Bitkub Blockchain Technology Co., Ltd.(the "Company," "we," "us," or "our") recognizes the importance of the protection of your Personal Data , we therefore provide this privacy notice to inform our customers of our policy in relation to the collection, use and disclosure of personal data in accordance with Thailand Personal Data Protection Act B.E. 2562, relevant laws and regulations.

This privacy notice (the "Privacy Notice") applies to the Personal Data (defined below in section 1) of (1) our prospective, current and former individual customers , (2) employees, personnel, officers, representatives, shareholders, authorized persons, members of the board of directors, contact persons, agents, and other natural persons in connection with our prospective, current and former corporate customer , and (3) third parties relevant to the services provided by us .

This Privacy Notice describes how we collect, use, disclose and cross-border transfer your Personal Data. This Privacy Notice applies to our business, websites, mobile applications, call centers, events and exhibitions, online communication channels, other locations and any means where we collect, use disclose, or cross-border transfer your Personal Data.

1. Personal data we collect, use, disclose, and/or cross-border transfer

We will collect, use, disclose and/or cross-border transfer the following categories and types of your Personal Data, including but not limited to:

General personal data

(a) Identification details,such as your title, name, middle name, surname, gender,, nationality, date of birth, age, marital status, information on government-issued cards and documents issued by government (e.g. national identification number, photo on identification card, laser number on the identification card, expiry date of identification card, passport number, tax identification number, house registrar, and in circumstances of a minor, personal data including information on birth certificate, adoption certificate, and in circumstances of a minor who got married, personal data including marriage certificate, divorce certificate) , data on relevant court’ orders, voice recording, picture, video and other identification/ know-your customer (KYC) information;

(b) Contact details,such as your address, telephone number, mobile number, email address, Facebook account, and a copy of house registrar;

(c) Transaction details, such as your transaction history, sale and purchase items and amount, and selling and purchasing behaviour;

(d) Education and Work details

(e) Account and financial details,such as your account name (account identifiers), account holder’s name, profile picture, profile banner, account number and account type, current assets, income and expenses, and assets information;

(f) Technical details,such as your Internet Protocol (IP) address, wallet address, web beacon, log, device ID and type, network, connection details, access details, single sign-on (SSO) details, login log, access times, time spent on our page, cookies, login data, search history, chat history, browsing details, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on devices you use to access the platform; and

(g) Usage details,such as information on how you use the websites, platform, products and services; and

Sensitive data

(a) Sensitive Data as shown in the identification document (e.g. race, religion and blood type). In circumstance where you have provide us with a copy of your identification document, and the following data have not been concealed, the Company may take the steps to conceal such data for privacy and security purposes.

(b) Biological Data such as facial recognition

2. The Purpose of collection, use or disclosure of your Personal Data

We may collect, use, disclose and/or cross-border transfer your Personal Data and Sensitive Data for the following purposes.

2.1 Purpose for which consent is required

We rely on your consent to:

(a) provide marketing communications, special offers, promotional materials outside the scope of our products and services which may not be justify by other legal grounds

(b) transfer or disclose your personal data to our affiliates and subsidiaries and the third parties for marketing purposes

(d) collect, use, and/or disclose your Sensitive Data which falls outside the grounds for processing data without consent, for the purpose of verification and know-your-customer (KYC) process.Where the legal basis is consent, you have the right to withdraw your consent at any time. This can be done so, by contacting us at the address in "10. Contacting Us" section of this Privacy Notice. The withdrawal of consent will not affect the lawfulness of the collection, use, and disclosure of your Personal Data and Sensitive Data based on your consent before it was withdrawn. However, the withdrawal of consent may affect you so that you lose convenience, do not receive special offers, or may not receive the services relating to the Personal Data in which you have requested to withdraw.

