Privacy Policy
Privacy Notice
ThaiAce Capital Co., Ltd.
25 May 2022
ThaiAce Capital Co., Ltd. (the “Company”) is committed to providing the best possible service and attaches the utmost importance to your privacy. The Company has therefore issued this Privacy Notice so that you are informed of the Company's policy on the collection, use and disclosure of your personal data, in accordance with the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”) and other applicable laws and regulations. This Privacy Notice informs you of how the Company collects, uses or discloses your personal data, the types of data and the purposes of such processing, as well as details of the retention period, the disclosure of personal data to third parties, your rights, the confidentiality and security of your personal data, and how you can contact the Company.
| Category of persons covered by this Notice | Details |
|---|---|
| 1. Customers of the Company | - Individual customers: former and current customers of the Company who are natural persons |
| - Business customers: directors, shareholders, ultimate beneficial owners, employees, guarantors, collateral providers and legal representatives of former and current business customers, as well as any other natural persons authorised to act on behalf of a business customer. The Company recommends that its business customers take steps to ensure that their authorised representatives and any related natural persons are made aware of the Company's Privacy Notice | |
| 2. Persons who are not customers of the Company | - Such persons include natural persons who have no products or services with the Company but whose personal data the Company may need to collect, use or disclose, such as persons involved in transactions of the Company or of the Company's customers; persons who enquire about products and/or services; persons who receive information about products and/or services through various channels; persons who make payments or transfers to the Company, or who receive funds from the Company's customers or from overseas money transfer service providers; persons who visit the Company's website or applications or use services at the Company's branches or offices; guarantors or collateral providers; ultimate beneficial owners, directors or legal representatives of juristic persons that use the Company's services; debtors or lessees of the Company's customers; professional advisers; as well as the Company's directors and shareholders and the legal representatives of such persons |
Note: Please be aware that links appearing on the Company's platforms may take you to third-party platforms. Once you enter a third-party platform, the processing of your personal data will be governed entirely by that third party's privacy policy. The Company therefore recommends that you read and understand the privacy policy of any third-party platform when you use it.
1. How the Company collects, uses or discloses your personal data
The Company will collect, use or disclose your personal data only where necessary or where there is a legal basis for the collection, use or disclosure of personal data, including collection, use or disclosure for compliance with legal obligations, for the performance of a contract you have entered into with the Company, for the legitimate interests of the Company, on the basis of your consent and/or under other legal bases. The purposes for which the Company collects, uses or discloses data are as follows.
1.1 The Company's legal obligations
As the Company must comply with applicable laws and regulations, the Company needs to collect, use or disclose your personal data for various purposes in order to comply with the laws and regulations of government agencies and/or the authorities that supervise the Company, including but not limited to the following purposes.
| (a) | To comply with the PDPA, as amended |
| (b) | To comply with the law (for example, anti-money laundering law, the law on counter-terrorism and proliferation of weapons of mass destruction financing, and other laws the Company must comply with, both in Thailand and abroad), including carrying out identity verification, background checks, credit checks, Know Your Client (KYC) and Customer Due Diligence (CDD) procedures and other checks (including checks against the public databases of regulators and/or designated persons lists), and taking ongoing steps to comply with any applicable law; and/or |
| (c) | To comply with the regulations and/or orders of competent authorities, such as court orders, orders of government agencies, the authorities supervising the Company, or authorised officials. Where the Company acts as an insurance broker, the Company will disclose your personal data to the Office of the Insurance Commission for the purposes of supervising and promoting the insurance business under the law on the Insurance Commission, the law on life insurance and/or the law on non-life insurance. Please read more about the personal data protection policy of the Office of the Insurance Commission at www.oic.or.th |
1.2 Contracts you have entered into with the Company
The Company will collect, use or disclose your personal data in accordance with your requests and/or the agreements you have entered into with the Company, including but not limited to the following purposes.
