Privacy Policy
NetDesign Host Co., Ltd. and GMO-Z com NetDesign Holding Co., Ltd. (the “Company”) firmly commit to conducting business ethically and respecting your privacy rights. The Company therefore prioritizes the protection and security of personal data to ensure that the personal data we receive from you is used correctly according to its objectives and strictly in compliance with the law. The Company has established this Privacy Notice (the “Notice”) to inform you, as the data subject, of the objectives and details regarding the collection, use, and/or disclosure of personal data, as well as your legal rights.
1. To whom does this Notice apply and what are the channels for collecting personal data?
1.1 To whom does this Notice apply?
This Notice applies to you if you fall into one or more of the following categories:
| Categories of individuals covered by this Notice | Details and examples |
|---|---|
| Individual Customers ("Customers") | Individual customers of the Company, such as: ○ Persons who use or have used products and/or services ○ Persons making inquiries about products and/or services ○ Persons receiving information about products and/or services through various channels ○ Persons who have been offered or invited by the Company to use or receive products and/or services |
| Individuals related to corporate customers of the Company or legal entities conducting transactions with the Company ("Partner Personnel") | Individuals related to corporate customers of the Company or legal entities conducting transactions with the Company, such as: ○ Shareholders ○ Directors ○ Authorized representatives ○ Agent partners ○ Employees, officers, and/or assignees |
| Individuals related to the transactions of the Company or the Company's customers ("Contacts") | Individuals related to the transactions of the Company or the Company's customers, such as: ○ Contacts ○ Employees, staff, officers, personnel ○ Family members, friends, neighbors ○ Persons recommended or referred to by the Company's customers ○ Investors, guarantors, collateral providers, ultimate beneficial owners ○ Persons who have made payments to or received money from the Company's customers ○ Any other persons whose personal data the Company may receive from customer transactions ○ Persons who have visited the Company's website, application, or social media accounts, or used services at the Company's office ○ Professional advisors ○ Other similar individuals |
| General Public ("General Public") | General individuals, such as persons with whom the Company has relationships, interactions, or contacts through other means, or who provide personal data to the Company, or whose personal data the Company receives directly or indirectly through any channel. |
| Job applicants, employees, staff, former employees, former staff, references, emergency contacts, and related persons ("Employees") | ○ Individuals who have applied for a job with the Company ○ Individuals who have been hired as employees or staff to work for the Company ○ Individuals who were formerly employees or staff of the Company in the past ○ Individuals whose information was provided to the Company by job applicants as references ○ Individuals whose personal data was provided by employees or staff as emergency contacts, including persons related to employees |
1.2 Channels for collecting personal data
The Company may collect your personal data through the following channels:
(1) Personal data that you provide directly to the Company, provide through the Company, or that already exists with the Company, arising from the use of products and/or services, contacting, visiting, participating in activities, searching, through service channels and/or various communication channels of the Company, such as offices, websites, applications, social media accounts, telephone, fax, mail, short message service (SMS), questionnaires, business cards, meetings, training, seminars, events, recreation, marketing promotional activities, meet-and-greets, job applications, employment contracting, during employment, or any other channels.
(2) Personal data that the Company receives or accesses from other sources, such as government agencies, other service provider companies, business partners and their service providers, companies that jointly issue products and/or services with the Company, information service providers, the Company's customers, individuals or legal entities conducting transactions with the Company (in your capacity as an individual related to such transactions as mentioned above), registrars, social media, third-party online platforms, public data sources (e.g., Royal Gazette), individuals with legal authority or rights, and any other persons or entities with whom the Company has legal relations.
2. What personal data does the Company collect, use, and/or disclose?
2.1 Personal data means data that can identify you, directly or indirectly, as follows:
2.1.1 Individuals, meaning Individual Customers, individuals related to the transactions of the Company or its customers, and the General Public.
| Data Category | Examples of data the Company collects, uses, and/or discloses |
|---|---|
| Personal details | ○ Title, first name, middle name, last name, alias (if any) ○ Gender, date of birth, age ○ Nationality, country of residence ○ Signature ○ Information on documents issued by government agencies (e.g., copy of ID card, copy of passport, copy of visa, copy of alien certificate, copy of work permit, copy of government/state enterprise employee ID, copy of house registration, copy of birth certificate, copy of name change certificate, copy of marriage certificate, copy of divorce certificate, copy of death certificate, copy of driver's license, or similar identity verification documents), etc. |
| Contact details | ○ Address as per legal documents, current residential address, address in home country, workplace ○ Telephone number, mobile phone number, fax number, email ○ Username or account name for electronic communication or various social media (e.g., LINE ID) ○ Proof of residence in Thailand (for foreigners) |
| Business ownership details | Shareholding proportion and/or information on any other documents to confirm business operations |
| Financial and transactional details | ○ Deposit account number ○ Credit/debit card number ○ Tax Identification Number ○ Information on applying for channels, products, and/or services ○ Transaction history, transaction details and objectives, information in transaction memos, transaction reference numbers, transaction channels ○ System username and password accounts ○ Other information accompanying the use of products and/or services (e.g., customer code, customer identification number, top-up credit limit, product orders) |
| Technical, device, or tool details | ○ Application usage data ○ IP Address ○ Cookies ○ Web Beacons, Pixel Tags, or Software Development Kits (SDKs), Device IDs ○ Device model and type, network, connection data ○ Access data, single sign-on (SSO) login data ○ Logs ○ Log-in data, access duration, usage and usage duration of the application and website, search history, browsing data ○ Time zone and Location Data ○ Browser plug-in types and versions, operating systems and platforms, including other technologies on the devices you use to access the platform ○ Other technical data from usage on the platform and operating systems |
| Other details | ○ Records of communication or interaction between you and the Company, details of complaints or feedback ○ Requests to exercise various rights ○ Opinion survey results ○ Voice recordings, photographs, motion pictures, audio clips, communication records via Log/Chat-Bot ○ Still images or motion pictures from Closed-Circuit Television (CCTV) cameras ○ Information on court orders / Royal Gazette related to the transactions of the Company's customers or the Company's legal compliance (e.g., receivership orders, orders appointing estate administrators, orders declaring incompetence or quasi-incompetence, subpoenas for documents or objects) ○ Any other data considered personal data under personal data protection laws ○ Registration data for participating in the Company's activities |
2.1.2 Corporate personnel, meaning individuals related to corporate customers of the Company or legal entities conducting transactions with the Company.
| Data Category | Examples of data the Company collects, uses, and/or discloses |
|---|---|
| Personal details | ○ Title, first name, middle name, last name, alias (if any) ○ Gender, date of birth, age ○ Marital status ○ Signature ○ Information on documents issued by government agencies (e.g., copy of ID card, copy of passport, copy of visa, copy of alien certificate, copy of work permit, copy of house registration, or similar identity verification documents), other KYC and CDD data, etc. |
| Contact details | ○ Address as per legal documents, current residential address, and address in home country, workplace ○ Telephone number, mobile phone number, fax number, email |
| Employment details | ○ Occupation and professional field ○ Job title ○ Job details, business type |
| Information appearing in transaction supporting documents | ○ Company certificate ○ List of shareholders ○ Power of Attorney ○ Commercial registration certificate |
| Other details | ○ Data collected, used, and/or disclosed in connection with the relationship with the Company, such as information provided by the legal entity to the Company in a contract ○ Details of complaints or feedback ○ Opinion survey results ○ Registration data for participating in the Company's activities ○ Records of communication or interaction between you and the Company ○ Requests to exercise various rights ○ Voice recordings, photographs, motion pictures, audio clips, communication records via Log/Chat-Bot ○ Still images or motion pictures from Closed-Circuit Television (CCTV) cameras ○ Information on court orders / Royal Gazette related to the transactions of the Company's customers or the Company's legal compliance (e.g., receivership orders, orders appointing estate administrators, orders declaring incompetence or quasi-incompetence, subpoenas for documents or objects) ○ Any other data considered personal data under personal data protection laws |
2.1.3 Job applicants, employees, staff, former employees, former staff, references, emergency contacts, and related persons, meaning individuals who have applied for jobs with the Company, individuals hired by the Company as employees or staff to perform work for the Company, as well as former employees, former staff, individuals whose information was previously provided to the Company by job applicants as references, and including individuals whose information was provided by employees or staff as emergency contacts, including persons related to employees.
| Data Category | Examples of data the Company collects, uses, and/or discloses |
|---|---|
| Name, initials, and identity characteristics | Information that identifies you, is used to address you, or is used to refer to you, such as title, first name / initials of first name, middle name / initials of middle name, last name, maiden name, alias or previously used name, and signature, age, date of birth, gender, height, weight, marital status, nationality, military conscription details, hobbies and interests, photographs, language proficiency, and number of children. |
| Government-issued identification data | Numbers or codes issued by responsible agencies for you to verify your identity, such as national identification number, other ID numbers issued by government agencies, driver's license number, work permit number, passport number, and alien registration number. |
| Contact details | Contact details such as home address, shipping address, home phone number, home fax number, personal email, internet number, mobile phone, or personal wireless network, profile or username (Handle) on social media, workplace address, work phone number, work email, and internet number, mobile phone, or workplace wireless network. |
| Educational and employment data | Your educational and work information, such as educational qualifications and enrollment, licenses, professional organization membership status, and academic records, occupation / rank, position, department, employer registration number, job code, details regarding work visa status / employment approval, drug test results, reference information and history, Tax Identification Number, insurance claims, workers' compensation, employment records (and salary information, attendance, and various benefits), start date, termination of employment, assets owned by the employee, and various evaluations (performance evaluations and possibilities), including the use of various technologies - technology usage evaluations (e.g., internet and email, etc.). |
| Communication device data | Information about devices and device usage, including technical device data, such as geolocation data, telecommunication tower data, audio / video / photo / camera access data, calendar data, call logs, address book / text or email contact addresses (content of texts or emails), Unique Device Identifier (UDID), computer serial numbers, click behavior / online website tracking data, clearly unstructured data (text, audio, images, videos, etc.), provision of information using radio frequency identification (RFID), login authentication data, security codes, access codes, or any required passwords, user account names, account access passwords, Telemetry license numbers or details describing the background of master data (Metadata), information about end-user activities, such as website visits (even if the Company does not know the user's identity), and files created by visited websites (cookies) or other similar technologies. |
| Other data | Records of communication or interaction between you and the Company, details of complaints or feedback, requests to exercise rights, opinion survey results, voice recordings, photographs, motion pictures, audio clips, communication records via Log / Chat-Bot, still images or motion pictures from Closed-Circuit Television (CCTV) cameras, information on court orders / Royal Gazette related to customer transactions or the Company's legal compliance (e.g., receivership orders, orders appointing estate administrators, orders declaring incompetence or quasi-incompetence, subpoenas for documents or objects), and any other data considered personal data under personal data protection laws, registration data for participating in the Company's activities. |
| Views and opinions | Information about your views and opinions, such as your preferences regarding the employment contract / working relationship or other information you choose to submit to the Company, opinions, feedback, complaints, suggestions, survey responses, questions, and information you voluntarily provide during human resources discussions. |
If you do not provide your personal data to the Company, the Company may not be able to offer you a job position as requested, and may not be able to perform all of its obligations to you under the employment contract/working relationship, or may be unable to fulfill the responsibilities the Company is legally required to perform.
Third-party data for use in referencing, certification, any employment-related actions, and contacting. If you provide third-party personal data to the Company, such as spouse data, family member data, child data, or if you request the Company to disclose that person's personal data to external parties, you must inform that person of the details under this Notice and seek their permission and consent (in cases where consent is required). In addition, you must ensure that the Company can collect, use, and/or disclose such personal data lawfully, as announced in this Notice.
2.2. Sensitive Personal Data
Sensitive personal data means personal data specifically prescribed by law. The Company has no intention to collect sensitive personal data from you, unless you are a job applicant, employee, staff, former employee, or former staff of the Company. The Company will collect, use, and/or disclose this sensitive personal data only when explicit consent is obtained from you through appropriate means, in order to perform the employment contract, establish legal claims, defend against, comply with or exercise legal claims, perform duties for substantial public interest under the law, or other matters stipulated by law.
| Category of Sensitive Personal Data | Objectives |
|---|---|
| Criminal records | To collect and use your criminal history to consider during employee recruitment, background screening / verification, and / or investigation. |
| Health data | The Company may collect and use your health data for hiring consideration, contract execution, leave record management, payroll, and various benefits. Your health data collected by the Company may include blood type, medical record numbers, health plan beneficiary numbers, communication device identification and medical treatment sequence numbers, diagnosis, medical treatment history, medical payment data, medical compensation claim usage data, medical photographs, and details describing the background of master data (Metadata), Rx numbers / prescriptions, health insurer ID or account numbers, drugs, therapies, or medical products or devices used, physical health data, mental health data, genetic test results or data, family health history, or illness history, and annual physical examination results. |
| Race data | The Company may collect data about your race for use in contracts. |
| Religion data | The Company may collect data about your religion for use in contracts, managing evidence, and leave records. |
| Biometric data | The Company may collect and use physical data (e.g., fingerprints and/or facial recognition) to verify identity and authorize office access. |
(Hereinafter in this Notice, unless specifically stated otherwise, the aforementioned personal data and sensitive personal data shall collectively be referred to as “Personal Data”.)
