Lighthouse Info Service Co., Ltd. ("the Company") recognizes the importance of personal data protection and its obligations under the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). The Company respects your privacy rights and is committed to safeguarding your personal data through appropriate security measures. We strive to ensure that your personal data is protected in accordance with applicable data protection laws and other relevant regulations.

This Privacy Notice has been prepared to inform you of the details regarding the collection, use, and disclosure of your personal data (collectively referred to as "processing"), as well as your rights as a data subject under applicable laws.

Please read this Privacy Notice carefully before providing your consent.

For users who have not reached the legal age of majority (20 years of age under Thai law), or who are adjudged incompetent or quasi-incompetent, consent must be obtained from their parent, legal guardian, curator, or authorized representative, as applicable, prior to accepting this Privacy Notice or exercising any rights under applicable data protection laws.

By accepting this Privacy Notice, the Company shall deem that such consent has been duly obtained from the relevant authorized person.

If the Company becomes aware that personal data has been collected from such individuals without proper consent verification, the Company will take reasonable steps to delete such information from its systems and servers.

1. Definitions

1.1 Platform

"Platform" means the One Platform (one.in.th), which is operated by Online Network Event Co., Ltd., the event co-organizer, and is used for registration and participation in the NIPPON HAKU BANGKOK 2026 event.

1.2 Customer

"Customer" means any individual who is a target customer of the Company's products or services, including participants in the Company's marketing campaigns or promotional activities, individuals expressing interest in the Company's products or services through any channel, users of the Company's online or electronic services, and any person legally authorized to act on behalf of such individual, including parents, guardians, or curators, as applicable.

1.3 Personal Data

1.3.1Personal Data

"Personal Data" means any information relating to an identifiable individual, whether directly or indirectly, but excluding information relating specifically to deceased persons. Examples include, but are not limited to: Email address, Gender, Age, Country of Residence

Interests relating to promotions and events

1.3.2 Sensitive Personal Data

"Sensitive Personal Data" means personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disabilities, labor union information, genetic data, biometric data, location data, device information such as IP addresses, cookies, activity logs, and any other data classified as sensitive personal data under applicable law.The Company will process Sensitive Personal Data only where explicit consent has been obtained from the data subject or where otherwise permitted by law.Unless otherwise specified herein, the terms "Personal Data" and "Sensitive Personal Data" shall collectively be referred to as "Personal Data."

2. Scope of This Privacy Notice

This Privacy Notice applies exclusively to individuals who register for participation in events through the Platform operated in connection with the Company.

3. Personal Data Collected

The Company collects only the personal data necessary for the purposes specified in Section 5, including:

1. Email Address
2. Gender
3. Age
4. Country of Residence 

4. Sources of Personal Data

The Company collects personal data directly from customers through the Platform, regardless of the access channel used, including mobile applications and websites.

5. Purposes of Collection, Use, and Disclosure of Personal Data

The Company collects, uses, and discloses personal data for the purpose of maintaining a customer database for event organizers to conduct marketing analysis through LINE during the event operation period from 15 June 2026 to 30 August 2026.

5.1 Contractual Necessity

The Company processes personal data where necessary for the performance of a contract relating to the use of the Platform, including:

• Communicating with users;
• Verifying user identity and preventing spam, unauthorized activities, or unlawful conduct;
• Personalizing content, recommendations, notifications, and user experiences;
• Providing location-based services where applicable;
• Complying with the Company's terms and conditions; and
• Complying with applicable laws, regulations, and regulatory requirements.

5.2 Consent

Where required by law, or where no other lawful basis applies, the Company will obtain the data subject's consent before processing personal data for the following purposes:

• Direct marketing;
• Targeted advertising;
• Service enhancement and personalization; and
• Promotional communications through channels selected by the data subject.

5.3 Legitimate Interests

The Company may process personal data based on its legitimate interests to:

• Better understand how users access and use the Company's services;
• Improve products, services, and user experiences;
• Conduct research, analytics, and statistical assessments relating to the use of the Platform; and
• Enhance customer satisfaction and service quality.

6. Disclosure of Personal Data

6.1 Internal Disclosure

To achieve the purposes described in this Privacy Notice, the Company may disclose Personal Data to relevant personnel within the Company on a need-to-know basis and only to the extent necessary for the performance of their duties.

Such persons may include:

• Sales personnel and other relevant employees whose responsibilities require access to Personal Data;
• Executives, managers, and supervisors responsible for business operations, decision-making, or personnel administration;
• Supporting departments, including Information Technology, Administration, Accounting, Procurement, Finance, and other related functions.

The Company implements appropriate access controls to ensure that only authorized personnel have access to Personal Data.

6.2 External Disclosure

The Company may disclose or transfer Personal Data to third parties where necessary for the purposes stated in this Privacy Notice, including:

• Event organizers utilizing the Platform;
• Service providers engaged by the Company;
• Cloud service providers and data hosting providers;
• Technology and system support providers; and
• Government authorities, regulatory agencies, courts, or other entities where disclosure is required by law.

Where Personal Data is disclosed to third parties, the Company shall require such parties to implement appropriate security measures and maintain the confidentiality of Personal Data in accordance with applicable laws.

