Privacy Policy

1. Principles and Objectives

Pranda Jewelry (Public) Company Limited and its affiliates (“the Group”) recognize the importance of personal data and other information related to users of our services (“Customers” or “You”). We aim to ensure that you can trust that our website operates transparently and responsibly in the collection, use, or disclosure of your information in accordance with the Personal Data Protection Act B.E. 2562 (“PDPA”) and other applicable laws. This Personal Data Protection Policy (“Policy”) has been established to inform you about the details of the collection, use, or disclosure (collectively referred to as “Processing”) of your personal data.

2. Collection of Personal Data

Personal data refers to information about an individual that can identify that person directly or indirectly. The Group collects personal data only when necessary and uses that data responsibly.

Type of Personal Data	Details and Examples
Personal Identifiers	Name-Surname Gender Age Date of Birth ID Number Photograph
Contact Information	Mailing Address Email Phone Number (including home or mobile) Social Media Accounts, such as LINE ID, Facebook Account, Facebook ID
Financial Information	Credit/Debit Card Details: Name on Card, Card Number, Expiry Date, Bank Name Bank Account Tax Invoices
Technical Data	IP Address MAC Address Usage Logs or Tracking of Website Usage from Session ID Type and Version of Web Browser

3. Sources of Personal Data

The Group may collect your personal data through various channels as follows:

3.1 Direct Collection from You
– When you register by filling out information in forms, whether in document form, through the website, social media, or any other channel.
– When you order products and services.
– When you fill out forms.
– When you communicate, inquire, provide feedback, or provide recommendations regarding the Group products and services.
– When you choose to receive news or promotional materials from the Group.

3.2 Automatic Collection of Personal Data
– When you visit or use services on the website that uses cookies or similar technologies to collect technical data about your usage details.
– Data obtained from the use of services and related information, such as device information used to access the services (IP Address & MAC Address).

3.3 Collection of Your Personal Data from Third Parties
This refers to the collection from such sources lawfully or with the consent of the owner of the personal data for disclosure to the Group, such as sending your personal data to the Group for the purpose of presentation or service provision to you and conducting related business.

4. Principles for Collecting Personal Data

Legal Basis for Data Collection	Details
Compliance with Contract	To fulfill the sales contract between the data controller (“the Group”) and the data owner (“You”) concerning payment for products and to collect your shipping address for delivery.
Consent of the Data Owner	For collecting, using, or disclosing personal data, the Group must obtain consent and inform you of the purpose of collection prior to or at the time of seeking consent. This includes sensitive personal data that does not fall under exceptions as per the law, offering and publicizing products and services, facilitating service provision, etc.

The types of personal data collected, used, processed, or disclosed will depend on the purposes of data use, and the Group will collect only necessary or relevant personal data, as follows :

(1) Personal Data of Shareholders
Information used to create ownership documents, including personal data of the Group shareholders, such as Name, ID Number or other identification numbers, phone number, date of birth, gender, address, email, etc.

(2) Personal Data of the Board of Directors and Subcommittees
Information used by the Group to conduct transactions or actions on behalf of the Group, such as Name, ID Number or other identification numbers, phone number, date of birth, gender, address, email, family information, work skills, signature, criminal history, etc.

(3) Personal Data of Employees, Contractors, Consultants, and Interns
Data collected from job application forms for hiring consideration and to create employee records used for human resource allocation, management, and development, providing benefits, ensuring safety and health, increasing employee knowledge and skills, as well as using data for various activities with the Group.

Personal Information: Name, Surname, Copy of ID Card or other identification, House Registration, Educational Certificates at all levels, Military Service Exemption Certificate, Phone Number, Date of Birth, Gender, Address, Email, Line ID, Photographs, Work History, Employment Certification Copy, Driving License Copy (for driver applicants), which may include previous employer’s name and address, job skills, signature, current address map, documents for employment guarantees, bank account number.
Sensitive Personal Data: Nationality, Ethnicity, Religion, Blood Type, Health Check History, Chronic Illnesses, and Health Check Results according to annual health checkup lists, including medical advice or treatment plans, criminal history, records of legal proceedings whether civil or other proceedings, including daily reports from law enforcement officials and related court orders, disability information, fingerprint data, facial recognition data (if the Group has obtained explicit consent).
Family Information: Information about spouses, family, emergency contact persons, references, or beneficiaries of various benefits. You must inform these individuals about the processing of their personal data as per this policy before providing information to the Group and seek their consent if necessary, unless the law states otherwise.
Employment Information: Job position, department, start date, end date of employment, length of service, salary and remuneration, tax information, performance assessments, attendance history, leaves, overtime, training, provident fund, social security, utilization of benefits, reasons for resignation, probation evaluation, performance evaluation, promotions, appointments, transfers, job changes, penalties, travel for work purposes, and related expenses or reports of accidents and workplace safety, etc.
Other Information: Information from CCTV, photographs, videos from participating in activities, information from tests, or other information provided to the Group by personnel, such as application data.