2.3. Personal Data of Minors, Incompetent Persons, or Quasi-incompetent Persons
The Company has no intention to collect, use, and/or disclose the personal data of minors, incompetent persons, or quasi-incompetent persons, unless the Company obtains consent from the holder of parental responsibility, curator, guardian, or through any actions for which the minor may give consent independently under the law (as the case may step), and/or operates under other legal bases. If the Company discovers that it has collected, used, and/or disclosed the personal data of minors, incompetent persons, or quasi-incompetent persons without the consent of the holder of parental responsibility, curator, guardian, or a minor who may give consent independently under the law (as the case may be), and cannot rely on any other legal basis, the Company will proceed to delete or destroy that personal data.
2.4. Personal Data of Any Other Third Parties
If you are the provider of personal data of any other third parties who are corporate personnel and/or related to you to the Company, such as shareholders, directors, authorized representatives, family members, references, trading partners, beneficiaries, estate administrators, emergency contacts, and/or any other individuals according to your transaction documents, please inform those individuals about the details in this Notice and request their consent if necessary, or establish another legal basis to ensure the Company can collect, use, and/or disclose the personal data of these third parties.
3. For what purposes does the Company collect, use, and/or disclose your personal data?
The Company will collect, use, and/or disclose your personal data only as necessary under the Company's lawful purposes, which includes collecting, using, and/or disclosing personal data for the performance of a contract to which you are a party, for compliance with legal obligations, for legitimate interests, to proceed in accordance with your consent, and/or to operate under other legal bases. The purposes for collecting, using, and/or disclosing personal data under this Notice are as follows.
Note that some of the following purposes may apply to you, and some may not. Please consider the nature of the purposes according to the relationship between you and the Company on a case-by-case basis.
3.1 Purposes relying on consent
The Company will collect, use, and/or disclose your personal data based on your consent. For employees, the Company will collect, use, and/or disclose sensitive personal data for which the Company cannot rely on other legal bases apart from requesting explicit consent from the employee. Such purposes include:
3.1.1 Religion and race data (Such data is obtained from collecting a copy of the ID card or a copy of the passport of certain countries, which the Company only needs to use as evidence for identity proofing and verification).
3.1.2 Biometric data strictly for signing, identity proofing and verification, employee time attendance, and for the Company's door access control only.
3.1.3 Health history, disability data, and criminal records, which the Company will collect, use, and/or disclose only when necessary to facilitate employees and for considering absences, and for criminal records, strictly for conducting criminal background checks on employees when necessary to use as supporting information for performing duties.
3.2 Purposes relying on other legal bases apart from consent
The Company will collect, use, and/or disclose your personal data based on other legal bases as necessary under the Company's lawful purposes, such as for the performance of a contract to which you are a party or as requested by you, to comply with legal obligations, for legitimate interests, and/or to operate under other legal bases for the following purposes:
3.2.1 Actions prior to entering into a contract with the Company, such as providing consultation, advice, and/or any other information related to products and/or services, analyzing and assessing customer needs, qualification checks, due diligence of corporate customers, verifying the accuracy of information or documents, identity proofing and verification, checking against the Sanction Lists of state law enforcement agencies and/or official agencies publicly disclosed as required by law, checking for receivership or bankruptcy status, and pre-filling personal data/contact data of customers to facilitate the application for the Company's products and/or services.
3.2.2 Any actions related to the consideration of providing various products and/or services, such as communication, sending and receiving documents or parcels, processing requests and proceeding according to the request approval process, entering into contracts, agreements, and/or any other related juristic acts, registering to use products, services, and/or to participate in various Company activities.
3.2.3 Delivery of various products and/or services according to the contract you have made with the Company, such as:
3.2.3.1 Any actions related to the provision of products and/or services (e.g., opening an account, changing data, setting, using, changing credit limits, or adjusting accounts, paying dividends and interest, refunding principal, receiving payments, freezing accounts, freezing cards, checking account balances, generating transaction reports, reconciliation, preparing customer document data to support customer transactions such as document certification).
