights with respect to your Personal Data:

Section 1. The right to access, obtain a copy of and receive

Pursuant to Sections 30 and 31 of PDPA, you are entitled to request access to and obtain a copy of the Personal Data related to yourself, subject to the exceptions provided for by law.

You can send an email to compliance@changan.co.th to make an application for accessing and obtaining a copy of your Personal Data.

You can send us a request to make an application for accessing and obtaining a copy of your Personal Data by sending an email to compliance@changan.co.th.

If technically feasible and in accordance with the conditions set by the relevant authorities, we may, at your request, transfer a copy of your Personal Data collected by us directly to you or to the controller of your Personal Data designated by you, and we will provide you with the appropriate means of transfer.

Section 2. The right to object

Pursuant to Section 32 of PDPA, you have the right to object the collection, use, or disclosure of your Personal Data in question, e.g., you have the right to object to direct marketing.

You can send us a request to object to the processing of your personal data by sending an email to compliance@changan.co.th.

Section 3. The right to erase or destroy

Pursuant to Section 33 of PDPA, you have the right to request us to erase or destroy your Personal Data, or anonymize the Personal Data to become the anonymous data which cannot identify you, directly or indirectly, based on the following circumstances:

1．If our processing of Personal Data in violation of laws and regulations
2．If the purpose for which your Personal Data is processed has been achieved, cannot be achieved or is no longer necessary for the achievement of that purpose (e.g. You are no longer the owner of CHANGAN Auto, etc.);
3．If we collect or use your Personal Data without your authorized consent or if you object the collection, use or disclosure of your Personal Data;
4．If our processing of your Personal Data in breach of our contract with you;
5．If we have ceased to provide a product or service or the retention period has expired;
6．If you have withdrawn your authorized consent for us to process your Personal Data;
7．Other cases stipulated by law.

You can send us a request to erase or destroy your personal data by sending an email to compliance@changan.co.th.

If we decide to respond to your request for erasure or destruction, we will also notify other entities that have access to your Personal Data through us at the same time and ask them to erase or destroy it, unless otherwise required by law or regulation, or if these entities have obtained your independently authorized consent.

Due to legal requirements or technical limitations, we may not immediately erase or destroy or anonymize the corresponding Personal Data from the system. During this period, we will securely store your Personal Data and will not proceed with any further processing, leaving it in a state where it cannot be retrieved or accessed.

Section 4. The right to restrict processing

Pursuant to Section 34 of PDPA, you have the right to request us to restrict the use of your Personal Data, where the following applies:

1．You contest the accuracy of the personal data, but please allow us to verify the accuracy of the Personal Data within a certain period.
2．The processing is unlawful and you object to the erasure of the Personal Data and request that the use of the Personal Data be restricted.
3．When it is no longer necessary to retain such Personal Data for the purposes of processing, but you have necessity to request the retention for the purposes of the establishment, compliance, or exercise of legal claims, or the defense of legal claims.
4．When we are pending verification or review to prove that the collection, use, or disclosure of the Personal Data based on an exemption or for the purpose of scientific, historical or statistic research in order to reject your objection request.

Section 5. The right to rectification

Pursuant to Section 35 of PDPA, if you find that your Personal Data processed by us is inaccurate or incomplete, you have the right to request us to rectify or supplement it.

You can send us a request to apply for rectification of your Personal Data by sending an e-mail to compliance@changan.co.th.

Section 6. The right to withdrawal of consent

You also have the right to give or withdraw your consent to the collection, use or disclosure of the Personal Data at any time. You can send us a request to withdraw your consent by sending an e-mail to compliance@changan.co.th. After you have withdrawn your consent, we will no longer process the Personal Data within the scope of your withdrawal of consent, but the decision to withdraw your consent will not affect the collection, use or disclosure of the Personal Data to which you have already consented.

Section 7. Responding to your requests and complaints above

In order to protect your personal data rights and for data security, we may require you to verify your identity through a written request, etc. before accepting your request, and we will provide feedback on your request within thirty days of the date of the request. It may sometimes take longer than thirty days if your request is particularly complex or if you have already made many requests. In such cases, we will notify you and keep you updated.