| (a) | To act on your requests prior to entering into a contract with the Company, such as providing advice on products and/or services, including any action by the Company which, if not taken, would affect the Company's operations or services or prevent the Company from providing services fairly and continuously, such as analysing and assessing customer needs, checking eligibility, verifying the status of corporate customers, verifying the accuracy of information or documents, identity proofing and verification including know-your-customer (KYC) and customer due diligence (CDD) procedures, asset appraisal, credit checks and/or requests to amend credit information, screening against the sanction lists of government law enforcement agencies and/or official bodies that are published as required by law, checking for receivership or bankruptcy, customer risk rating, and pre-filling your personal/contact details to facilitate applications for the Company's products and/or services |
| (b) | Any action relating to the consideration of products and/or services, such as communications, processing applications and carrying out the approval process (including but not limited to appraising customer assets, inspecting and valuing assets, and reviewing asset values), setting credit limits, and entering into contracts, agreements and/or any other related legal transactions |
| (c) | To carry out your instructions (for example, to act on requests relating to loan facilities and other liquidity credit, letters evidencing financial standing, cashier's cheques, payments or requests to settle debts, changes to your insurance policy, or to answer your enquiries) |
| (d) | To provide services via the internet (online banking), mobile applications and other online product platforms |
| (e) | To monitor or record your transactions |
| (f) | To prepare reports (such as transaction reports you request, or the Company's internal reports) |
| (g) | To send transaction alerts and notifications of maturing products and/or services |
| (h) | To collect debts you owe to the Company (for example, where you have not yet repaid a loan and/or outstanding fees); and/or |
| (i) | To take any action relating to insurance policies or claims (such as assessing your insurance application, quoting premiums, delivering the insurance policy to you, handling or pursuing claims under your insurance policy, and exercising rights of claim against third parties) |
1.3 The Company's legitimate interests
The Company will rely on the legitimate interests basis, weighing the interests of the Company or of other persons against your fundamental rights in the personal data that the Company collects, uses or discloses, including but not limited to the following purposes.
| (a) | To manage the business of the Company and of the companies in the Company's group (such as supervision and audit, checking bankruptcy records, risk management, internal management, and monitoring, preventing and investigating fraud, money laundering, terrorism, misconduct or other crimes, including but not limited to checking the reliability of any persons connected with the Company's business customers) |
| (b) | To manage the relationship between the Company and you (such as customer care, satisfaction surveys and complaint handling) |
| (c) | To manage claims and disputes, including resolving disputes, exercising legal rights or defending legal claims |
| (d) | To maintain security (such as CCTV recording, visitor registration, ID card exchange and/or photographing visitors before they enter the Company's buildings, and monitoring network usage and security events) |
| (e) | To develop and improve the Company's products, services and systems in order to raise the Company's service standards; to use personal data to build credit models and/or to best meet your needs, including research and data analysis; and to offer products, services and benefits suited to you, having regard to your fundamental rights in your personal data. If you do not wish to receive offers of products, services and benefits from the Company, you may call 02-744-2222 |
| (f) | To record images and/or audio of meetings, training, seminars, recreational events or marketing activities; and/or |
| (g) | In the case of the Company's business customers, the Company will collect, use and disclose the personal data of their directors, authorised persons or representatives |
1.4 Your consent
In some cases the Company may ask for your consent to collect, use or disclose your personal data so that you receive the greatest benefit and/or so that the Company can provide services that meet your needs, including but not limited to the following purposes.
| (a) | Where it is necessary to collect and use sensitive personal data (for example, using face recognition data or a photograph of your national ID card (which contains sensitive personal data such as your religion and/or blood group) to prove and verify your identity before a transaction) |
| (b) | To collect and use your personal data and any other data about you for research and analysis in order to develop products and services that genuinely meet your needs, and/or to contact you to offer products, services and benefits suited specifically to you |
| (c) | To contact you to provide financial advice and present information about the Company's products or services that may interest you (where consent is required under the PDPA) |
| (d) | Where you are a minor, an incompetent person or a quasi-incompetent person, in which case the consent of a parent, guardian, curator or custodian (as the case may be) is required (except where the PDPA allows the processing to be carried out without consent) |
| (e) | To disclose your personal data and any other data about you to the companies in the Company's group and the Company's trusted business partners for the following purposes: (1) research, statistics, and the development and analysis of products, services and benefits that meet your needs; and (2) contacting you to offer or provide products, services and benefits suited to you; and/or |
| (f) | Any other processing for which the Company must obtain your consent |
1.5 Other legal bases
In addition to the legal bases above, the Company may collect, use or disclose your personal data under the following other legal bases.
| (a) | Preparation of historical documents or archives in the public interest, or for research or statistical purposes |
| (b) | Prevention or suppression of danger to a person's life, body or health |
| (c) | Where necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in a competent official |
Where the personal data the Company collects from you is necessary for the Company's compliance with the law or for entering into a contract with you, the Company may be unable to provide (or to continue to provide) some or all of the Company's products or services to you if you do not provide that personal data to the Company when requested.