3.2.3.2 Providing privileges and executing actions in accordance with customer privileges.
3.2.3.3 Customer relationship management, after-sales transaction execution, customer facilitation, and/or managing complimentary gifts for customers.
3.2.3.4 Providing advice or risk management guidelines.
3.2.3.5 Handling complaints, resolving problems, and proceeding according to customer requests.
3.2.3.6 Receiving payments or any assets.
3.2.3.7 Monitoring compliance with conditions for using products and/or services, and service cancellation.
3.2.4 Marketing operations that do not require your legal consent, such as:
3.2.4.1 Considering customer target groups for sending invitations to participate in activities or sales promotions as appropriate.
3.2.4.2 Delivering product and/or service offers, special privileges to participate in activities, events, or meetings organized by the Company, including facilitating event participation (e.g., event registration).
3.2.4.3 Offering products, services, and/or special privileges requested by you, or notifying you of your benefits.
3.2.4.4 Offering the same/similar types of products and/or services as those you already have with the Company or other companies within the Company's financial business group.
3.2.4.5 Contacting you in the event that you have unsuccessfully applied for products and/or services (drop-off) to facilitate you if you wish to apply for the same type of products and/or services with the Company again, or offering other products and/or services that may be of interest to you.
3.2.4.6 Organizing sales promotional activities (e.g., offering benefits and prizes).
3.2.5 Analysis, research, and/or preparation of statistical data that do not require your legal consent, to be used in the development and improvement of products and/or services internally within the Company itself, such as analysis, research, market research, statistical data preparation, and report preparation for internal Company use.
3.2.6 Other operations of the Company, such as:
3.2.6.1 Administration, risk management, and internal auditing within the Company.
3.2.6.2 Protecting legitimate interests.
3.2.6.3 Creating customer databases or recording data into systems or databases.
3.2.6.4 Reviewing customer credit quality.
3.2.6.5 Sending debt payment reminders or renewing various products and/or services.
3.2.6.6 Debt collection tracking.
3.2.6.7 Surveying and evaluating satisfaction after using products and/or services.
3.2.6.8 Conducting litigation or related legal proceedings.
3.2.6.9 Collaborating, coordinating, and/or assigning tasks to others to act on behalf of or jointly with the Company (e.g., for designing products or services, designing customer service experiences, designing processes, or supporting the delivery of products and/or services).
3.2.6.10 Transfer of rights and/or duties, business administration of the Company, and other companies within the Company's financial business group.
3.2.6.11 Using Closed-Circuit Television (CCTV) cameras to control entry and exit at the Company's premises.
3.2.6.12 Handling complaints or managing incidents of legal offenses or suspicious events (such as fraud, money laundering, terrorism and proliferation of weapons of mass destruction, committing crimes, intellectual property violations, which includes management planning, investigation, surveillance, evidence gathering, reporting, and/or detection operations).
3.2.6.13 Creating business risk databases for the Company.
3.2.6.14 Information technology operations, communication system management, and preventing, handling, and mitigating information technology risks and cyber threats.
3.2.7 Complying with the orders of legally authorized persons and/or complying with laws, such as complying with court orders, orders of government agencies, regulatory authorities governing the Company, state officials with authority under personal data protection laws, financial institution business laws, securities and exchange laws, life insurance laws, non-life insurance laws, the Office of Insurance Commission laws, payment systems laws, exchange control laws, deposit protection agency laws, taxation laws, anti-money laundering laws, laws on the prevention and suppression of terrorism financing and the proliferation of weapons of mass destruction, computer crime laws, bankruptcy laws, and other laws that the Company is obligated to comply with both in Thailand and abroad, including announcements and regulations issued under such laws, whether currently in force, to be amended, or to be enacted in the future.
3.2.8 Preventing or suppressing a danger to a person's life, body, or health.
3.2.9 Compiling historical documents or archives for public interest, or relating to research or statistics.
3.2.10 Carrying out the Company's public interest missions or performing duties in the exercise of state power assigned to the Company.
Note that if the Company needs to collect, use, and/or disclose your personal data for entering into or performing a contract you have made with the Company, and/or for the Company's legal compliance duties, and you do not provide that necessary personal data to the Company upon request, or if you choose to delete your user account from the Company's service application, the Company may not be able to consider approving or delivering/providing some or all products and/or services to you. This may also affect the Company's legal compliance duties or the relationship between you and the Company.