(4) Personal Data of Job Applicants
This includes information you consent to provide for hiring consideration, based on the application form you filled out, which may include:

Personal Information: Name, Surname, Copy of ID Card or other identification, House Registration, Educational Certificates at all levels, Military Service Exemption Certificate, Phone Number, Date of Birth, Gender, Address, Email, Line ID, Photographs, Work History, Employment Certification Copy, Driving License Copy (for driver applicants), which may include previous employer’s name and address, job skills, signature, photographs.
Sensitive Personal Data: Nationality, Ethnicity, Religion, Blood Type, Health Check History, Chronic Illnesses, and Health Check Results according to annual health checkup lists, including medical advice or treatment plans, criminal history, records of legal proceedings whether civil or other proceedings, including daily reports from law enforcement officials and related court orders, disability information (if the Group has obtained explicit consent).
Family Information: Information about spouses, family, emergency contact persons, references, or beneficiaries of various benefits. You must inform these individuals about the processing of their personal data as per this policy before providing information to the Group seek their consent if necessary, unless the law states otherwise.

(5) Personal Data of Land and Property Owners or Renters
This information is created between the data owner and the Group for managing rental spaces, making land lease agreements, property lease agreements, and other contracts based on mutually agreed terms, such as Name, Surname, ID Number or other identification numbers, phone number, date of birth, gender, address, email, information about the space or property, bank account number, etc.

(6) Personal Data of Customers, Partners, or Contractors
This data is used by the Group for creating contracts with customers, partners, business affiliates, or trade contracts, including transactions with partners or contractors, such as Name, Surname, ID Number or other identification numbers, passport number, phone number, date of birth, gender, address, email, etc., based on the terms of the contract or documents required for each task.

(7) Personal Data of Visitors to the Group Premises
This includes records of entry and exit from the office building and security measures and is used for security verification, recorded in the visitor logbook, such as Name, Surname, ID Number or other identification numbers, etc.

(8) Other Personal Data
Other personal data may be collected for verification, human resource management, and compliance with relevant laws. The Group may store employee personal data in various forms, such as documents or electronically.

5. Purpose of Data Collection

Purpose	Details
To facilitate website usage and services	To facilitate product ordering, shipping, returns, and exchanges.
To respond to inquiries and assist customers	To provide assistance to customers related to services, update customer information, and handle requests or complaints.
To develop and improve quality and services	To analyze and enhance products or services to better meet customer needs.
To provide information about products and services or for marketing communications	To send information regarding products and services, offer promotions, discounts, and special offers to customers via email, SMS, and mail (upon obtaining explicit consent).
For data analytics	To analyze customer data for market research and improve products and services.
To prevent, detect, and investigate crimes	To conduct checks and actions to prevent violations of applicable laws, including security breaches affecting the data owner.

The Group may publicly disclose your non-identifiable information or share it with partners for marketing purposes, website performance analysis, and general operations, promotional activities, or to demonstrate trends related to the usage of the Group products and services.

6. Disclosure of Personal Data to External Parties

The Group may disclose personal data only as necessary to external agencies or parties under the consent of the personal data owner unless permitted by law.

6.1) Internal Agencies
Such as human resources personnel, management, supervisors, accounting & finance, and IT departments.

6.2) External Agencies Related to the Group Business
Such as service providers for transportation, payment processing, data analysis, and market research.

6.3) Government Agencies and Regulatory Authorities
Law enforcement officers, government officials, agencies that regulate under the law, or those requesting to disclose personal data using legal authority or related to legal processes or permitted by applicable laws.

6.4) Other Agencies
Such as new employers, external training institutes, insurance companies/hospitals (for employee benefits), external auditors, customers, or other relevant agencies.

n cases where the Group discloses your personal data to others, it will implement appropriate measures to protect the disclosed personal data and comply with personal data protection standards and obligations as required by the Personal Data Protection Act.

If the Group transfers your personal data to another country, it will ensure that the destination country, international organization, or data recipient meets adequate personal data protection standards. In some cases, the Group seek your consent for the transfer of your personal data abroad as stipulated by the Personal Data Protection Act.

7. Retention Period for Personal Data

The Group will retain your personal data only as required by law or as necessary for the purposes of data collection. The Group will delete or destroy personal data when it is no longer necessary for the purposes outlined. After such period, the Group may take appropriate steps to delete or destroy your personal data from storage or make your personal data non-identifiable.

8. Security of Personal Data

The Group recognizes the importance of safeguarding your personal data. Therefore, it has established appropriate measures to prevent loss, access, destruction, use, alteration, modification, or unlawful disclosure of personal data, ensuring electronic security through SSL (Secure Socket Layer) standards approved for the website by a Certificate Authority (CA) and encrypted to protect data such as personal information, passwords, and credit card numbers.

9. Rights of Personal Data Owners

1) Right to Withdraw Consent
You have the right to withdraw consent for the processing of your personal data at any time while your personal data is with the Group.

(2) Right of Access
You have the right to request access to your personal data in the Group control and request copies of such data.

(3) Right to Rectification
You have the right to request correction of your personal data to ensure it is current and complete. If you are a member, you can correct your personal information on your member detail page.

(4) Right to Erasure
You have the right to request deletion, destruction, or making your personal data non-identifiable when such data is no longer necessary.

(5) Right to Restriction of Processing
You have the right to request the temporary restriction of the processing of your personal data while the Group is reviewing your request for rectification of your personal data or your right to object to the collection, use, or disclosure of your personal data.

(6) Right to Data Portability
You have the right to receive your personal data in cases where the Group has made that data available in a format that is commonly used and can be read or processed automatically, including the right to have that data sent or transferred to another data controller.

(7) Right to Object
You have the right to object to the collection, use, or disclosure of your personal data.

(8) Right to Lodge Complaints
If the Group violates or fails to comply with the laws on personal data protection, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee.

Impact of Exercising Rights
If you choose to object to the collection or request deletion or destruction of your previously provided consent, it may affect the services you will receive, and the Group may not be able to provide certain services.

Exercising Your Rights
You can exercise your rights as a personal data owner as outlined above using the Data Subject Right Request Form, which can be requested from the Group data controller. The Group will consider and inform you of the result within 30 days from the date it receives such request.

Timeframe for Processing Your Rights

Type of Right	Processing Time
Right to Withdraw Consent	7 Days
Right to Access Personal Data	30 Days
Right to Data Portability
Right to Object
Right to Erasure
Right to Restrict Processing
Right to Rectification

Exercising the rights listed in the table above, you or your legal heirs, authorized representatives, guardians, or legal guardians must notify the Group in writing to process the request within the timeframe stipulated by law.

The Group actions regarding your rights may result in limitations on the services or transactions you can receive or actions that benefit you under the Group terms and applicable laws.

10. Connections to External Websites or Services

The Group website may contain links to external websites that may collect data about your usage and personal information. The Group cannot be responsible for the security or privacy of information collected by external websites. You should review the privacy policies of those external websites and comply with the privacy policies presented on those websites.

11. In the Event You Refuse Consent or Do Not Provide Personal Data

The Group is required to collect personal data as mandated by law or for entering into a contract between you and the Group. If you do not consent to the use of your personal data, you can still use the Group services, however, you may receive less convenience from using the services because the Group cannot use your personal data effectively for its purposes.

12. Reservation of Rights

The Group reserves the right to deny your request as outlined in Section 9 in the following cases:

(12.1) the law grants the Group the right to deny your request.
(12.2) The requested personal data is anonymous or cannot identify the personal data owner.
(12.3) The requester cannot prove they are the personal data owner or authorized/affected parties to act on behalf of the personal data owner.
(12.4) The personal data does not exist in the Group records.
(12.5) the personal data owner or authorized/affected parties have made similar requests or repeated requests without necessity or reasonable grounds.

13. Amendment of the Privacy Policy

This Privacy Policy may be revised or amended as appropriate to comply with the Personal Data Protection Act or other applicable laws. The Group recommends that you periodically check for changes to this Privacy Policy. In the event of any changes to the personal data protection policy, the Group will notify the personal data owner by publishing it on the Company’s website, public notices, electronic media, or other appropriate channels for communication with the personal data owner

14. Contact Details

If you have questions, suggestions, or need further information regarding the privacy policy, please contact:

Personal Data Controller contact
Pranda Jewelry Public Company Limited
Email: legal_prandagroup@pranda.co.th
Phone: 02-769-9999

15. Account Deletion

If a user wishes to delete their account, they can notify the Group to request account deletion at any time by sending an email to pdpa_crm@primagold.co.th After the account is deleted, your personal data on the server will be erased and cannot be recovered.

This Privacy Policy was approved by the Board of Directors at its 5^th meeting of 2025 on November 12^th, 2025, and has been effective since November 12^th, 2025.