2. Personal data the Company collects, uses or discloses
The types of personal data the Company collects, uses or discloses vary according to the scope of the products and/or services you may have used or are interested in, and include both general personal data and sensitive personal data, including but not limited to the following.
| Type of data | Examples of personal data |
|---|---|
| Personal details | • Title, first name, middle name (if any), last name |
| • Date of birth | |
| • Age | |
| • Education | |
| • Marital status and number of children • Spouse's name | |
| • Nationality | |
| • Relationship information (such as between the principal borrower and a co-borrower, or between you and a beneficiary) | |
| Identification and verification details | • Photograph of national ID card, house registration |
| • National ID number, laser code (on the back of the national ID card) | |
| • Certificate of change of name or surname | |
| • Passport details | |
| • Official certificate details, alien identification card | |
| • Work permit | |
| • Driving licence | |
| • Signature | |
| Asset or collateral details | • Vehicle registration |
| • Machinery registration | |
| • Land / condominium unit title deed | |
| • Information about persons linked or connected to any of the above, such as the owner's name | |
| Contact details | • Postal address |
| • Address per house registration, address per national ID card | |
| • Current address | |
| • Electronic address | |
| • Telephone number | |
| • Fax number | |
| • Social media accounts | |
| Employment details | • Occupation |
| • Details of employer and workplace | |
| • Position | |
| • Salary | |
| • Length of service | |
| • Remuneration | |
| Business ownership information | • Shareholding proportion and/or information on any other document confirming business operations (such as a company affidavit or a lease of business premises) |
| Financial and transaction details | • Products and/or services you use |
| • Deposit account number, deposit balance | |
| • Income, source of income and expenses | |
| • Information on salary certificates, salary/bonus slips or other evidence of income, and bank statements | |
| • Asset appraisal value | |
| • Data on the use of channels, products and/or services | |
| • Transaction history, transaction details and the purpose of transactions, transaction memo data, transaction reference numbers, transaction channels | |
| • Information about your transactions (such as the type, amount and other information relating to your transactions) | |
| • Insurance information (such as insurance application documents, type of insurance, insurance applications, insurance policy details, start and end dates of cover, details of the insured property, premiums, sums insured and details of claims made under the insurance policy) | |
| Verification data | • Due diligence data (such as data relating to know-your-customer (KYC) and customer due diligence procedures) |
| • Data for verification and risk management, anti-money laundering and counter-terrorism checks, bankruptcy checks, and so on | |
| Access and service request data | • Data on your access to the Company's systems and your transactions with the Company via the internet and the Company's applications |
| Security data | • Images |
| • Physical description | |
| • Detection of suspicious or unusual activity | |
| • Photographs or video footage from closed-circuit television | |
| • Video / audio recordings | |
| Sensitive personal data | The Company does not intend to collect sensitive personal data from you. In some cases, however, the Company may need to collect sensitive personal data from you in order to provide services or products to you, such as |
| • Health data (such as data stated in an insurance application, reasons given for overdue payments, medical certificates, food allergy data, communicable disease screening data) • Criminal records (such as data appearing in the sanction lists and watch lists issued by competent government authorities, which may make the Company aware of a criminal record relating to predicate offences, terrorism or terrorist financing offences, or bankruptcy resulting from fraud) • Political opinions (such as data appearing in sanction lists and watch lists or any other database, which may make the Company aware of a person's political status) • Disability (such as a copy of a disability ID card, the type of disability, or a certificate from a disability association) • Biometric data (such as fingerprints or facial images) | |
| The Company will collect, use and/or disclose sensitive personal data only where the Company has obtained your explicit consent, or where the Company has a necessity in the cases permitted by law, and will do so on a case-by-case basis whenever sensitive personal data needs to be collected from you | |
| Personal data of minors | The Company does not intend to collect, use or disclose the personal data of minors unless the Company has obtained the consent of the person exercising parental authority, or in any matter to which a minor may lawfully give consent alone (as the case may be) |
| Other data | • Records of interactions and communications between you and the Company in any form or by any means, including but not limited to telephone, e-mail, chat messages and social media communications |
| • Information about insurance policies and claims (such as policy coverage, medical treatment data and claims history) | |
| • Any information you provide to the Company through any channel |
3. Sources of your personal data
In general, the Company collects personal data directly from you in the following ways.
