2.1 ATOM Myanmar Limited collects personal information about you, and we will process it in accordance with the following key principles:

• We are open about how we collect process and protect your personal information.
• We will process your personal information in accordance with Telecommunication Law, other relevant laws, rules and notifications in Myanmar (referred to as “applicable law”) and regulatory requirement with this privacy policy.
• We will only process your personal information for legitimate purposes and normally only for as long as it is necessary to achieve those purposes or for as long as we are otherwise required by applicable law and our obligation under relevant laws and licenses to retain it.
• We will do our best to enable you to exercise choice and control over our processing of your personal information, not only when we are required to do so by applicable law, but also in other circumstances in which we think this is appropriate and technically feasible.
• We will respect the privacy rights that you have under applicable law, including your right to access the personal information that we hold about you, correct it and keep it up to date.
• We will implement security measures to keep your personal information safe and secure.
• We always take steps to ensure that we keep your personal information safe and secure.
• If you fail to supply us the above personal information or if the personal information supplied is insufficient or not satisfactory to us, we may not be able to process your application and/or provide you with our services detailed in Section 7 “How we use your personal information”.

3.1 ATOM Myanmar Limited that provides you the service(s) that you use normally determines the purposes for which and the means by which your personal information is processed, and therefore acts as the "data controller" and is legally responsible for ensuring that your personal information is processed in accordance with our key privacy principles, this privacy policy and applicable law.

3.2 When we share your personal, we will ensure that the personal data is processed in accordance with our key privacy principles, this privacy policy and applicable law.

4.1 We collect personal information about you in three ways:

4.1.1 information that you provide to us, for instance when you subscribe for our services;

4.1.2 information that we collect automatically when you use our services;

4.1.3 information that we may obtain about you from third parties.

We explain below what personal information we typically collect about you in these three ways.

4.1.1 Information that you provide to us, for instance when you subscribe for our services

(a) When you sign up for one of our services or when you receive one of our services, you may provide us with certain personal information. The types of such information may include:

• Your name, NRC/Passport number, image of NRC/Passport Copy, phone number, email address, postal address, date of birth, gender and other information you give us when registering to receive one of our services in a store, online, by phone or participating in any of ATOM Myanmar event such as promotion, survey.
• Credit or debit card information, bank account number and sort code or other banking or payment information, as well as amounts, dates and times of any payments that you make to us.
• Your preferences regarding the services that we provide. This will usually be collected through your service settings when setting up the service.
• Information about your customer account with us, for example the type of contract you hold with us, any service you have subscribed to, and any dates of payment owed and received.
• Records of your contact with us, for example a customer note, an email or letter you send to us, information about any customer support requests that you make or any feedback that you provide to us.
• Information about our communications with you, for example any customer support requests that you make or any feedback that you provide to us.
• The contact information that you provide to us if you choose to receive marketing, promotion, news and updates from us.
• The contact information and other information, such as demographic information about you and your household, that you provide to us when you agree to participate in one of our competitions, marketing event, prize draws, research surveys or consumer panels or provide other feedback to us regarding our products or services.
• Some of the services provided on our websites, such as appear.in or online.no, require you to have an online account with us. If you want to set up an online account, we will ask you to give us certain personal information, such as your name, NRC/ Passport number, phone number and email address, and to create a unique password for your account. Generally, these services enable you to have a registered owner, an individual responsible for making payments and one or more users. If you choose to let others, such as members of your family, use your account, you should ask them to read this privacy policy.

4.1.2 Information that we collect automatically when you use our services

(a) When you use our services, we will automatically collect certain information about you and your device. The information that we collect automatically will vary depending on the service and the device that you are using to access and/or benefit from our service.

(b) We will collect information about the type of device and software that you use to access our services, for instance whether you use an iPhone or Samsung phone, and what operating system is running on your device.

(c) When you use our telecommunication services, we automatically collect information about your communications, including:

• the phone numbers that you call/text or that call/text you;
• the date and time of the calls and texts you send or receive;
• the duration of calls received and made through our network;
• your approximate location at the time these communications take place, as further explained in the section on location data below;
• your browsing information and
• the type and level of service you receive from us.

(d) When you visit one of our websites and/or use one of our online services, we collect information concerning your terminal equipment or device and your use of our online services. Such information usually includes:

• the IP address of your terminal equipment or device, such as your PC, laptop or smartphone;
• information about your terminal equipment or device model and settings;
• network information and
• details of when, where and how you used the service.