In principle, we will not charge you any fees for reasonable requests, but we will charge a fee for multiple, repeated requests that exceed reasonable limits, depending on the circumstances. We may refuse requests that are unfounded, require excessive technical means (such as the development of new systems or fundamental changes to existing current practice law), pose a risk to the legitimate interests of others, or are highly impractical.

Pursuant to PDPA , if you believe that our collection, use and disclosure of your Personal Data is unlawful or does not comply with applicable data protection laws, you have the right to file a complaint with the competent authorities in Thailand: กระทรวงดิจิทัลเพื่อเศรษฐกิจและสังคม MDES.

Section 8. We may not be able to respond to your request in the following circumstances:

1. Related to the fulfillment of our statutory obligations;
2. Directly related to national security, national defense security, financial security, etc.;
3. Related to public safety and significant public interest;
4. Directly related to crime investigation, prosecution, trial and execution of judgment;
5. We have sufficient evidence to show that you have subjective malicious intent or abuse of rights;
6. Responding to your request will lead to serious damage to your legitimate rights and interests or those of other individuals or organizations.
7. Other circumstances stipulated by law.

Part 7. How we protect the Personal Data of minors

Our products or services are primarily intended for adults. Minors under the age of 20 may not create their own accounts without the consent of a parent or other guardian. We do not knowingly collect Personal Data from users under the age of 20 without the prior consent of a parent or other guardian. If we learn that we have inadvertently collected the Personal Data of any minor under the age of 20, we will delete the relevant data immediately or process the minor's Personal Data only if we can rely on a legal basis other than consent.

Part 8. How we use Cookies and similar technologies

Section 1. What are Cookies

Cookies are small file that are temporarily stored on your computer or mobile device to recognize and remember you. It is sent to your browser and stored on your computer's hard drive, tablet, or mobile device. When you visit our service providers, business partners and our websites and emails we received, we may collect data about you through Cookies or similar technologies. As there is no detailed regulation in Thailand, a more detailed description of what Cookies are and how they work can be found in the EU Cookies Guide: Cookies policy (europa.eu).

Section 2. How we use Cookies

The use of Cookies and similar technologies helps us analyze your usage to improve your experience.

When you visit CHANGAN Website, we will send cookies to your device and to Google. We promise that we will not use cookies for any purpose other than the purposes set out in this Policy.

Section 3. What type of cookies we use

Cookie	Cookie field	Purposes
Google Analytics	IDE _auc _ga _gat_newsTracker _gat_webTracker	These cookies are used to collect information about your use of our website. We use them to estimate the number of visitors to our website and the pages they visit. We then use this information to improve our website and its content.

Part 9. How we maintain updates to this Policy

We reserve the right to modify this Policy at any time. If such changes are material, we will automatically consider your consent withdrawn until you agree again to the terms of our Privacy Policy. We will not reduce your rights under this Policy without your express consent.

We will periodically post any changes to this Policy on this page and will archive older versions. You can send us a request to apply for a copy of the historical version by sending an e-mail to compliance@changan.co.th.

For major changes, we will also provide more prominent notice (including, but not limited to, special notices on browsing pages, pop-up notices, etc.) and request your consent again if necessary or required by law.

Major changes within the meaning of this Policy include, but are not limited to:
1. When there is a significant change in our service model, such as the purpose of processing Personal Data, the type of Personal Data processed, the way Personal Data is used, etc.;
2. When we undergo significant changes in our ownership structure, organizational structure, etc., such as changes of data controllers due to business restructuring, bankruptcy and mergers and acquisitions, etc.;
3. When there is a change in the main targets of in the cases of disclosure of Personal Data, cross-border and other circumstances;
4. When there is a significant change in your right to participate in the processing of Personal Data and the way of exercising your right;
5. When there is a change in the department, the contact information and complaint channels responsible for handling Personal Data security.

Part 10. How to contact us

When and if you have any questions, comments or suggestions about this Policy or matters relating to your Personal Data, or if you wish to exercise any of your rights, you can contact us in the following ways:

Email: compliance@changan.co.th
Address: Rooms No. 88 The Parq Building, Room No. 7E1-16 and 8E1-16, 7th and 8th Floors, Ratchadaphisek Road, Khlong Toei Sub-district, Khlong Toei District, Bangkok, 10110, Thailand.
Zip code: 10110

We will respond as soon as possible after receiving your information and thank you for your patience and understanding. Given the complexity and volume of requests, this period may be extended when necessary.