SPREX Money Exchange Co., Ltd. (hereinafter referred to as “MT Money Exchange” or “the Company”) uses closed-circuit television (CCTV) to monitor our premises for the protection of life, health, and property. This notice explains how we collect, use, and disclose the personal data of all individuals—including officers, employees, contractors, customers, visitors, and others—who enter our monitored spaces (collectively referred to as “you”). Legal Basis for Processing Your Personal Data

We process your personal data under the following legal grounds:

• To prevent and protect against threats to life, body, and health: This includes protecting you and any other individuals on our premises.
• For our legitimate interests and the interests of relevant third parties: This is necessary to achieve our business goals, as long as it doesn't override your fundamental rights to data protection.
• To comply with applicable laws: We use CCTV to meet legal requirements related to safety and security on our premises. Purposes of Data Collection

We collect your personal data through CCTV for these purposes:

• To ensure the health, personal safety, and security of you and your belongings.
• To protect the Company's premises, facilities, and assets from damage, disruption, vandalism, or criminal activity.
• To support law enforcement agencies in deterring, preventing, detecting, and prosecuting crimes.
• To assist in resolving disputes related to disciplinary or grievance proceedings.
• To aid in investigations or proceedings concerning whistleblowing complaints.
• To help establish or defend against any legal claims, including employment-related proceedings.

Disclosure of Your Personal Data

We treat your personal data as confidential. However, we may disclose it to relevant third parties if necessary for the following reasons:

• Law enforcement: We may share your personal data with law enforcement agencies to comply with our legal obligations and assist with the detection, investigation, and prosecution of crimes.
• Safety and security: We may disclose your data to relevant third parties to ensure the protection of your life, body, health, personal safety, and belongings Your Rights as a Data Subject

Under the Personal Data Protection Act (PDPA) B.E. 2562, you have the following rights regarding your personal data:

Under the Personal Data Protection Act (PDPA) B.E. 2562, you have the following rights regarding your personal data:

• Right of access: You have the right to request and receive a copy of your personal data that we have collected. We may deny this request if it could negatively affect the rights and freedoms of another person, as permitted by law or a court order.
• Right to rectification: You can request that we correct any incomplete, inaccurate, misleading, or outdated personal data we hold about you.
• Right to restrict processing: You can request that we restrict the processing of your personal data if:
• We are in the process of verifying the accuracy of your data.
• Your personal data was collected, used, or disclosed unlawfully.
• The data is no longer needed for its original purpose, but you still require it for a legal claim
• You have objected to the processing, and we are verifying if our legitimate grounds override your request.
• Right to object: You have the right to object to the collection, use, or disclosure of your personal data. However, we may refuse your request if we can demonstrate compelling and legitimate reasons for the processing that outweigh your interests, or if the processing is for the purpose of establishing, exercising, or defending legal claims

Personal Data Collected and Used

MT Money Exchange has installed CCTV cameras in clearly visible locations and placed clear signage at entrances and other monitored areas. This is to inform you that CCTV is in use and that your personal data is being recorded.
The types of personal data we collect may include:

• Images
• Videos
• Sound
• Images of your belongings (e.g., vehicles, bags, clothing)

Disclosure of Your Personal Data

Data Retention: We will keep your personal data for 90 days after your visit to our premises. We may retain it longer if necessary to handle any disputes or legal proceedings that may arise. After this period, your personal data will be deleted. Security Measures: We have implemented reasonable technical and administrative security measures to protect your personal data from loss, unauthorized access, destruction, or alteration. We have established internal privacy and security guidelines for handling data, and we regularly review them.

Contact Us

Changes to This Notice and Acceptance We reserve the right to amend this notice at any time and will inform you of any changes in an appropriate manner, such as through a QR code at our information counter. We recommend that you always check the up-to-date notice before entering our premises. By entering our premises, you agree to the terms of this notice. If you do not agree, please do not enter. Your continued presence on our premises after any updates to this notice will be considered your acceptance of the new terms.