(e) When you visit one of our websites and/or use one of our online services we may also collect the following information:

• log-in information;
• browser type and version;
• browser plug-in types and versions;
• operating system and platform;
• information about your visit including the websites from which you come to our website, the pages on our website that you visit, and the websites you visit from our website;
• information about the services and products that you viewed or searched for on our website;
• download errors and
• length of visits to certain pages and how you interact with those pages.

(f) The information that we collect automatically when you use our websites and/or online services is collected through cookies and similar technologies.

4.1.3 Information that we may obtain about you from third parties

(a) We collect information when we link our digital services with the services of third parties, for instance when you have given us your consent and/or where otherwise lawfully permitted and we integrate our service with social networks such as Facebook, Instagram or Twitter. Such information usually includes:

• certain general information such as the information described above (including, for instance, information that you provide to us when you register for a service, information that we collect automatically when you use our services (including, for instance, IP address and information about your device), location information that we collect when you use location based services, and other information that you provide to us or which we collect on the basis of your consent or as permitted by applicable law); and
• certain service specific information, such as information that is necessary to enable us to link your ATOM Myanmar log in credentials to the third-party service log in credentials in a non-personally identifiable manner, to enable us to integrate our digital services with the services of those third parties.

4.2 For some of our services, for example financial, music or astrology services, it may be necessary to collect additional personal information about you, and/or collect personal information in other ways and/or for purposes that are specific to that service. In such cases, our relevant Terms of Service explain the service-specific personal information processing activities. When you subscribe for one of our services, you will have the opportunity to review the Terms of Service and will be asked to indicate that you accept them.

5.1 We collect information about your location in the following circumstances:

• When you use our telecommunications services. For instance, we collect the Cell ID, which is a piece of information concerning the location of your device on our network that reveals your approximate geographical location. We need to know your approximate location so that we can deliver mobile telecommunications services to you.
• When you use our location-based services or you receive location-based offers, and you have given us your consent to process your location data for those purposes. Depending on the location-based service or offer that you use and your position within our network, we may use the Cell ID and/or location data generated by the Global Positioning System ('GPS'). GPS data reveals much more precise information about the geographical location of your device. For these purposes we may also use geo-fencing techniques to determine when your device enters a defined geographical area.

6.1 We sometimes collect personal information about you from third parties, in connection with services that we provide to you. We will do this only when you have given us your consent or when we are required or allowed to do so under applicable law.

6.2 For instance, when we integrate our digital services with third-party services. We also work closely with third parties (including, for example, business partners, sub-contractors, payment and delivery services, advertising networks, analytics providers, search information providers) and may receive information about you from them.

6.3 When you use your social media credentials to login to or otherwise interact with a ATOM Myanmar Limited webpage or offer, we may collect information about your social media profile, such as your interests, “likes” and friends list. You can control this data collection via the options made available by your social media service provider in your social media account.

6.4 We may combine the personal information that we receive from such other sources with personal information you give to us and information we automatically collect about you.

7.1 We use your personal information to provide our services to you, support and improve our services, to provide more personalised and relevant services and to send you communications about the services we provide to you.

7.2 We may also process your personal information to contact you from time to time with exciting news and offers, as further explained in the section on How we use your personal information for marketing purposes below.

7.3 We also use your personal information to:

• Manage your customer relationships with us, manage and fulfil your orders, send you invoices and purchase orders, and collect payment for our services.
• Communicate with you about the services that we provide to you, send you notices about purchases and about errors in the service, and to respond to your queries and feedback.
• Provide you with an overview of the services and the parts of a service that you have been or are currently using, tell you about changes to our service and our Terms of Service, remind you about the benefits you enjoy as part of your service and advise you about how to use our service to ensure you get the best value out of it.
• Make our services and communications more relevant to you, including by creating customer profiles, offering you personalised content and making recommendations that are relevant to you.
• Monitor and record our communications with you and use that information for training purposes, quality assurance, record details about the products and services you order from us or discuss with you your orders or the services you receive.
• Administer our services for internal operations, including troubleshooting, network management and network optimisation, so that we can provide you and our other customers with a better customer experience.
• Ensure that content from our websites is presented in the most effective manner for you and your devices so that you are able to make the most out of the services that you have subscribed to.
• Measure and understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.
• Make suggestions and recommendations to you and other users of our services about products or services that may interest you or them.
• Protect and keep our service and network secure and ensure security for you and our staff.
• To improve the safety and reliability of our services and investigate, prevent or take action regarding illegal activities and violations of our Terms of Service and/or applicable law.
• Meet our legal and regulatory obligations under applicable laws.
• To create aggregated statistics about our sales, services, customers, network traffic and location patterns, which we may provide to third parties. Such aggregated statistics do not include information that can personally identify you through the use of means that are likely reasonably to be used either by us or by any other person.
• To conduct market research and to carry out marketing campaigns, marketing activities in pursuit of our legitimate business interests.
• To research, monitor and analyse customer use of our network and services on an anonymous or personalised basis, in order to identify general trends, improve our understanding of our customers' behaviours and partner with third parties to develop new services for our customers and personalise the services we offer to you.

