Personal Data Protection Policy

As PTT Exploration and Production Public Company Limited and its Subsidiaries (“Company”) are well-aware of the importance of the protection of Personal Data, this Personal Data Protection Policy was prepared to explain how the Company treats the Personal Data in general such as collection, use and disclosure of Personal Data, including rights of the data subjects, etc. Further details on the collection, use, and disclosure of Personal Data related to Company's activities will be informed to the data subject through the Personal Data Protection Statement in accordance with the law.

1. Definition

“Personal Data” means any information relating to a person which enables the identification of such Person, whether directly or indirectly, but not including the information of deceased Persons in particular.

“Sensitive Personal Data” means any information categorized by laws as sensitive Personal Data under Section 26 of the Personal Data Protection Act, B.E. 2562 such as racial or ethnic origin, political opinions, cults, religious or philosophical beliefs, sexual behavior, criminal records, health data, disabilities, trade union information, genetic data, biometric data, or any data which may affect the data subject in the same manner, as prescribed by the Personal Data Protection Committee.

2. Collection of Personal Data

The Company collects Personal Data from the data subject or from other sources, within the lawful purpose, scope, and methods. The Company will collect Personal Data to the extent necessary to fulfil the Company's purpose by relying on a legal basis and will inform the data subject of relevant details as required by the law. Where the data subject’s consent is required, the Company will obtain the explicit consent from the data subject.

In case the data subject refuses to provide the necessary Personal Data, it may result in the Company’s inability to enter into a contract with the data subject, to perform a contract, to comply with the laws, or to fulfil the purpose for the collection, use, and disclosure of Personal Data.

3. Purpose of the Collection or Use of Personal Data

The Company will collect or use data subject’s Personal Data for the Company's business purposes such as procurement, contract execution, financial transactions, company’s activities, coordination, or other activities in accordance with its objectives and in compliance with applicable laws or regulations related to the Company's operation. The Company will collect and use such Personal Data to the extent necessary to fulfil the purposes informed to the data subject or as specified by law. The Company will not process the Personal Data for any purpose other than as specified unless:

(1) The data subject has been informed of the new purpose, and/or the consent has been obtained from the data subject;

(2) It is necessary to comply with Personal Data Protection Laws or other relevant laws.

4. Disclosure of Personal data

The Company may disclose the data subject's Personal Data to other persons or organizations in accordance with the purpose informed to the data subject, with the data subject’s consent, or as permitted by the laws such as disclosure to government agencies, regulators, or in response to lawful request from authorized persons or authorities whose duties relates to Personal Data, for the benefits of the Company's operation and the provision of service to the data subject. The Company will ensure that such recipients maintain the confidentiality of the Personal Data and do not use Personal Data for any purpose other than those specified by the Company.

5. Cross-border Transfer of Personal Data

The Company may send and/or transfer your Personal Data to persons or organizations located in foreign countries, by relying on the legal basis or data subject’s consent. In cases where the country may not have Personal Data protection standards equivalent to those of Thailand, the Company will implement appropriate measures to ensure adequate protection of Personal Data sent or transferred. The Company will also ensure that the recipients have appropriate Personal Data protection standards, which may include the use of the Personal Data Protection Policy for sending or transferring Personal Data to the data controller or data processor who is in a foreign country, and is in the same affiliated business, or in the same group of undertakings in order to jointly operate the business or group undertakings (Binding Corporate Rules)

6. Personal Data Storage and Retention Period

The Company stores your Personal Data in both hard copies and electronic formats. Personal Data will be stored only as necessary to fulfil the purposes of the collection, use, and disclosure of Personal Data, including for the retention period during which the Company has the right or legal basis to collect, use, or disclose such Personal data, or for the period specified by law.

7. Standard of Security Measures

The Company implements appropriate security measures for collection, use, or disclosure of Personal Data which include technical, administrative, and physical measures covering components of related information systems based on the compliance with security measures stipulated by Personal Data laws to maintain confidentiality, integrity, and availability of Personal Data

8. Rights of Data Subject

The data subject has the following rights:

• 8.1 The right to withdraw consent for the collection, use, or disclosure of Personal Data. This withdrawal of consent will not affect the collection, use, or disclosure of Personal Data to which consent has previously been given.
• 8.2 The right to access and obtain a copy of Personal Data including the right to request the disclosure of acquisition of Personal Data obtained without consent.
• 8.3 The right to rectify Personal Data.
• 8.4 The right to delete or destroy Personal Data or anonymize Personal Data
• 8.5 The right to restrict the use of Personal Data.
• 8.6 The right to port Personal Data.
• 8.7 The right to object to the collection, use, or disclosure of Personal Data.
• 8.8 The right to lodge a complaint to the Personal Data Protection Committee.

To exercise the rights indicated above, the data subject may submit a written or electronic request form (CLICK ). The Company will consider the request and notify the data subject of the outcome within 30 days from the date the request is received.

9. Revision and Changes of Policy

The Company may update this policy every 3 years or whenever there are significant changes to the PDPA laws. The Company will clearly notify any such changes.

10. Contact Information

Corporate Governance and Subsidiary Management Department PTT Exploration and Production Public Company Limited 555/1 Energy Complex Building A, 19th - 36th Floor, Vibhavadi-Rangsit Road, Chatuchak, Chatuchak, Bangkok 10900 Thailand

Ref. No. 12157-PCY-002-R02

Effective date: 1 July 2025