This Policy applies to personal data we collect from prospective and registered users of the Platform ("you," "your"), including visitors who browse Investment Segments without registering, individuals who complete our onboarding and identity-verification process, and registered investors who fund, hold, or exit a position through Focus50. It does not apply to information you provide directly to an independent asset operator, special purpose vehicle ("SPV"), or third-party service provider outside the Platform, which is instead governed by that party's own privacy notice.

The Platform is operated by [Company Legal Name, e.g., Focus50 Technologies Co., Ltd.], a company registered in [Thailand / jurisdiction] with its registered office at [Registered Address] ("Focus50," "we," "us," "our"). For the purposes of the PDPA and any equivalent data protection law that applies to you, Focus50 acts as the data controller for personal data processed to operate the Platform, and as a data processor in limited circumstances where we process data solely on the instructions of an Investment Segment partner (for example, passing verified investor documents to an SPV administrator for legal completion of an investment).

3.1 Information you give us directly

• Identity and contact data: full name, date of birth, nationality, national ID/passport number, tax identification number, residential address, email address, and phone number.
• Know-Your-Customer (KYC) and Anti-Money-Laundering (AML) data: government-issued identification documents, proof of address, selfie/liveness-check images, source-of-funds and source-of-wealth declarations, employment and income information, and politically-exposed-person (PEP) or sanctions-screening responses.
• Investor profile data: investor classification (e.g., retail, high-net-worth, or institutional, where relevant to a specific Offering), investment experience, risk tolerance, and suitability-questionnaire responses.
• Financial and payment data: bank account details, e-wallet details, and payment card data (processed by our payment providers — see Section 6).
• Communications: messages you send us through support channels, in-app chat, email, or feedback forms.

3.2 Information we collect automatically

• Device information: device model, operating system, unique device identifiers, and mobile network information.
• Usage data: pages and Investment Segments viewed, features used, session duration, and in-app navigation paths.
• Log data: IP address, browser type, access times, and referring/exit pages.
• Approximate location, inferred from your IP address or, if you consent, device GPS.
• Cookies and similar technologies, described in Section 8.

3.3 Information we receive from third parties

• Identity-verification and sanctions/PEP screening providers.
• Banking and payment partners, for transaction confirmation and fraud checks.
• Credit reference or fraud-prevention agencies, where permitted by law.
• Referral partners, if you were introduced to Focus50 by an existing user or affiliate.
• Publicly available sources, such as corporate or land registries, where relevant to verifying an Investment Segment.

3.4 Investment and transaction data

Once you invest, we hold records of your portfolio holdings, subscription amounts, funding sources, distribution and payout history, transaction confirmations, and any documents you electronically sign in connection with an Offering.

We use personal data to:

• Create and authenticate your account and verify your identity;
• Conduct KYC, AML, counter-terrorist-financing, and sanctions/PEP screening before allowing you to invest;
• Assess investor eligibility and suitability for a given Offering;
• Process subscriptions, payments, distributions, and withdrawals;
• Provide customer support and respond to enquiries;
• Maintain Platform security, detect fraud, and prevent unauthorised access;
• Comply with legal and regulatory obligations, including reporting to the Thai Securities and Exchange Commission ("Thai SEC"), the Bank of Thailand, the Anti-Money Laundering Office ("AMLO"), the Revenue Department, or equivalent authorities in other jurisdictions where we operate;
• Analyse and improve the Platform, including through aggregated or de-identified analytics;
• Send you service communications (transactional, security, and account-related) and, where you have opted in, marketing communications; and
• Enforce our Terms and Conditions and protect our legal rights.

Where the PDPA or a similar law requires a legal basis, we rely on one or more of the following:

• Consent — for example, for marketing communications, optional location access, and certain cookies;
• Performance of a contract — to create your account, process an investment, and deliver the Platform's core functionality;
• Compliance with a legal obligation — for KYC/AML checks, tax reporting, and regulatory record-keeping;
• Legitimate interests — for fraud prevention, Platform security, and product improvement, balanced against your rights and expectations; and
• Vital interests — in rare circumstances necessary to protect someone's life or safety.

We do not sell your personal data. We disclose personal data only in the following circumstances:

• Investment Segment partners and SPVs. To complete a subscription, we share the minimum necessary investor information (e.g., verified identity, subscription amount, payment confirmation) with the special purpose vehicle, asset operator, or issuer responsible for the specific container, agricultural, or solar Offering you invest in.
• Identity verification and KYC/AML providers, engaged to confirm your identity and screen for sanctions or PEP status.
• Payment processors, banks, and escrow or custody agents, engaged to move and safeguard investor funds.
• Professional advisors, including auditors, accountants, and legal counsel, bound by confidentiality obligations.
• Regulators, courts, and law-enforcement authorities, where disclosure is required or permitted by law, including the Thai SEC, Bank of Thailand, AMLO, and tax authorities.
• Service providers that host, secure, or support the Platform (e.g., cloud infrastructure, analytics, customer-support tooling), acting under data-processing agreements and only on our instructions.
• Corporate transactions. If Focus50 is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to confidentiality safeguards.

Because Investment Segments and service providers may be located outside Thailand, your personal data may be transferred to, stored, and processed in other countries. Where such a country does not maintain data-protection standards adequate under the PDPA, we rely on appropriate safeguards permitted under the PDPA (such as standard contractual clauses, binding corporate rules, or your explicit consent) before transferring your data.

We use cookies, SDKs, and similar technologies on our website and app for the following purposes:

You can manage cookie preferences through our cookie banner on first visit, your browser settings, or your device's advertising-ID controls. Blocking essential cookies may prevent parts of the Platform from working.

We retain personal data for as long as necessary to provide the Platform and fulfil the purposes described in this Policy, including the following minimum periods:

• KYC/AML records: at least the period required under Thai AML law and equivalent regulation (commonly a minimum of five years after the end of the account relationship, and longer if required by a regulator or ongoing legal matter);
• Transaction and investment records: for the duration of your holding plus the applicable statutory record-keeping period;
• Marketing data: until you withdraw consent or opt out; and
• Support communications: for a reasonable period to resolve your enquiry and maintain a service history.

After the applicable retention period, we securely delete or irreversibly anonymise the data.

We apply administrative, technical, and physical safeguards designed to protect personal data, including encryption of data in transit and at rest, role-based access controls, multi-factor authentication for staff and, where available, for users, and regular security testing. No system can be guaranteed 100% secure; if we become aware of a data breach affecting your personal data, we will notify you and the relevant authority (such as the Office of the Personal Data Protection Committee) as required by applicable law.

Subject to the exceptions and conditions under the PDPA (or the equivalent law of your country of residence), you have the right to:

To exercise any of these rights, contact us using the details in Section 16. We may need to verify your identity before actioning a request, and we will respond within the time limits required by applicable law.

The Platform is intended for adults who have reached the legal age of majority in their jurisdiction (20 years old in Thailand) and who have the legal capacity to invest. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a minor without appropriate consent, we will delete it.

The Platform may contain links to third-party websites, documents, or services (including materials published by Investment Segment operators). We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy notices separately.

We may use automated tools to support fraud detection, sanctions/PEP screening, and preliminary investor-suitability checks. Where an automated decision produces a legal or similarly significant effect on you (such as declining an investment), you may request human review by contacting us using the details in Section 16.

We may update this Policy from time to time to reflect changes in our practices, the Platform, or applicable law. We will post the updated Policy with a new "Last updated" date and, where changes are material, provide additional notice (such as an in-app message or email) before they take effect. Your continued use of the Platform after an update constitutes acceptance of the revised Policy.

If you have questions about this Policy or wish to exercise your rights, contact:

Focus50
Attn: Data Protection Officer
[Registered Address]
Email: info@focus50.app
Phone: [Insert phone number]