Personal Data Protection Policy (Privacy Policy)

1. Scope and Purpose of This Personal Data Protection Policy

This document is the Personal Data Protection Policy for users of our platform. We act as the Data Controller under the personal data protection law. This Policy explains how we collect and use your personal data within the scope of our purposes.

2. What Personal Data We Collect

We collect the following personal data about you:

• Identity data, such as first and last name, taxpayer identification number, and signature.
• Address or contact data, such as telephone number, email, address, and LINE ID.
• Employment data, such as company/juristic person name and job title.
• Transaction data, such as date and time.

3. How We Collect Personal Data

In general, we collect personal data directly from you through processes or channels such as telephone, email, or social media such as LINE or Facebook.

However, we may also collect additional data from external organizations, including:

• Government agencies, such as the Department of Business Development.
• Commercial banks, such as Kasikornbank Public Company Limited.
• Accounting service providers, such as PUUN Intelligent Co., Ltd.

4. How We Use Personal Data

We use your personal data to carry out activities in line with our purposes, which can be divided into the following activity groups:

5. Sharing Personal Data with External Organizations

We may need to transfer and/or disclose your personal data to the following external organizations so that they can process the data in accordance with their contractual responsibilities to us and/or their legal obligations:

• Government agencies, such as the Revenue Department.
• Accounting service providers, such as accounting firms.

However, where personal data is disclosed and/or transferred to external organizations, we will do so only to the extent necessary, disclosing and/or transferring the least amount of data, and we may consider using anonymisation and pseudonymisation for greater data security.

6. Sending or Transferring Data Abroad

Within the scope and processing purposes of this Personal Data Protection Policy, we currently have no need to send or transfer your personal data to any data recipient located abroad.

Furthermore, should your personal data be sent or transferred abroad, we will send or transfer it only where one of the following conditions is met:

• The destination country receiving the data has been determined by the Personal Data Protection Committee to have adequate personal data protection.
• The foreign organization receiving the data is subject to a personal data protection policy that has been reviewed and certified by the Office of the Personal Data Protection Committee.
• The foreign organization has put in place appropriate personal data protection measures under which the rights of data subjects are enforceable, together with effective legal remedies, such as standard contractual clauses and codes of conduct.
• It is necessary for the exercise of legal claims.
• Your consent has been obtained, you having been informed of the inadequate personal data protection standards of the destination country.
• It is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into that contract.
• It is done in performance of a contract between us and another person or juristic person for your benefit.
• It is to prevent or suppress danger to the life, body, or health of a person, where that person is incapable of giving consent at that time.
• It is necessary for carrying out a mission in an important public interest.

7. Security of Personal Data

We have put in place security measures for your personal data. In addition, external organizations that process personal data on our behalf must comply with our security measures and must agree to maintain the security of your personal data.

8. Personal Data Retention Period

We will retain your personal data for as long as necessary to carry out our purposes, including necessary activities such as legal, accounting, and auditing matters.

9. Rights of the Data Subject

You have the following rights in relation to your personal data:

• Right to Revoke Consent — where we have requested your consent in order to process your personal data.
• Right of Access — you may request a copy of your data and verify whether we have processed your data lawfully.
• Right to Data Portability — where we have provided a platform that enables you to access personal data by automated means
  • You may request that your personal data be sent or transferred to another organization by automated means.
  • You may request to directly receive the personal data that we have sent or transferred to another organization, unless it is technically not feasible.
• Right to Object — you may object where we process your data on the following lawful bases and/or for the following purposes:
  • On the basis of legitimate interest
  • For direct marketing purposes
• Right to Erasure — you may request that your personal data be deleted or destroyed, or made data that cannot identify you, in the following cases:
  • When processing of the personal data is no longer necessary.
  • When you withdraw consent to the processing of the personal data and we have no legal ground to continue processing it.
  • When you have objected to the processing of your personal data.
  • When the personal data has been processed unlawfully.
• Right to Restrict Processing — you may request that the use of your personal data be restricted in the following cases:
  • While verification is pending following your request to rectify the personal data.
  • When the personal data must be deleted or destroyed but you request that its use be restricted instead.
  • When the personal data is no longer necessary to retain for the purposes, but you need it to be retained in order to establish legal claims.
  • While demonstration or verification is pending in respect of your request to exercise the right to object.
• Right to Rectification — you may request that your data be corrected so that it is accurate, complete, and up to date, if you find that it is not.

10. Review and Revision of This Policy

This document is the Personal Data Protection Policy for users of our platform, last updated on 31 July 2024. We reserve the right to review and revise this Policy as we see fit, and will notify you of changes to this Personal Data Protection Policy.