2.2 Purpose for which we may rely on other legal grounds for processing your Personal Data

In pursuant to the law, we may collect, use, disclose, and/or transfer, including transfer cross-border, of your Personal Data as set forth in this Privacy Notice based on (1) contractual obligations (2) legal grounds (3) necessary for our or any other person's legitimate interests which are balanced with your fundamental rights in relation to the protection of your Personal Data (4) for preventing or suppressing a danger to a person's life, body or health basis (5) necessary for the performance of a task carried out in the public interest or it is necessary for the exercising of official authority; and (6) necessary for the establishment, compliance, exercise or defence of legal claims, for the following purposes:

(a) contacting and communicating with you for performing in accordance with or for the interest of entering into a contract with us;

(b) processing applications for verification and record of account opening, account maintenance, and operations relating to your accounts, including without limitation, processing your applications or requests for services or products, processing your transactions, displaying your account movement, and operating and closing your accounts;

(c) providing services to you, such as, blockchain network provider, Non-Fungible Token (NFT) platform, transfer of digital assets or NFT, receipt of digital assets or NFT from others, recording of information about your digital assets or NFT into your wallet, displaying your digital assets or NFT, data connection to digital asset exchange, NFT payment, digital assets custody, depository or redemption of relevant rewards or benefits and rights, delivery of products, services and rewards, enter white list in gachapon redemption, store opening on Bitkub NFT Marketplace, NFT minting, subscriptions to other services that might be necessary for using our services such as Developers Tools, BKC Oracle, information acquisition to perform actions such as the procedure in case of or getting the password, from time to time and dealing with all matters relating to the services;

(d) carrying out your instructions, displaying and verifying information about your transaction, including wallet address;

(e) managing your relationship with us and administration of your account with us, responding to your inquiries or feedback, and resolving your complaints, addressing or investigating any complaints, claims or disputes;

(f) conducting identity verification and credit checks, know-your-business (KYB), know-your-customer (KYC) and customer due diligence (CDD) processes, checking membership, conducting credits scoring, other checks and screenings, and ongoing monitoring that may be required under any applicable law;

(g) preventing, detecting and investigating fraud, misconduct, or any unlawful activities, whether or not requested by any governmental or regulatory authority, and analysing and managing risks;

(h) complying with all applicable laws, regulations, rules, directives, orders, instructions and requests from any governmental, tax, law enforcement or other authorities or regulators (whether local or foreign), such as Thai Revenue Department;

(i) managing our infrastructure, internal control, [internal] audit and business operations and complying with our policies and procedures that may be required by applicable laws and regulations including those relating to risk control, security, audit, finance and accounting, systems and business continuity,;

(j) provide marketing communications, information, news, special offers, and promotional materials about the products and services of the Company, our affiliates and subsidiaries and the third parties, and arrange projects or marketing campaigns, meetings and seminars;

(k) developing new services and products and updating you on our services and products from time to time;

(l) carrying out research, planning, assessment, and statistical analysis, for example, on your behaviour in using products or services, for the purpose of developing our services and products, and for marketing purposes to the extent that is foreseeable;

(m) organizing our promotional campaign or events, conferences, and seminars;

(n) enforcing our legal or contractual rights including, but not limited to, recovering any and all amounts owed to us;

(o) facilitating financial audits to be performed by an auditor, or receiving legal advisory services from legal counsel appointed by you or us; and

(p) performing our obligations under any agreements to which we are a party, e.g. agreements with our business partners, or vendors, or under which we are acting as an agent.

3. Disclose or transfer your Personal Data

We may disclose or transfer your Personal Data to the following third parties (including their personnel and agents) who process Personal Data in accordance with the purposes under this Privacy Notice. These third parties may be located in or outside Thailand. You can visit their privacy policies to learn more details on how they process your Personal Data.

3.1 Bitkub Group

As Bitkub Blockchain Technology Co., Ltd is part of a Bitkub Group, we may transfer your Personal Data to, or otherwise allow access to such Personal Data by, other companies within Bitkub Group, including the following companies, for the purposes set out above. Please see the list of companies and scope of activities within Bitkub Grouphere.

● Bitkub Online Co., Ltd.

● Bitkub M Co., Ltd.

● Bitkub Labs Co., Ltd.

3.2 Our service providers

We may use other companies, agents or contractors to perform services on our behalf or to assist with the provision of products and services to you. We may share your Personal Data with these service providers, including but not limited to: (a) IT service providers;(b) research agencies; (c) analytics service providers;(d) survey agencies;(e) marketing, advertising media and communications agencies; (f) payment service providers;and (g) administrative and operational service providers.

