Personal Data Protection Policy

The Group processes your personal data based on the purposes of use of the personal data is processed by the Group.

Personal data under this Policy refers to information relating to an individual that can identify that individual, directly or indirectly, excluding information about deceased persons specifically. It can be categorized into two types of personal data as follows:

1.1 General Personal Data

1. Personal identifiers such as name, surname, gender, age, date of birth, ID card number, photographs, and signatures.
2. Historical information such as military status, marital status, nationality, education history, employment history, language skills,  special skills, and  performance evaluations.
3. Contact information such as address, phone number, and email.
4. Financial information such as credit card details and bank account numbers.
5. Work-related information such as occupation, position, and workplace.
6. Technical data such as IP address, MAC address, access logs, website usage behavior, browser type, and version.

1.2 Sensitive Personal Data
Sensitive personal data refers to personal data under Section 26 of the PDPA, including race, ethnicity, political opinions, religious beliefs, sexual behavior, criminal history, health information, disability, trade union membership, genetic data, biometric data, and any other data as declared by the committee.

In general, the Group collects your personal data directly through various activities between you and the Group. However, in some cases, the Group may receive your personal data from other sources, such as individuals related to you (e.g., family members, referees, contacts) who have indicated or shown that they have the right to disclose your personal data to the Group for the purposes of processing as outlined in this Policy.

The Group collects, uses, or discloses your personal data to perform various actions according to the scope and purposes outlined below:

3.1 If you are a customer of the Group

1. To enter into a contract with you as agreed with the Group.
2. To provide services to you according to the contract you have agreed upon with the Group.
3. To process payments according to the agreement between you and the Group.
4. To present interesting news, offers, benefits, and promotions of the Group.
5. For marketing and data analysis purposes.
6. To ensure security within the Group, such as CCTV recordings.
7. To resolve disputes or conflicts that may arise between you and the Group related to the provision of services.
8. To comply with the PDPA or other laws related to the aforementioned purposes.

3.2 If you are a business partner of the Group

1. To enter into contracts or service agreements as agreed with the Group.
2. To perform obligations under the contract.
3. To process payments and communications.
4. To resolve disputes or conflicts that may arise between you and the Group related to the fulfillment of the contract.
5. To comply with the PDPA or other laws related to the aforementioned purposes.

3.3 If you are an employee of the Group

1. To recruit personnel and conduct internships.
2. To perform employment contracts between you and the Group, such as salary payments.
3. To comply with laws applicable to the group as an employer, such as labor protection, social security funds, compensation funds, revenue department, etc.
4. To ensure security within the group, such as CCTV recordings.
5. To resolve disputes or conflicts that may arise between you and the Group related to the fulfillment of the contract.
6. To comply with the PDPA or other laws related to the aforementioned purposes.

The Group relies on the following legal bases to process your personal data.

By processing your personal data, it may rely on one or more legal bases.

4.1 Government agencies responsible for regulatory oversight, such as the Revenue Department, the Enforcement Department, and the Provident Fund.
4.2 External service providers, such as data analysis service providers.
4.3 Insurance companies.
4.4 Financial institutions, such as banks providing payment services.

2) Right to access personal data: You have the right to request access to and receive copies of all personal data relating to you, including requests for disclosure of the acquisition of personal data that you did not consent to.

3) Right to data portability: If the Group has a platform that allows you to access your personal data by automated means.

• You may request the Group to transfer your personal data to another organization by automated means.
• You may request the Group to transfer your personal data directly to another organization unless there are technological limitations.

4) Right to object to processing: You have the right to object to the processing of your personal data processed under the legitimate interests of the Group. Additionally, you have the right to object to the processing of your personal data if the Group processes your personal data for marketing purposes and for beneficial profiling.

5) Right to request deletion or destruction of personal data: You have the right to request the deletion or destruction of your personal data or to anonymize your personal data in the following cases:

• When your personal data is no longer necessary for the purposes of processing.
• When you withdraw your consent for the Group to process your personal data and/or your sensitive personal data.
• When you object to the processing of your personal data which the Group has processed based on legitimate interests, and the Group has no overriding legal grounds for continuing to process your personal data.
• When the processing activities are not in compliance with the law.

6) Right to request suspension of processing: You may have the right to request the Group to suspend the processing of your personal data in the following cases:

• While your request for rectification of your personal data is being reviewed.
• In relation to personal data that you have previously requested the Group to delete, but you have subsequently requested the Group to suspend the processing of your personal data instead.
• When the processing period of your personal data has ended, but you have requested the Group to suspend processing due to legal reasons.
• While your objection to the processing of your personal data is being reviewed.

7) Right to request rectification of personal data: You have the right to request the rectification of your personal data to be accurate, current, complete, and not misleading.

If you wish to exercise your rights under the PDPA, you can contact the Group through the channels specified in Section 12. The Group will respond to your request within 30 days from the date of receipt of your request. However, the exercise of your rights as stated above is subject to various relevant factors, and the Group may not be able to comply with your request if it can assert any legal basis for processing your personal data further.

The Group may charge a fee for processing your request, and such fee will be at the Group discretion.

The Group has implemented measures to ensure the security of personal data, including organizational measures and technical measures, based on the principles of confidentiality, integrity, and availability of data to prevent loss, access, use, alteration, modification, or disclosure. Additionally, the Group will implement security measures for personal data, including administrative safeguards, technical safeguards, and physical safeguards regarding access control.

The Group will limit access to your personal data, allowing only those individuals who need to access the personal data to perform their duties. In cases where third parties process your personal data, it must be processed under the Group instructions as specified in the Data Processing Agreement between the data controller and the data processor.

In the event of a personal data breach occurring, the Group will notify the Office of the Personal Data Protection Committee without delay within 72 hours of becoming aware of the breach. If the breach poses a high risk of affecting your rights and freedoms, the Group will inform you of the breach along with remediation measures without delay through various channels.

The Group may amend this Policy from time to time, and you can find out about the amended terms and conditions of this Policy through the Group communication channels as deemed appropriate.

If you have suggestions or inquiries about details regarding the processing of your personal data or wish to exercise your legal rights, you can contact us at the following: