Privacy Policy

If you do not wish the Company to collect the personal data described above, you may opt out at any time by submitting a written notice to the Company’s Data Protection Officer using the contact details below. However, please be aware that opting out or withdrawing consent for the collection, use, disclosure, overseas transfer and/or other processing of your data may affect your use of the Products and/or Services, for example, you may not receive offers, Products and/or Services, or benefits that are specifically tailored to your needs from the Company or its business partners.

5. Sensitive Personal Data

In offering or delivering Products and/or Services to you, the Company may need to collect, use, disclose and/or transfer overseas sensitive personal data, which may include personal data relating to religious beliefs, race/ethnicity, biometric data, disability data, health data, as applicable. The Company will collect, use, disclose and/or transfer overseas sensitive personal data only when the Company has obtained your consent and/or when necessary for compliance with applicable laws.

In the event that you are required to submit a copy of your national identification card or other official documents to the Company for identity verification or transaction purposes, please redact or conceal any sensitive data, such as religion and blood type (if applicable), prior to submitting such documents to the Company.

If you fail to redact or conceal such information, the Company reserves the right to redact or conceal such information on your behalf to protect your personal data. In such cases, it shall be deemed that the Company has not collected, used, or disclosed such sensitive personal data, and the Company has no intention to process your data regarding religion or blood type.

6. Personal Data of Minors, Quasi-Incompetent Persons, and Incompetent Persons

6.1 The Company does not intend to collect and process personal data of persons under 20 years of age without obtaining parental/guardian consent as required by law, and does not intend to collect and process personal data of quasi-incompetent persons and incompetent persons without obtaining consent from their legal guardians/curators as required by law. You represent and warrant that you have the legal right and capacity to use the Company’s Products and/or Services. Access to or use of the Products and/or Services by persons under 20 years of age, quasi-incompetent persons, or incompetent persons shall be deemed that such persons have obtained consent from their parents/guardians/curators, as applicable.

6.2 If the Company becomes aware that it has unintentionally collected and processed personal data of persons under 20 years of age, quasi-incompetent persons, or incompetent persons without the required consent, the Company will immediately delete such personal data and/or will collect and process such data only based on consent or as permitted by law. 

7. Sources of Data

7.1 Personal data provided directly by you

In general, the Company will collect or may obtain personal data from you voluntarily and directly when you access, register for, or use the Products and/or Services (e.g., completing forms, questionnaires, surveys, consenting to participate in marketing activities, advertising, promotions, or customer relationship management activities), providing information or documents to the Company for identity verification, contracting or conducting transactions with the Company, and providing information or documents while interacting with the Company (e.g., contacting the Company via customer services, telephone, email, social media, or other channels), etc.

7.2 Personal data collected automatically

When you visit and/or use the Products and/or Services via the Company’s website, the Company may use cookies or similar technologies to collect your data automatically, such as device identifiers, access logs, usage settings or behavior. Please see further details in the Cookie Policy.

In addition, if you enter the Company’s premises or areas of events, trainings, public relations events, press conferences, meetings, or exhibitions under the Company’s supervision, the Company may obtain your data (e.g., photos, videos and/or audio) from CCTV and/or event photography or video recording.

7.3 Personal data obtained from other sources

In some cases, the Company may obtain your personal data from third parties, such as:

• Data from government agencies such as the Anti-Money Laundering Office, the National Anti-Corruption Commission, the Office of the Consumer Protection Board, the Electronic Transactions Development Agency, the Royal Thai Police, the Legal Execution Department, and other agencies
• Data from payment service providers and identity verification service providers that you have provided and consented for the Company to access
• Data from your online platforms or social media (e.g., Google, LINE, Facebook) where you use SSO and consent for the Company to access such data
• Data from public sources such as government or private sector websites, online news, or other public articles

8. Purposes of Processing

8.1  Contractual performance

• The Company will collect, use, disclose and/or transfer overseas your personal data for the purposes and agreements you have entered into with the Company, including but not limited to:
• To process your requests to access or use the Products and/or Services, and to perform rights and obligations under the contract to manage, deliver and/or support your use of the Products and/or Services, including processing, storing transaction data and all matters related to the Products and/or Services or your user account, without which the Products and/or Services may be affected or you may not be able to use the Products and/or Services fairly and continuously
• To support your use of the Products and/or Services, such as transaction notifications, responding to feedback, complaints, requests and inquiries, investigating and resolving complaints, and after-sales service
• To enter into agreements or perform obligations under agreements between the Company and you or between the Company and third parties for your benefit
• To verify your identity before or during any transaction with the Company
• For accounting or financial purposes, such as payment processing, completing transactions, tax processing, billing, invoicing, collection, audit, issuance of tax invoices and transaction evidence
• For other purposes as required by law or by agreement

8.2 Legitimate interests

The Company may rely on legitimate interests to collect, use, disclose and/or transfer overseas personal data, taking into account your fundamental rights. Purposes include but are not limited to:

• To maintain, manage, develop and improve the Products and/or Services and related systems (e.g., service operations, error handling), to enhance service standards and/or ensure smooth use and maximum benefits, including research and statistical analysis to develop and improve Products and/or Services and to present suitable Products, Services and benefits to you. If you do not wish to receive offers, Products, Services and benefits, you may contact the Company using the details below
• To facilitate customer relationship management and manage the relationship between you and the Company (e.g., customer care, satisfaction surveys, complaints and dispute management, call center recording), dispute resolution, initiating proceedings, exercising rights, or defending legal claims
• To protect security, rights and assets of the Company, its employees, users and customers (e.g., CCTV recording and/or visitor entry/exit logs)
• To manage the Company’s IT systems, including IT risk management, cybersecurity prevention and response, network usage monitoring, and security analysis and audits
• To monitor, analyze and investigate violations or suspected violations of the Products and/or Services terms, fraud, corruption, misconduct, crime, or illegal activities
• To record communications and details of contacting the Company
• To record still images and/or videos of meetings, trainings, public relations events, press conferences, marketing/advertising events or exhibitions organized or conducted by the Company
• Other actions necessary for business continuity of the Company and its affiliates, such as processing data of directors, authorized persons, representatives of juristic person customers/users, or disclosing/transferring personal data to third parties in connection with acquisition, sale, transfer, merger, or similar events

8.3 Consent-based processing

In some cases, the Company may request your consent for specific collection, use, disclosure and/or overseas transfer of personal data to ensure smooth use and maximum benefits, including but not limited to:

• Marketing, public relations, advertising, promotions and customer relationship management, such as sending newsletters about promotions, updates, articles and marketing materials relating to Products and/or Services, or offers and benefits relating to products/services of business partners that you are interested in or that the Company believes you may be interested in. You can unsubscribe at any time via the unsubscribe link in the email
• Managing events, competitions, contests and lucky draws, including necessary actions such as announcing results and winners
• Research and analytics to develop Products and/or Services that best meet your needs, and to create special offers and marketing campaigns aligned with your interests
• Contacting you to offer Products, Services and benefits of the Company or its business partners that are specifically suitable to you
• When it is necessary to collect, use and/or disclose your sensitive personal data (e.g., religious data) to competent authorities under applicable laws, or to prove/verify your identity
• Other purposes you have consented to

8.4 Legal obligations

The Company may be required by law to collect, use and/or disclose your personal data to comply with Personal Data Protection Laws or other applicable laws (e.g., tax laws), or where necessary for legal proceedings or compliance with court orders, government agencies, regulators, or competent officials. The Company may also use, disclose and/or transfer overseas your personal data on other legal bases, such as for historical records or archives in the public interest, research or statistics, prevention or suppression of danger to life, body or health, or performance of tasks carried out in the public interest.

9.  Cookies and Similar Technologies

When you visit or use the Products and/or Services on the Company’s website, the Company will automatically collect and record your website usage logs by using cookies and similar technologies to analyze website operations and technical issues, to support website functionality and deliver a good user experience, and to track your website usage. This stored information will be used to develop and improve the website to better meet your needs. Disabling cookies and similar technologies may cause certain website features to not function properly. Please see further details in the Cookie Policy.

10. Newsletter Subscription

You may subscribe, free of charge, to newsletters about updates relating to the Company’s Products and/or Services and other related information, or products and/or services of the Company’s business partners that you have shown interest in or that the Company believes you may be interested in. You may unsubscribe at any time via the unsubscribe link in the email sent by the Company.

11. Push Notifications

The Company may send push notifications to your mobile device to provide updates relating to the Company’s Products and/or Services and other related information, or products and/or services of the Company’s business partners that you have shown interest in or that the Company believes you may be interested in. You may disable notifications or targeted advertising notifications by adjusting the notification settings on your device.

12. Disclosure of Personal Data

In general, the Company will not disclose or transfer your personal data to external persons or entities unless the Company has obtained your consent or is required to do so under applicable laws. However, for business operations and under the purposes set out in this Policy, the Company may need to disclose or share certain personal data, to the extent necessary, with the following third parties (who may be located in Thailand or abroad):

12.1 Business partners (e.g., marketing partners or partners conducting joint research or promotions) where you consent for the Company and/or such partners to contact you with offers, promotions, or benefits relating to products/services you are interested in, or where you consent to participate in marketing activities, promotions, receive news and/or marketing materials from the Company or relevant partners

12.2 Partner banks and other financial institutions where disclosure is required by law to verify financial transactions or trace funds in cases of financial crime, suspicious funds, or where you consent for disclosure to complete a transaction

12.3 Contractors, agents and service providers of the Company (including but not limited to payment providers, analytics providers, cloud storage providers and/or data centers, marketing and advertising providers, media/public relations providers, email and messaging providers, social media service providers, event organizers, CRM providers, and security/IT development and maintenance providers) where necessary to support the Company’s business and to provide and respond to your use of the Products and/or Services. The Company will enter into data processing agreements as required by law

12.4 Affiliates of the Company where necessary for processing under the purposes specified in this Privacy Policy only

12.5 Other relevant persons in case of acquisition, sale, transfer, merger, corporate restructuring or similar events where the Company needs to share data to complete such transaction or restructuring

12.6 Government authorities, regulators and other third parties as required by law, including where the Company is legally obligated or where legal process compels disclosure to courts, the Legal Execution Department, officials, regulators, as well as legal advisors, lawful representatives of the Company, or others where the Company believes disclosure is necessary to comply with law, protect the Company’s rights, third-party rights, or individuals’ safety

13. Overseas Transfer

The Company may send or transfer your personal data for storage and/or processing outside Thailand as described in this Privacy Policy. The Company will ensure that the destination country or recipient has an adequate level of personal data protection standards and policies and that the transfer complies with applicable Personal Data Protection Laws.

14. Data Security

The Company implements internal security measures and selects personal data storage systems with appropriate mechanisms and techniques, with security measures in accordance with Personal Data Protection Laws and other applicable laws, including restricting access to your personal data by the Company’s employees, staff and representatives to prevent unauthorized use, disclosure, destruction, or access.

15. Data Retention Period

The Company will retain your personal data for the following periods: