Data Processing Agreement (DPA)

Annex to the General Terms of Use of the SiamPoints Platform

Between: the respective business / shop (hereinafter the “Controller” or “data controller”) and First Class Tech Ventures Co., Ltd. (operator of SiamPoints, hereinafter the “Processor” or “data processor”)

1. Subject Matter and Scope

This Data Processing Agreement (DPA) governs the rights and obligations of the parties in connection with the processing of personal data by the Processor on behalf of the Controller. This takes place in the course of providing the SaaS platform “SiamPoints” (loyalty points system, reservation engine, e-commerce shop, API payment integrations, checking of payment slips, the business’s own form fields and broadcasting). It supplements our Terms of Use.

This DPA applies exclusively to personal data in respect of which the merchant acts as data controller under the Thai PDPA (e.g. order-related delivery addresses, shop-specific reservation details, purchase histories, API payment forwarding, uploaded payment slips, guests’ feedback, information in the business’s own form fields and consents for broadcasting). For the end customer’s primary registration data used to create a global SiamPoints account (email address or sign-in via Google, Apple, Facebook or LINE — no mobile phone number is used for this), SiamPoints acts as an independent data controller in accordance with our separate Privacy Policy.

SiamPoints is not a payment service provider: the Processor does not accept payments on behalf of the Controller or its guests, does not hold any money and does not forward any; guests’ payments go directly to the Controller. Where the Processor transmits transaction data or payment slips to a payment service provider or verification service of the Controller, it does so purely technically and on the Controller’s behalf.

2. Types of Data and Categories of Data Subjects

The Processor processes the following categories of data of end customers (guests) on behalf of the Controller:

• Identification and contact data: names, email addresses and phone numbers only where the guest enters them for a delivery.

• Transaction data: loyalty points collected, details of online reservations (e.g. date, number of persons, special requests) and guests’ feedback and requests to the Controller.

• E-commerce and payment data: delivery addresses, billing addresses, products ordered and transaction details forwarded via the platform interfaces to integrated payment service providers for the processing of payments; in addition, uploaded payment slips (image, payer’s name, amount, time) and the result of their check.

• Information in the business’s own form fields: guests’ answers in additional fields that the Controller creates in its forms.

• Broadcasting: guests’ consents per service together with proof (time, version of the wording, method, IP address), the guest’s identifier with the service, unsubscriptions and the content and log of messages sent.

Categories of data subjects: End customers (guests) who interact with the respective Controller (shop/business) via the platform.

3. Obligations of the Processor (SiamPoints)

In accordance with the requirements of the Thai PDPA, the Processor undertakes as follows:

3.1 Strict adherence to instructions The Processor processes the personal data exclusively within the scope of the documented instructions of the Controller. The Controller’s use of the functions of the SiamPoints platform constitutes such a documented instruction. The Processor is expressly prohibited from processing data for its own advertising or broadcast purposes directed at the Controller’s end customers. The Processor transmits the Controller’s messages (broadcasting) only on its behalf, via its own account with the respective service, only to guests with valid consent and always with an unsubscribe line.

3.2 Data security (technical and organizational measures) The Processor takes appropriate technical and organizational security measures to protect the data against unauthorized access, loss, theft, destruction or manipulation. This includes the use of secure server infrastructures and encrypted data transmission.

3.3 Data breach notification Should the Processor become aware of a personal data breach (hacker attack, data leak), it will inform the Controller without undue delay, but no later than 36 hours after becoming aware of it. This enables the Controller to fulfill its statutory obligation to notify the Thai data protection authority (PDPC) within the prescribed 72 hours.

3.4 Assistance to the Controller The Processor assists the Controller by appropriate technical measures in fulfilling its obligation to respond to requests to exercise the rights of data subjects (e.g. access, erasure, rectification).

3.5 Deletion or return of data After termination of the main contract (end of the SiamPoints subscription) — and likewise during a suspension for non-payment — the Processor retains the personal data of the Controller processed on its behalf for six months so that the Controller can reactivate the subscription (clause 10.3 of the Subscription Terms). If the Controller requests deletion or return earlier, the Processor will, at the Controller’s choice, either securely delete this data or return it in a common format. After the six months have expired, the Processor securely deletes the data. In each case, this applies unless Thai laws (e.g. the Computer Crimes Act) require longer retention of the technical logs. Guests’ points are preserved in their SiamPoints accounts.

3.6 Confidentiality, records and statutory obligations The Processor obliges all persons who process the data to maintain confidentiality and keeps a record of its processing activities in accordance with the PDPA. It may disclose data where required to do so by law, an authority or a court under Thai law — for example logs under Section 26 of the Computer Crimes Act; where legally permitted, it informs the Controller of this.

4. Engagement of Sub-Processors and International Transfers

The Controller hereby grants the Processor general authorization to engage further processors (sub-processors) that are strictly necessary for the secure operation of the platform. These sub-processors include in particular:

• cloud and server hosting providers

• content delivery networks (CDN) and security infrastructures (e.g. Cloudflare with web application firewalls to protect against cyberattacks, Turnstile and the storage of public media)

• communication gateways (e.g. email delivery services, LINE Messaging API)

• address search and maps (Geoapify, OpenFreeMap)

• payment service providers / payment gateways (e.g. Stripe, Opn Payments or comparable providers), insofar as their integration is used for B2C payment processing in the Controller’s online shop — via the Controller’s own account.

Checking of payment slips: If the Controller switches on the automatic check, it chooses the verification service (such as SlipOK, EasySlip or Thunder) and uses it via its own account; the contract with this provider is the Controller’s own contract, and it bears its costs. The Processor merely transmits the slip technically on the Controller’s behalf. Likewise, for broadcasting the Controller uses its own account with the respective service (in Thailand, LINE); that account is governed by the service’s terms and by the Broadcasting Terms.

International data transfer: The Controller acknowledges and expressly agrees that some of the sub-processors mentioned (in particular cloud hosting and CDN providers) operate server infrastructures outside Thailand. The processed data may therefore be transferred internationally. The Processor ensures by contractual and technical means that these sub-processors and recipient countries have adequate data protection standards that meet the requirements of the Thai PDPA (in particular Section 28).

5. Obligations and Liability of the Controller (Merchant/Shop)

1. Legal basis: The Controller warrants that it has a valid legal basis under the PDPA for the collection and processing of data via the platform (in particular for reservation or order data going beyond this). It is solely responsible for legally assessing and handling data protection requests from its end customers.

1. Indemnification and limitation of liability: The Controller shall fully indemnify the Processor against any claims, penalties or claims for damages of third parties (including the Thai data protection authority, the PDPC) arising from a breach of the PDPA caused by the Controller. With regard to the contractual liability of the Processor (SiamPoints) under this DPA, the limitations and caps on liability set out in the General Terms of Use apply in full and mutatis mutandis.

1. Own form fields, broadcasting and verification services: The Controller is solely responsible for the content of its own form fields (sensitive data only with express consent), for the consents and messages in broadcasting and for the choice and use of its verification service and its payment service provider. The indemnity under item 2 also applies to these.

6. Final Provisions

This DPA is governed by the laws of the Kingdom of Thailand. It enters into force upon the Controller’s electronic acceptance (e.g. via a checkbox upon registration) and forms an integral part of the General Terms of Use of the SiamPoints platform. The Thai version is authoritative (section 14 of the Terms of Use).