The Company has established a Confidentiality Policy to ensure that directors, executives, and employees adhere to appropriate practices for safeguarding and using confidential information, particularly information that is sensitive to the Company or its stakeholders. In addition, the Company has implemented a Cybersecurity and Information Technology Policy and the Instructions on the Use of Computer and Network Systems to manage and ensure the secure use of computers, information, and network systems. The Company has also adopted a Personal Data Protection Policy aligned with international standards and legal requirements, such as the Cybersecurity Act and the Personal Data Protection Act (PDPA).

See more details about our Information Security and Data Privacy Policy.

The Company prioritizes the development of cybersecurity measures to protect the information of the Company and its key stakeholders, including employees, customers, business partners, suppliers, and contractors. Accordingly, the Company has established goals for cybersecurity operations and data security. These goals include implementing a data leakage prevention system across all business units (100%) and ensuring there are no complaints regarding personal data leakage.

The Company focuses on reducing the likelihood and impacts of incidents and cyber-attacks on its information technology system. A working group has been set up to review the security system’s structural architecture, identifying vulnerabilities in critical work systems, to ensure that sensitive components in every system are continuously monitored.

The Company mandates that data users strictly adhere to the policy and terms of use. To support compliance, it provides training on measures to manage and maintain the security of personal information. Additionally, the Company has raised awareness and fostered a fundamental understanding of information security and cyber threat trends among executives and employees. This training enables them to handle and use data safely, exercise caution, and prevent cyber-attacks. Security measures include using information technology systems that require password-protected access and regularly changing passwords within a specified period. On October 4, 2024, the Company conducted a Cyber Security Awareness training for employees on the topic "Cybersecurity in Daily Life." The training covered Cybersecurity AI trends, cyber threats, phishing attacks, and social engineering tactics. A total of 100 employees participated in the session, accounting for 32% of the total workforce

If a stakeholder identifies an incident of non-compliance with regulations, a violation of personal data, or a leakage of stakeholder information, they may file a trace or complaint through the Company’s complaints channel. In 2024, the Company received no complaints related to violations of personal data, leakages of stakeholder information, or any incidents of company information leakage or cyber-attacks.