7.4 In many cases we aggregate and/or anonymize your personal information to an extent that it no longer identifies you. We process such aggregated and/or anonymized data for various purposes, including for research purposes and to help us understand our customers, their requirements and how they use our services so that we can improve our services to provide a better customer experience or create new services.

8.1 We use partners and service providers for a variety of business purposes such as to help us offer, provide, bill, repair, and improve our services. In such cases it may be necessary to disclose your personal information to third parties for these purposes. We will typically share your personal information with third parties when:

• It is necessary to involve a third-party partner, agent or other service provider including other telecommunications service providers, for example when you choose to roam on local or foreign networks to facilitate or extend our services so that we can provide a better service to you.
• We engage service providers or other data processors that process your personal information on our behalf and on our instructions. In such cases, we will take steps to ensure that your personal information remains protected and that the third parties with which we share it will process it in accordance with our instructions and will not use it for their own purposes.
• We share information with third parties that provide services (such as social networks) that you have chosen to link with our services, to the extent that such sharing is necessary to enable you to use these services.
• You request that we share your personal information with a third party in accordance with our privacy policy.
• You have given us your consent to share your personal information.
• We share information with third parties that conduct research, analytics, marketing, service development and advertisement on our behalf.
• We are required or allowed by law to disclose your personal information, for example in order to protect you, us or someone else from harm or damage, or we are required by a warrant, court order or other legal or regulatory requirement to disclose your personal information to law enforcement agencies, courts or other public authorities.
• If we decide to sell, buy, merge or otherwise re-organise our business, we may share your personal information with prospective or actual purchasers, sellers or partners and their advisers.

8.2 When we share your personal information, we will take steps to ensure that the recipient will protect your privacy, keep your personal information secure under our instruction and process it in accordance with applicable law. Such measures may include entering into appropriate contracts with third parties. Your personal information may be stored in our data centers, or in servers and locations outside of Myanmar.

8.3 We will not sell the personal information that we process about you to third parties without your consent.

9.1 We would like to increase the value you get from being a our customer and provide you with more relevant information about products and services. Therefore, with your permission, we and selected third parties may use your personal information to send you marketing communications, information about products and services based on your preferences, subscribe and interests. You have choice and can control how we use your personal information for marketing purposes. This means that we will obtain your consent before using your personal information for marketing purposes, when we are required by law to do this. You may at any time opt-out of receiving such marketing messages from us. Please contact our call center (dial 979 for ATOM Myanmar customers) or visit our ATOM Myanmar Limited website www.atom.com.mm for more information.

9.2 Please note that if you opt out, we will stop sending you marketing communications, but we will continue sending you communications that relate to the services we provide to you.

10.1 We collect information automatically through the use of cookies, web beacons (also called clear gifs or pixel tags), and similar technologies.

10.2 Cookies

(a) A cookie is a text file containing small amounts of information that a website can send to your browser, which may then be stored on your computer as an anonymous tag that identifies your computer but not you.

(b) Our websites use cookies to improve your user experience when you visit our websites and to collect information about your user patterns and interests so that we can display to you online ads that are relevant to your interests when you return to the website. You can set your browser to notify you before you receive a cookie, giving you the chance to decide whether to accept it. You can also set your browser to turn off cookies; however, if you do this, some of our websites may not work properly. We also use cookies and similar technologies for analytics and advertising purposes.

(c) For most types of cookies, including those we use for advertising purposes, you have the right to tell us that you do not want us to use them when you visit our websites. If you opt out of cookies that we use for advertising purposes, we will stop using cookies, but please note that this does not mean that you will not see ads when you visit our websites, it only means that the ads that you will see will not be tailored to your interests.

(d) If you want to know more about cookies, check out www.aboutcookies.org.

