Privacy Notice for Customers

EXOGRO CO., LTD. (“Company”) values your privacy and strives to protect your personal data (“Personal Data”) based on the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). The Company has, therefore, prepared this Privacy Notice to inform you of details about the collection, use and/or disclosure of your Personal Data.

1. Purposes of collection, use and disclosure of Personal Data

The Company will collect, use and disclose your Personal Data only where there are proper reasons and/or legal grounds to do so. This includes sharing it to third parties under the following main purposes:

1.1 for performance of a contract or before the Company enters into a contract with you;

1.2 for the processing of your Personal Data in compliance with the law or obligations under the law;

1.3 for trading, transactions and investment risk assessments according to internal processes, applicable law and regulations;

1.4 for processing information about payment, charge or pay, including accounting purposes, accounting management, company auditing or debt collection;

1.5 for performance appraisal, internal report, data analysis and manage contractual employment;

1.6 for regulatory compliance and audit the Company's business affair (Both internal and external);

1.7 for maintain company security;

1.8 for the Company’s legitimate interests in processing your Personal Data while still considering that your fundamental rights does not exceed the benefits of the Company; and

1.9 for a specific purpose in accordance with the consent you gave to the Company in processing your Personal Data.

2. Collection of Personal Data

The Company collects and uses many kinds of Personal Data, depending on the circumstances that are relevant to the selling or providing of services.

2.1 Sources of data for the collection of Personal Data

The Company collects your Personal Data from a variety of sources, such as:

• When you buy products and/or request services from the Company;

• All conversations between you and the Company, including records of conversations by telephone, letter, email, memos or any other method;

• When you are using the Company’s systems, applications and/or website (browser’s cookies),;

• Customer surveys and complaints about the Company's products or services;

• When you participate in the competitions or promotional activities of the Company;

• When you make your personal information publicly available, including disclosure via social media, in such case the Company will choose to collect only the information you choose to be publicly visible;

• Information received from outsiders which is considered as credit information, information from law enforcement agencies, etc.; and/or

• When you purchase any products and/or services of the Company through third parties.

In some cases, the Company may be joined with third parties who are not affiliated companies to collect your personal information in connection with the customer survey when you visit online resources. However, the Company will notify and give you an opportunity to refuse the processing of such information.

2.2 Categories of Personal Data collected, used and/or disclosed

The categories of your Personal Data that the Company collects, uses and/or discloses (collectively “process” or “processing”), subject to applicable law, includes but is not limited to the following:

• Personal details: First name and surname, gender, date of birth, personal identification number, passport number, other identification number issued by government authorities to be used as an identity verification document, important documents of legal entities issued by the government (in case that the business partner is a juristic person), tax identification number, nationality, photograph as appears in the identification card, passport or driving license, signatures, identity verification information, other photographs and CCTV images/footage;

• Contact details: Address, telephone number and email address;

• Financial details:Details of your bank account, mailing address for issuing invoices, credit card numbers and card holder’s name and details of credit card;

• Electronic details: IP address, cookies, recording of activities, identifying person and geolocation data; and

• Sensitive Personal Data:

o Religion;

o Health data;

o Criminal record.

The Company may also collect some sensitive Personal Data about you for use in delivering products and/or services to you. However, the Company will not collect, use and/or disclose this type of data without your explicit consent unless the law allows the Company to do so.

2.3 Refusal to give Personal Data to the Company

Under circumstances where it is necessary for the Company to collect your Personal Data and you refuse to give your Personal Data to the Company, the Company may refuse to take other relevant actions.

3. Processing of Personal Data

Pursuant to the purposes, the Company may process your Personal Data in accordance with applicable law and a legal basis. The legal basis on which the Company performs such processing are as follows:

Purposes of collection, use and disclosure of Personal Data

Legal basis

Products and/or services

  • To deliver/transport the Company's products and/or services.
  • To verify your identity.
  • To resolve existing problems related to the products and/or services. 
  • To manage your payment including expense management.
  • To process information about payment, charge or pay, including accounting purposes, accounting management, company auditing or debt collection.  
  • To do performance appraisal, internal report, data analysis and manage contractual employment.
  • Contractual basis

Customer care

  • To contact and communicate with you about products and/or services.
  • To register customers.
  • To create username on Company’s website, application, or IT systems.
  • To provide you to access and use Company’s website, application, or IT systems.
  • To respond to your complaints and find a way to remedy you.
  • To comply with requests regarding the right you have over your personal information in the Company's possession.
  • To manage the relationship between the Company and you or your business.
  • To maintain database and keep contact information up to date.
  • To organize events for customers.
  • Contractual basis
  • Legal obligation
  • Consent
  • Legitimate interest

 

Business development

  • To identify existing issues related to products and/or services.
  • To plan existing products and/or services for development.
  • To test, analyze and develop products and/or new services.
  • To develop new approaches to meet your needs. 
  • To understand and analyse demands and to assess and/or survey your satisfaction.
  • Legitimate interest

Security, safety and risk management

  • To verify your identity.
  • To prevent crimes and manage the security of the Company’s premises, the Company may, for example, install a closed-circuit television (CCTV) in and around the Company’s premises and these may collect your photos, videos or voice recordings.
  • To manage the risks of the Company and customers of the Company.
  • To keep documents for reference checks.
  • To investigate, report and seek ways to prevent financial crimes.
  • To audit the Company's business affairs (Both internal and external).
  • To comply with regulations and legal requirements.
  • Legal obligation
  • Legitimate interest

 

Marketing

  • To survey products and/or services of the Company that you may be interested in.
  • To communicate with you about analytical marketing activities that meet your needs through any method, including email, telephone, text messages, social media, letter or face-to-face.
  • To develop marketing activities.
  • Consent
  • Legitimate interest

General

  • For public relations of the company.
  • To conduct various surveys of the company such as satisfaction surveys, etc.
  • Legitimate interest
  • To record Logfile.
  • Legal obligation

4. Disclosure of Personal Data

The Company may disclose or send your Personal Data to third parties in order for these individuals to process your Personal Data in the following ways:

4.1 Disclosure of Personal Data to third parties

• Subcontractors, brokers or any services provider whom working for the Company or providing services to the Company including their sub-contractors, service providers, directors and officers;

• Persons assigned to manage any of your interests;

• Intermediaries, contact persons and your representatives;

• Financial institutions and payment service providers;

• Any person or other Company involved in any corporate reorganization, merger or amalgamation or acquisition that has taken place or may arise including a transfer of rights or any duties which the Company has under the contract between the Company and you;

• Law enforcement agencies, government, courts, dispute resolution agencies, Company’s controlling person, auditors and any person appointed or requested by the Company's controlling person to check the operational activities of the Company;

• Any other person in connection with any dispute arising including any dispute related to a transaction;

• Fraud prevention agencies which use the information to investigate and prevent fraud and other financial crimes;

• Any person who orders or manages affairs on your behalf (such as attorneys, lawyers, etc.); and/or

• Any person whom the Company has been ordered by you to disclose your personal information for.

• Affiliates, Group companies or Major shareholder;

• Companies, organizations, or entities that conduct audits of the company's business/operation.

4.2 Transfer of Personal Data overseas

The Company may be required to send or transfer your Personal Data overseas for storage and/or processing in the performance of a contract entered into between you and the Company. The Company will not allow unrelated persons to access the Personal Data and the Company will lay out appropriate security measures.

5. Retention of Personal Data

The Company will collect your Personal Data for as long as it is necessary to carry out the purposes of processing such Personal Data. The Company will retain your Personal Data for a period of 10 years from the date on which your relationship with the Company as a customer expires. The Company will destroy, delete, or make Personal Data non-personally identifiable information, unless there is a legal obligation or technical reasons whereby the Company may keep your Personal Data for a longer period of time.

6. Data Subject Right

You have entitled to your Personal Data in accordance with the PDPA, and the Company will respect your rights and take actions promptly in accordance with any laws, rules, or regulations, under certain circumstances, relating to the processing of your Personal Data

You have the following rights regarding your Personal Data:

6.1 Right to Withdraw Consent: In case where the Company processes your Personal Data with your consent, this right enables you to withdraw your consent to the Company processing your Personal Data at any time. The Company may continue to process your Personal Data if the Company has another legal basis to do so.

6.2 Right to Access: This right enables you to receive a copy of your Personal Data that the Company holds about you.

6.3 Right to Correct: This right enables you to have any incomplete or inaccurate Personal Data the Company holds about you to become correct, current, and complete.

6.4 Right to Erasure: This right enables you to ask the Company to delete, destroy or anonymize your Personal Data where there is no good reason for the Company to continue processing it. You also have the right to ask the Company to delete your Personal Data where you have exercised your right to object to the processing (see below). Nonetheless, the Company will consider a request to delete carefully, according to the law, regarding the processing of your Personal Data.

6.5 Right to Object: This right enables you to object to the processing of your Personal Data where the Company relies on legitimate interest and there is something about your particular situation which makes you want to object to the processing on this ground. You also have the right to object where the Company processes your Personal Data for direct marketing purposes and profiling activities.

6.6 Right to Restrict Processing: This right enables you to ask the Company to suspend the processing of your Personal Data, for example, if you want the Company to establish its accuracy or a reason/lawful basis for processing it.

6.7 Right to Portability: In some cases, you have the right to request for a copy of your Personal Data in electronic form to be sent to other data controllers. This right will be used only for the Personal Data you submitted to the Company and the processing of such Personal Data is done with your consent or where such Personal Data is necessary to be processed to fulfill the Company’s obligations under a contract.

6.8 Right to Lodge a Complaint: This right enables you to file a complaint with a related government authority, including but not limited to, the Thailand Personal Data Protection Committee, when you see that the Company, the Company’s employees or service providers violate or do not comply with the PDPA or other notifications issued under the PDPA.

You may exercise your rights at any time by contacting the Company via the contact channels mentioned in Article 8 below.

The Company may be required to obtain certain information from you to verify your identity and certify your right to access Personal Data (or to exercise any other right) in order to comply with security measures that will ensure that your Personal Data will not be disclosed to anyone who has no right to access it.

The Company will make every effort to respond to all legitimate requests within 30 days. In some cases, it may take more than 30 days if your request is complex, or you submit more than one request. In such event, the Company will notify you and will keep you informed of the status of the request.

7. Security of your Personal Data

The Company takes the security of your Personal Data very seriously. The Company will inspect and implement organizational security as well as physical and technical measures appropriately for the Company to store and process your Personal Data and ensure that your Personal Data will not be lost, destroyed, disclosed and misused or accessed by anyone other than the employee or data processors performing the Company's duties.

8. Dealing with complaints or inquiries

To make a complaint about how the Company collects, uses, processes and discloses your Personal Data, you can contact the Company or ask questions via the following channels:

• Contact the Company at Data Protection Officers, 

EXOGRO CO., LTD.

8/5 Moo 3, Bangmaenang, Bangyai, Nonthaburi, 11140 Thailand;

• Email the Company at info@exogro.co.th; or

• Telephone number 66 (0) 2 103-9000.

9. Modification of the Privacy Notice

The Company will regularly review and revise the Privacy Notice for Customers. You can view the latest changes from the date below in the Privacy Notice through the Company's website. [www.exogro.co.th]

This Privacy Notice for Customers’ members was last updated on May 05, 2024.