4. To whom may the Company disclose your personal data?
The Company may disclose your personal data to others under your consent or under the criteria permitted by law for disclosure. The individuals or entities receiving such personal data will collect, use, and/or disclose your personal data according to the scope to which you have given consent or the relevant scope in this Notice. In some cases, you may also be subject to the personal data protection notices of those recipients of your personal data. The recipients of your personal data may be located in Thailand or abroad. The Company may disclose your personal data to various individuals or entities depending on your relationship and transactions, as follows:
| Categories of Personal Data Recipients | Details |
|---|---|
| The Company's Service Providers | The Company may use other companies, partners, agents of the Company, subcontractors, or external service providers to conduct business on the Company's behalf or to help support the provision of the Company's products and/or services to you. For this reason, the Company may disclose your personal data to the Company's service providers. ○ National Digital ID (NDID) service providers ○ Payment infrastructure systems and international money transfer service providers (National Interbank Transaction Management and Exchange: NITMX) ○ Digital infrastructure system providers and database system providers for data exchange among financial institutions ○ Telephone network and SMS delivery service providers ○ Information technology, technology support, and technology security service providers ○ Cloud Computing service providers ○ Marketing service providers ○ Document archiving service providers ○ Social media service providers ○ Payment channel service providers ○ Debt collection service providers ○ Printing houses or printing service providers ○ Document or parcel delivery service providers ○ Concierge Services providers |
| The Company's Business Partners | The Company may disclose your personal data to the Company's business partners, including those collaborating to provide products and/or services. In the event of disclosing your personal data to business partners for the business partners' marketing purposes, such as for sales promotions, public relations, or offering products and/or services from business partners to you, the Company will notify you of the list of business partners for your consideration in granting consent. In this regard, business partners can rely on the consent obtained by the Company. |
| Persons prescribed by law | In some cases, the Company is required to disclose your personal data to comply with the orders of legally authorized persons and/or to comply with the law, where the recipients of your personal data include: ○ Law enforcement agencies ○ Regulatory authorities governing the Company, such as the Bank of Thailand, Anti-Money Laundering Office, Revenue Department, Department of Provincial Administration, Courts, Police Officers, Legal Execution Department, Department of Lands, Department of Land Transport, Personal Data Protection Committee Office, Office of the Consumer Protection Board, etc. ○ Government agencies ○ Associations, agencies, or any other persons as necessary to comply with legal obligations or regulatory duties, or to protect the rights of the Company or the rights of third parties, which may include instituting any related legal proceedings. |
| Advisors / Experts | For the benefit of the Company's business operations, the Company may disclose your personal data to: ○ Auditors ○ External inspectors ○ Legal advisors ○ Tax advisors ○ Credit rating agencies ○ Other advisors or experts as the case may be |
| Interested transferees and/or assignees in transactions or mergers of the Company | In the event that the Company undergoes organizational restructuring, debt restructuring, mergers and acquisitions, business acquisitions, assignment of rights, liquidation, or any other similar events, the Company may need to disclose your personal data to trading partners, interested parties, asset management companies, and/or such assignees. |
| Any other third parties | The Company may disclose your personal data to any other third parties to fulfill the purposes specified in this Notice. Other third parties receiving your personal data may include but are not limited to: ○ Individuals with whom you share a contract or transactional relationship (e.g., references, beneficiaries, or embassies for document certification) ○ Infrastructure technology and/or system developers for the Company ○ Central organizations for international money transfers to the Company (SWIFT) ○ Members of the National Digital ID (NDID) service providers ○ Card network service providers (e.g., VISA, Mastercard, JCB, UPI) ○ Universities or educational institutions ○ Social media service providers ○ The general public |
5. Does the Company send or transfer your personal data abroad?
The Company may need to send or transfer your personal data to other companies within the Company's business group located abroad, or to other data recipients as part of the Company's normal business operations, such as sending or transferring personal data to be stored on cloud platforms or servers located overseas, business partners collaborating to provide products and/or services, and business partners co-issuing products (co-branding), social media service providers, foreign government agencies, and/or individuals related to your transactions abroad, etc.
In the event that the destination country has inadequate personal data protection standards, the Company will ensure that the sending or transferring of personal data complies with legal requirements and will implement necessary and appropriate personal data protection measures in accordance with confidentiality standards, such as establishing agreements with data recipients in those countries to confirm that your personal data will be protected under standards equivalent to those in Thailand.