10.3 Pixel tags

(a) A pixel tag, also known as a clear gif or web beacon, is an invisible tag which we may place on certain pages of our website. When you access these pages, pixel tags generate a generic notice of that visit. Usually, they work in conjunction with cookies and record when a computer visits a page. If you turn off cookies the pixel tag will simply detect an anonymous website visit.

(b) A ‘smart pixel’ is a tiny graphics file containing a unique identifier that is embedded within an e-mail. We may use smart pixels in our email campaigns or newsletters. They allow us to track whether the e-mail was opened successfully and to record certain information about the activities of the recipient(s). Users who have set their e-mail client software to refuse automatic downloads of images within the e-mails they receive will not be served our smart pixel unless they actively choose to download the images within the e-mail (and many e-mail clients are set by default to refuse automatic image downloads).

11.1 We will normally not keep your personal information for longer than is necessary for the purposes for which we collect and process it, except when we are required by applicable law and our obligation under Operation License to keep it for longer than that.

12.1 Privacy officer together with business security their job is to ensure that the processing of your personal information complies with this privacy policy and applicable laws.

12.2 We will put in place appropriate technical and organisational security measures to protect your personal information from unauthorised access, collection, use, disclosure, copying, modification or disposal. Our specialist security teams review these security measures regularly.

12.3 When we use service providers or other data processors to process personal information on our behalf, we require them to follow our instructions and apply appropriate security measures to protect the personal information they process on our behalf.

13.1 For the purpose of develop and extend our telecommunication services, we may transfer your personal information to countries outside Myanmar. We may transfer customer information as permitted by applicable Laws and other regulatory framework. Every time when we export the Personal information to outside of Myanmar, we ensure that our Partner will implement appropriate measures to protect the personal information that they receive, and only process such information in accordance with our instructions.

13.2 We also take the appropriate measures and cover with contract obligation to comply with applicable laws for such data exports.

14.1 You have certain rights in relation to the personal information that we hold about you. We have in place measures and processes to enable you to exercise your rights and ensure that we can fulfil your requests concerning the personal information that we hold about you.

14.2 We have listed below a list of your privacy rights: -

(a) Right to access your information: You can request a copy of the specific personal information that we hold about you any time by contacting us at care@atom.com.mm, or access most of the information directly through your online account. Before we are able to respond to your request, we may ask you some security questions to prove your identity, conduct verification exercise and to provide further details about your request. We will respond to your request within an appropriate timeframe and, in any event, within the timescales and subject to payment of the fees prescribed by applicable laws;

(b) Right to correct personal data: You can request to correct or amend your personal information that is inaccurate by contacting us, or by accessing your online account to correct personal information relating to billing address and email address. However, it is your responsibility to ensure that you provide us true, accurate and complete information, and that you keep information on your online account up to date;

(c) It is your responsibility to provide us with accurate and complete information, and to update us when such information changes, so that we can continue to provide you with the best possible customer experience.

15.1 As a general rule, our services are not aimed at children under the age of 13, and generally we do not intentionally collect personal information about them. If we become aware that we have collected information about children under the age of 13 which we should not have been collecting, we will take steps to delete the information as soon as possible, except where we are required by law to keep it.

15.2 However, some services may be designed for use by children under the age of 13. We will let you know in these services and the applicable Terms of Service exactly how we are protecting the relevant data and will make sure each of these services complies with our guiding principles.

16.1 Our websites may contain links to third party websites, and some of our digital services provide you with access to third party services (such as social networks).

16.2 We have no control over how third-party websites and services process your personal information. We do not review third party websites and services, and we are not responsible for such third-party websites and services or their privacy practices. Please read the privacy policies of any third-party websites or services that you access from our websites or services.

17.1 This privacy policy was last updated on 1st June 2022. We may update this privacy policy from time to time, in which case we will post a prominent announcement on our website home page for 30 days. By continuing to use our services after that period you confirm your continuing acceptance of this privacy policy.

17.2 Where we think it is appropriate, and in any event where we make material changes to our privacy policy, we will also email you or text you to inform you that our privacy policy has been updated.

17.3 If we make material changes to the privacy policy and you do not wish to accept them, you will have 30 days in which you may terminate the service with no termination charges. If you do not terminate the service within 30 days, by continuing to use our services you confirm your continuing acceptance of this privacy policy. This will be explained to you in the email or text that we will send you to inform you of such material changes.

18.1 If you have a question, concern or complaint about this privacy policy or our handling of your information, please contact via www.atom.com.mm or email us at care@atom.com.mm or call to our call center (dial 979) .