In the course of providing these services, the service providers may have access to your Personal Data. However, we will only provide our service providers with the Personal Data that is necessary for them to perform the services, and we ask them not to use your Personal Data for any other purposes. We will ensure that all the service providers we work with will keep your Personal Data secure.

3.3 Our business partners

We may transfer your Personal Data to persons acting on your behalf or otherwise involved in the provision of the type of product or service you receive from us, including payment recipients, beneficiaries, intermediaries, custodians, agents, vendors, co-brand business partners, market counterparties, or issuers of products to whom we disclose Personal Data in the course of providing products and services to you and whom you authorize us to disclose your Personal Data to, provided that these data recipients agree to treat your Personal Data in a manner consistent with this Privacy Notice.

3.4 Third parties permitted or specified by law

In certain circumstances, we may be required to disclose or share your Personal Data with a third party in order to comply with legal or regulatory obligations. This includes any law enforcement agency, court, regulator, government authority or other third parties, such as other clients, for which we believe disclosure or transfer is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, the rights of any third party's or individuals' personal safety, or to detect, prevent, or otherwise address fraud, security or safety issues.

3.5 Professional advisors

We may disclose or transfer your Personal Data to our professional advisors relating to audit, legal, accounting, and tax services who assist in running our business and defending or bringing any legal claims.

3.6 Third parties as assignees, transferees, or novatees

We may assign, transfer, or novate our rights or obligations to a third party, to the extent permitted under the terms and conditions of any contract between you and us. We may disclose or transfer your Personal Data to assignees, transferees, or novatees, including prospective assignees, transferees, or novatees, provided that these data recipients agree to treat your Personal Data in a manner consistent with this Privacy Notice.

3.7 Third parties connected with a business transfer

We may disclose or transfer your Personal Data to our business partners, investors, significant shareholders, assignees, prospective assignees, transferees, or prospective transferees in the event of any reorganization, restructuring, merger, acquisition, sale, purchase, joint venture, assignment, dissolution or any similar event involving the transfer or other disposal of all or any portion of our business, assets, or stock. If any of the above events occur, the data recipient will comply with this Privacy Notice to respect your Personal Data.

3.8 Public information

With nature of our businesses, some of your personal data might be disclosed to the public on our blockchain network.

4. International transfers of your Personal Data

We may disclose or transfer your Personal Data to third parties or servers located overseas, and the destination countries may or may not have the same data protection standards as Thailand. We have taken steps and measures to ensure that your Personal Data is securely transferred, that the data recipients have suitable data protection standards in place, and that the transfer is lawful by relying on the derogations as permitted under the law.

5. How long do we keep your Personal Data

We retain your Personal Data for as long as is reasonably necessary to fulfil the purposes for which we have obtained it as set out in this Privacy Notice and to comply with our legal and regulatory obligations. However, we may have to retain your Personal Data for a longer duration, if required by applicable law and if there is any continuing dispute.

6. Other important information about your Personal Data

6.1 Cookies and how they are used

If you visit our websites, we will gather certain information automatically from you by using cookies. cookies are tracking technologies that are used in analyzing trends, administering our websites, tracking users' movements around the websites, and remembering users' settings.

Most Internet browsers allow you to control whether or not to accept cookies. If you reject cookies, your ability to use some or all of the features or areas of our websites may be limited.

6.2 Personal Data of minors, quasi-incompetent or incompetent person

If we become aware that we have unintentionally collected, used and/or disclosed personal data from the minor; (person who are under the age of majority (such as minor under the age of 20 or are under the age of majority by marriage)) without the consent of the exercise of parental power if necessary or from the quasi-incompetent person without the consent of the legal curator or the incompetent person without the consent of the legal guardian, we will delete that personal data immediately or continue to process that personal data if we are able to rely on legal or any basis other than obtaining consent. If you are a parent of a the minor, curator of the quasi-incompetent or guardian of the incompetent and have found out that we have collected, used and/or disclosed the personal data of the minor, the quasi-incompetent or incompetent person, as the case may be, without your consent and without exception by law to do so. Please contact us as detailed in Clause 10. Contact Us of this privacy notice. We have no intention of collecting, using and/or disclosing personal data of the minor, quasi-incompetent person or incompetent person who wishes to have a contractual relationship with us and without legal exceptions to do so. You must obtain the consent of your parent, curator or guardian, as the case may be, before contacting us or providing us with your personal data.