6. The Use of Cookies and/or Similar Technologies
The Company may collect and use cookies and/or any other similar technologies when you use the Company's websites and/or applications, including when conducting transactions and using the Company's products and/or services via digital channels and the internet. The collection of cookies and/or the use of any other similar technologies helps the Company remember your usage and preferences, as well as analyze your interests to improve and develop the performance of the Company's websites and/or applications to respond to your needs and usage, ensuring you receive a good experience from using the Company's websites and/or applications.
Additionally, the Company may disclose your non-identifiable data to data analysis service providers, such as Google, both domestically and internationally. Google will use technologies and tools to help analyze data, such as cookies and/or Software Development Kits (SDKs), to track and generate analytical reports related to your usage activities on the Company's websites and/or applications. You can study the details of Google's data analysis under the topic “How Google uses data when you use our partner's sites or apps” at www.google.com/policies/privacy/partners or any other URL designated by Google.
7. How long does the Company retain your personal data?
The Company will retain your personal data for as long as you remain a customer or maintain a relationship with the Company, or for the period necessary to achieve the related purposes outlined in this Notice. When your relationship with the Company ends, the Company will continue to retain your personal data thereafter for the period necessary according to the statute of limitations, or the period prescribed or permitted by law, such as:
7.1 Retained under anti-money laundering laws for 5-10 years from the end of the relationship, as the case may be.
7.2 Retained under financial institution business laws, securities and exchange laws, accounting laws, and taxation laws for 10 years from the end of the relationship.
The Company will take appropriate steps to delete or destroy personal data or anonymize it so that it cannot identify you when it is no longer necessary or when the aforementioned period expires.
8. How does the Company protect your personal data?
The Company will securely maintain your personal data using Technical Safeguards, Administrative Safeguards, and Physical Safeguards to preserve the confidentiality, integrity, and availability of personal data, and to prevent unauthorized or unlawful access, collection, alteration, modification, use, and/or disclosure of personal data, strictly in accordance with applicable laws.
The Company has implemented appropriate measures to prevent personal data breaches. The Company has established notices, regulations, and criteria for personal data protection, such as measures to control access to personal data and the use of secure and appropriate devices for storing and processing personal data, restricting access to personal data, defining personal data access rights for users, granting permission to assigned employees to access data, and outlining user responsibilities to prevent unauthorized access, disclosure, knowledge, or illicit copying of personal data, or theft of storage or processing devices. The Company also enforces measures for tracing access, modification, deletion, or transfer of personal data in a manner appropriate to the methods and tools used for collecting, using, or disclosing personal data, including audits to evaluate the effectiveness of compliance with the personal data protection notices, regulations, and criteria.
Furthermore, executives, employees, staff, contractors, agents, advisors, and data recipients from the Company have an obligation to maintain the confidentiality of personal data in accordance with the personal data protection policies established by the Company.
9. What are your rights regarding your personal data?
Your rights in this section are legal rights that you should be aware of. You can request to exercise various rights under the provisions of the law and the notices set forth currently or to be amended in the future, as well as the criteria established by the Company. If you are under 20 years of age or have limited capacity to perform juristic acts under the law, you can request to exercise your rights by having your father and/or mother, the holder of parental responsibility, or a legally authorized representative state your intent on your behalf.
9.1 Right to Withdraw Consent: If you have given consent to the Company to collect, use, and/or disclose your personal data (whether the consent was given before the personal data protection law came into effect or thereafter), you have the right to withdraw your consent at any time while your personal data is with the Company, unless there is a restriction on such right by law or an existing contract that benefits you. Withdrawing your consent will not affect the collection, use, and/or disclosure of your personal data that was completed prior to the withdrawal of consent.
However, your withdrawal of consent regarding information necessary for receiving services may result in the Company being unable to fulfill a contract or provide services to you, or it may cause related transactions or other activities to be suspended or temporarily halted, or it may affect your ability to receive information about various products and/or services. For example, you may not receive product and/or service offers, benefits, promotions, or new proposals; you may not receive products and/or services more tailored to your preferences or corresponding to your needs; or you may miss out on news and useful advice. For your benefit, it is advisable to study and inquire about the impacts before withdrawing consent.
9.2 Right to Access Data: You have the right to request access to your personal data under the Company's responsibility and request the Company to provide a copy of such personal data to you, including requesting the Company to disclose how the Company obtained your personal data.
The Company will provide the first copy of such personal data free of charge. For subsequent copies beyond the first, the Company may charge appropriate service or processing fees, which will be notified to you prior to making the copies.
9.3 Right to Data Portability: You have the right to receive your personal data if the Company has prepared such personal data in a format readable or commonly used by automated tools or devices, allowing the personal data to be used or disclosed automatically. You also have the right to request the Company to send or transfer your personal data in such format to another personal data controller when possible by automated means, and you have the right to directly receive the personal data that the Company sends or transfers in such format to another personal data controller, unless it is technically unfeasible.
The aforementioned personal data must be personal data for which you have given consent to the Company to collect, use, and/or disclose, or personal data that the Company necessarily collects, uses, and/or discloses to enable you to use the Company's products and/or services according to your desires as a contracting party with the Company, or for processing your requests before using the Company's products and/or services, or other personal data as prescribed by legal authorities.
9.4 Right to Object: You have the right to object to the collection, use, and/or disclosure of your personal data at any time if the collection, use, and/or disclosure of your personal data is conducted as necessary under the legitimate interests of the Company or of other individuals or legal entities, or for carrying out tasks in the public interest. If you submit an objection, the Company will continue to collect, use, and/or disclose your personal data only if the Company can demonstrate legal grounds that are more compelling, or if it is for the establishment, compliance, exercise, or defense of legal claims, as the case may be.
Additionally, you also have the right to object to the collection, use, and/or disclosure of your personal data conducted for direct marketing purposes, or for scientific, historical, or statistical research purposes.
9.5 Right to Erasure or Destruction of Data: You have the right to request the deletion or destruction of your personal data, or to anonymize the personal data so that it cannot identify you, if you believe that your personal data has been unlawfully collected, used, and/or disclosed according to relevant laws, or if you consider that the Company no longer needs to retain it for the related purposes in this Notice, or after you have exercised your right to withdraw consent or your right to object as stated above.
9.6 Right to Restrict Data Processing: You have the right to request a temporary suspension of the use of personal data in cases where the Company is investigating your request to correct personal data or your objection request, or in any other cases where the Company no longer requires and must delete or destroy your personal data under relevant laws, but you request the Company to suspend its use instead.
9.7 Right to Rectification: You have the right to request the correction of your personal data to ensure it is accurate, up-to-date, complete, and not misleading.
9.8 Right to Lodge a Complaint: You have the right to file a complaint with relevant legal authorities if you believe that the collection, use, and/or disclosure of your personal data violates or fails to comply with relevant laws.
The exercise of your aforementioned rights may be restricted under applicable laws, and there are certain cases where necessary reasons may compel the Company to refuse or be unable to comply with your request, such as required compliance with the law or court orders, public interest reasons, or if exercising the right may violate the rights or freedoms of others. If the Company refuses your request, the Company will notify you of the reasons for the refusal.
You can submit requests to exercise your various rights through the following channels:
| Rights | Processing Time (Counting from the date you submitted the request and complete supporting documents) |
|---|---|
| Right to Withdraw Consent | Within 7 business days |
| Right to Access Data | Within 30 days |
| Right to Data Portability | |
| Right to Object | |
| Right to Erasure or Destruction of Data | |
| Right to Restrict Data Processing | |
| Right to Rectification | Within 7 business days |
10. Personal Data Collected by the Company Before the Personal Data Protection Act Came into Effect
The Company will continue to collect and use your personal data that was in the Company's possession prior to the effective date of the Personal Data Protection Act, for the original purposes without requiring your consent again. This includes your right to request access to such personal data and exercise legal rights similarly to personal data collected after the Personal Data Protection Act took effect. However, if the Company intends to disclose or conduct any other actions beyond the original collection and usage purposes, the Company will proceed with your personal data according to the provisions set forth by the personal data protection laws.
11. Will the Company Amend or Update the Privacy Notice?
The Company may consider reviewing to amend, update, or change this Notice from time to time as deemed appropriate and to the extent permitted by law. In the event of an amendment, update, or change to this Notice, the Company will announce the current version of the Notice for your information on the Company's website.
12. How Can You Contact the Company and the Data Protection Officer?
If you have any suggestions or wish to inquire about the details of the collection, use, and/or disclosure of your personal data, including requesting to exercise your rights under this Notice, you can contact the Company and/or the Data Protection Officer through the following channels:
Email: dpo@netdesigngroup.com
Address: No. 1 Fortune Town Building, 22nd Floor, Ratchadaphisek Road, Din Daeng Subdistrict, Din Daeng District, Bangkok 10400
Telephone Number: 02-6421105
This Notice is effective from January 17, 2023 onwards.