Please note that any third-party websites linked from our website are governed by their own privacy policies, and the Company is not responsible for the privacy practices of such external websites.

7. Retention of Personal Data

 7.1 Retention Period

The Company will retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, used, and processed, including compliance with applicable legal obligations.

7.2 Deletion and Destruction

Upon expiration of the applicable retention period, or when Personal Data is no longer necessary for the purposes for which it was collected, the Company will delete, destroy, anonymize, or otherwise render such Personal Data permanently unidentifiable, unless retention is required by law.

The Company will also process requests from data subjects for deletion of Personal Data in accordance with applicable laws.

7.3 Security of Stored Data

The Company maintains Personal Data in secure environments accessible only to authorized personnel who are required to keep such information confidential.

Where applicable, sensitive information transmitted through the Platform is protected using Secure Socket Layer (SSL) encryption technology and stored on secure servers and cloud-based infrastructure maintained in accordance with industry-standard security practices. 

8. Rights of Data Subjects

Subject to applicable laws, you are entitled to exercise the following rights:

(1) Right to Withdraw Consent

Where processing is based on your consent, you may withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.

Please note that withdrawing consent may affect your ability to receive certain services, benefits, promotional offers, communications, or personalized experiences.

(2) Right of Access

You have the right to request access to your Personal Data and obtain a copy of such data held by the Company, including information regarding how the Company obtained such data.

The Company may refuse a request where disclosure would adversely affect the rights and freedoms of others or where disclosure is prohibited by law or court order.

(3) Right to Data Portability

You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and, where technically feasible, to request that such data be transmitted directly to another data controller.

(4) Right to Object

You have the right to object to the processing of your Personal Data where such processing is based on the Company's legitimate interests or public interest grounds.

If you object, the Company will cease such processing unless compelling legitimate grounds exist that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defense of legal claims.

You also have the right to object to processing conducted for direct marketing purposes.

(5) Right to Erasure

You have the right to request the deletion, destruction, or anonymization of your Personal Data where:

• The Personal Data is no longer necessary for the purposes for which it was collected;
• Processing is unlawful;
• You have withdrawn consent and no other lawful basis exists; or
• You have successfully exercised your right to object.

The Company may retain Personal Data where required by law or for the establishment, exercise, or defense of legal claims.

(6) Right to Restriction of Processing

You may request that the Company temporarily suspend the processing of your Personal Data under circumstances permitted by applicable law.

(7) Right to Rectification

You have the right to request correction of inaccurate, incomplete, misleading, or outdated Personal Data.

(8) Right to Lodge a Complaint

You have the right to lodge a complaint with the relevant supervisory authority if you believe that the collection, use, or disclosure of your Personal Data violates applicable data protection laws.

8.1 Exercise of Rights

Upon receiving a request from a data subject, the Company will process the request within the period prescribed by law.

The Company reserves the right to refuse requests where permitted by applicable laws.

 8.2 Company's Discretion

The Company reserves the right, at its sole discretion and subject to applicable laws, to approve or reject any request submitted by a data subject.

Where a request is denied, the Company will provide reasons for such denial as required by law.

9. Personal Data Security Measures

The Company maintains appropriate technical, administrative, and organizational safeguards to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, or other unlawful forms of processing. Such safeguards are regularly reviewed and updated to ensure a level of security appropriate to the risks involved in processing Personal Data. These measures apply to all forms of Personal Data processing, whether electronic or paper-based.

10. Personal Data Breach Notification

In the event of a Personal Data Breach, the Company will notify the Office of the Personal Data Protection Committee (PDPC) without undue delay and, where feasible, within seventy-two (72) hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of affected individuals.

Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals, the Company will notify affected data subjects without undue delay and provide information regarding remedial measures through appropriate communication channels, including the Company's website, SMS, email, telephone, or registered mail, where applicable.

11. Changes to this Privacy Notice

The Company may review and update this Privacy Notice from time to time to ensure compliance with applicable laws, regulations, and business practices.

Where material changes are made, the Company will provide notice through appropriate communication channels and publish the updated version of this Privacy Notice.

You are encouraged to review this Privacy Notice periodically to stay informed of any changes.

12. Contact Information

If you have any questions, concerns, or complaints regarding the processing of your Personal Data, or if you wish to exercise any of your rights under applicable data protection laws, please contact:

 Lighthouse Info Service Co., Ltd.

Liberty Square Building, Unit 2303, 23rd Floor
287 Silom Road, Silom Sub-district
Bang Rak District, Bangkok 10500
Thailand

13. Governing Law

This Privacy Notice shall be governed by and construed in accordance with the laws of the Kingdom of Thailand.

Any dispute arising out of or in connection with this Privacy Notice shall be subject to the exclusive jurisdiction of the Thai courts.

By providing your consent, you acknowledge that you have read and understood this Privacy Notice in its entirety and that you freely and voluntarily consent to the collection, use, and disclosure of your Personal Data as described herein, without coercion or undue influence.

You understand that you may withdraw your consent at any time, subject to legal restrictions or contractual obligations between you and the Company. Any withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.