Contact Us

If you have any questions about this CCTV Privacy Notice or your personal data, please contact our Data Protection Officer (DPO):

⦁ ⦁ ⦁ ⦁ “ Personal Data Protection and Management Notice “ ⦁ ⦁ ⦁ ⦁

MT Money Exchange Co., Ltd. (hereinafter referred to as “the Company”) is committed to protecting your personal data. This notice explains how we collect, use, and disclose your personal data when you use our money exchange services. By proceeding with your transaction, you acknowledge that you have read, understood, and agree to the terms of this notice.

1. Legal Basis and Purpose of Personal Data Collection

We collect your personal data based on the following legal grounds and for specific purposes:

• Legal Obligation: We are required by law, including anti-money laundering (AML) and counter-terrorist financing (CTF) regulations, to verify your identity and record transaction details. We also comply with other legal requirements related to financial transactions and reporting.
• Consent: We may ask for your explicit consent to process your personal data for specific purposes that are not required by law, such as for marketing or providing additional services.
• Legitimate Interest: We may process your data for our legitimate business interests, such as fraud prevention, security, and service improvement, as long as these interests do not override your fundamental rights.

2.Types of Personal Data We Collect

To complete a money exchange transaction and comply with legal requirements, we collect the following types of personal data from you:

• Identification Data: Full name, date of birth, nationality, gender, and details from your official identification document (e.g., Passport, Thai National ID Card).
• Contact Data: Address, phone number, and email address.
• Financial and Transaction Data: Amount and type of currency exchanged, transaction date and time, and any other information required for a valid receipt.
• Physical Data: Your photograph, which we may take as part of the transaction verification process.
• CCTV footage: Your image and likeness may be captured by our CCTV systems for security and crime prevention purposes. Please refer to our separate CCTV Privacy Notice for more details.

3. How We Use and Disclose Your Personal Data

Your personal data is used and disclosed for the following purposes:

• Transaction Processing: To verify your identity, process your money exchange transaction, and issue a valid receipt.
• Legal and Regulatory Compliance: To fulfill our obligations under AML/CTF laws, as well as to comply with other regulations and requests from government or regulatory authorities.
• Fraud and Crime Prevention: To detect, prevent, and investigate fraudulent activities or other crimes.
• Customer Service: To provide customer support and respond to your inquiries.
• Business Operations: For internal record-keeping, data analysis, and improving our services.We will keep your personal data confidential. However, we may disclose it to:
• Government and regulatory authorities: When required by law (e.g., the Bank of Thailand, Revenue Department, Anti-Money Laundering Office).
• Law enforcement agencies: In response to a legal request or to assist with crime prevention and prosecution.
• Third-party service providers: We may use trusted third parties to provide services on our behalf (e.g., IT support, security), but they will only process your data as instructed by us and are bound by confidentiality agreements.

4. Retention Period

We will retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting requirements. In most cases, we will retain your data for a minimum period as required by Thai law related to financial transactions. After the required retention period, we will securely destroy or anonymize your data.

5. Your Rights as a Data Subject

As a data subject, you have the following rights:

• Right of Access: You can request access to your personal data and a copy of the data we hold about you
• Right to Rectification: You can request that we correct any inaccurate, incomplete, or misleading data.
• Right to Erasure: You can request the deletion or destruction of your personal data, subject to legal exceptions (e.g., when we are required to retain it by law).
• Right to Restriction of Processing: You can request that we restrict the processing of your data in certain circumstances.
• Right to Object: You can object to the processing of your data in certain situations.
• Right to Data Portability: You can request to obtain your personal data in a readable format and transfer it to another data controller, where technically feasible.

To exercise any of these rights, please contact our Data Protection Officer using the details provided below.

6. Contact Us

If you have any questions, concerns, or wish to exercise your rights under this notice, please contact our Data Protection Officer:

By proceeding with this transaction, you acknowledge and consent to the collection, use, and disclosure of your personal data as described in this notice.