6.3 Personal Data related to third parties

If you provide the Personal Data of any third party (such as your spouse and children, shareholders, directors, beneficiary, emergency contact, referral, and references) to us, e.g. their name, family name, email address, and telephone number, you should ensure that you have the authority to do so and to permit us to use the Personal Data in accordance with this Privacy Notice. You are also responsible for notifying the third party of this Privacy Notice and, if required, obtaining consent from the third party or relying on another legal basis.

7. Your rights with regard to your Personal Data

Subject to the applicable laws and exceptions thereto, you may have the following rights regarding your Personal Data:

(a) Access: you may have the right to access or request a copy of the Personal Data we are processing about you;

(b) Data Portability: you may have the right to obtain Personal Data held about you, in a structured, electronic format, and to transmit this data to another data controller;

(c) Objection: in some circumstances, you may have the right to object to how we process your Personal Data in certain activities specified in this Privacy Notice;

(d) Deletion: you may have the right to request that we delete, destroy, or de-identify your Personal Data that we process about you, e.g. if the data is no longer necessary for the purposes of the processing;

(e) Restriction: you may have the right to restrict our processing of your Personal Data if you believe such data to be inaccurate, that our processing is unlawful, or that we no longer need to process this data for a particular purpose;

(f) Rectification: you may have the right to have Personal Data that is incomplete, inaccurate, misleading, or out-of-date rectified;

(g) Consent withdrawal: you may have the right to withdraw consent that was given to us for the processing of your Personal Data unless there are restrictions on the right to withdraw consent as required by the law, or a contract that benefits you; and

(h) Lodge a complaint: you may have the right to lodge a complaint to the competent authority if you believe our processing of your Personal Data is unlawful or in non-compliance with applicable data protection law.

To exercise any of these rights in this section, you may contact us at the address in "10. Contacting Us" section below.

Your request for exercising any of the above rights may be limited by the applicable laws and exceptions. There may be certain cases where we can reasonably and lawfully decline your request; for example, due to exemptions by law for you to exercise the rights, our technical restriction/limitation in relation to nature of our services (for example, information that cannot be erased from blockchain network), our legal obligation or court order. If we decline your request, we will notify you of our reason.

8. Security Measures

We maintain appropriate security measures for Personal Data, which cover administrative, technical and physical safeguards in relation to access control to protect the confidentiality, integrity, and availability of Personal Data against any accidental or unlawful or unauthorized loss, access, use, alteration, correction or disclosure of Personal Data, in compliance with the applicable laws.

We have implemented access control measures which are secure and suitable for our collection, use and disclosure of Personal Data. We restrict access to Personal Data, as well as storage and processing equipment, by imposing access rights or permission, user access management to permit access to authorized personnel, and user responsibilities to prevent unauthorized access, disclosure, perception or unlawful duplication of Personal Data, or theft of device used to store and process Personal Data. This includes methods enabling the re-examination in relation to access, alteration, erasure, or transfer of Personal Data which are in accordance with methods and channels to collect, use or disclose Personal Data.

9. Changes to this Privacy Notice

From time to time, we may change or update this Privacy Notice. We encourage you to read this Privacy Notice carefully and periodically revisithttps://bitkubblockchain.com/to review any changes that may occur in accordance with the terms of this Privacy Notice. We will notify you or obtain your consent again if there are material changes to this Privacy Notice, or if we are required to do so by law.

10. Contacting Us

If you wish to contact us to exercise the rights relating to your Personal Data or if you have any queries or complaints about your Personal Data under this Privacy Notice, please contact us or our data protection officer via the following avenues:

● Bitkub Blockchain Technology Co., Ltd.

oAddress: 2525, FYI Center, Tower 2, 11th floor, Unit 2/1101-2/1107, Rama 4 Road, Klongtoei Sub-district, Klongtoei District, Bangkok, Thailand 10110

oContact number: 02-032-9555
Contact email: dpo_bbt@bitkub.com

● Group Data Protection Officer

o Contact email: dpo_bbt@bitkub.com or contact our address mentioned above.

**********