| (a) | When you apply for the Company's products and/or services |
| (b) | Telephone conversations between you and the Company or its branch offices, including recordings of telephone conversations, e-mails, message records or any other means |
| (c) | When you visit the Company's website or use the Company's mobile applications |
| (d) | Information obtained from documents |
| (e) | Insurance claims or other documents |
| (f) | Audits and any financial statements or explanations |
| (g) | When you take part in promotional activities with the Company. In some cases, however, the Company may obtain your personal data from other sources, in which case the Company will proceed as required by the PDPA. Personal data the Company collects from other sources may include but is not limited to the following |
| (h) | When you have made your personal data explicitly public, including by disclosing it through social media, in which case the Company will collect only the personal data you have chosen to make public |
| (i) | Data the Company receives from the companies in the Company's group, business partners and/or any other persons with whom the Company has a legal relationship |
| (j) | Data the Company receives from persons connected with you (such as your family, friends or referrers) |
| (k) | Data the Company receives from business customers, where you are a director, authorised person, representative, delegate or contact person |
| (l) | Data the Company receives from government agencies, the authorities supervising the Company, financial institutions, credit bureau companies and/or external service providers (such as publicly available data, transaction data and credit information); and/or |
| (m) | Data the Company receives from insurance companies and/or any other persons in connection with insurance policies or claims |
Where you provide the personal data of another person to the Company in a transaction with the Company or in any other case, you must inform that person of the details of the collection, use and disclosure of personal data and of the rights under this Privacy Notice.
4. Your legal rights
The PDPA aims to give you greater control over your personal data. You may exercise your rights under the PDPA, as detailed below, through the channels specified by the Company.
- Right to access and obtain a copy of your personal data
You have the right to access and obtain a copy of the personal data the Company holds about you, except where the Company is entitled to refuse your request under the law or a court order, or where your request would adversely affect the rights and freedoms of others.
- Right to rectification of your personal data
You have the right to ask the Company to correct or update your personal data where it is inaccurate, incomplete or out of date.
- Right to erasure of your personal data
You have the right to ask the Company to delete or destroy your data, or to anonymise it so that it can no longer identify you, unless the Company has lawful grounds to refuse your request.
- Right to restrict the use of your personal data
You have the right to ask the Company to restrict the use of your personal data in certain cases (for example, while the Company is verifying your request to rectify your personal data or your objection to the collection, use or disclosure of your personal data, or where you ask the Company to restrict the use of your personal data instead of deleting or destroying personal data that is no longer necessary, because you need the Company to retain your personal data for the establishment, compliance with or exercise of legal claims, or the defence of legal claims).
- Right to object to the collection, use or disclosure of your personal data
You have the right to object to the collection, use or disclosure of your personal data where the Company relies on the legitimate interests basis, or where the purpose is direct marketing or scientific, historical or statistical research, unless the Company has lawful grounds to refuse your request (for example, where the Company can demonstrate that the collection, use or disclosure of your personal data has more compelling legitimate grounds, or is for the establishment, compliance with or exercise of legal claims, or is in the public interest of the Company).
- Right to receive, or to request the sending or transfer of, your personal data
You have the right to receive your personal data where the Company can make that data available in a format that is readable or commonly usable by automated tools or devices and can use or disclose the personal data by automated means. You also have the right to ask the Company to send or transfer your personal data to a third party, or to receive personal data the Company has sent or transferred to a third party, unless this is technically impossible for the Company or the Company has lawful grounds to refuse your request.
- Right to withdraw consent
You have the right to withdraw the consent you have given to the Company at any time, in accordance with the procedures and methods specified by the Company, unless by its nature the consent cannot be withdrawn. Withdrawing your consent will not affect any collection, use or disclosure of your personal data that was lawfully carried out on the basis of your consent before the withdrawal. You may review and change your consent to the use or disclosure of your personal data for marketing purposes through the channels for exercising rights set out in section 11 below, or through other channels the Company may specify in future.
- Right to lodge a complaint
You have the right to lodge a complaint with the Personal Data Protection Committee or the Office of the Personal Data Protection Committee if the Company fails to comply with the PDPA.
5. Disclosure of your personal data
The Company may disclose your personal data to the following persons or organisations, subject to the requirements of the PDPA.
| (a) | Companies in the Company's group, business partners and/or any other persons with whom the Company has a legal relationship, including the directors, executives, employees, staff, contractors, agents and advisers of the Company and/or of such persons |
| (b) | Government agencies and/or the authorities supervising the Company (such as the Bank of Thailand) |
| (c) | Business partners, agents or other organisations (such as independent auditors, securities depositories and document storage providers), where the disclosure of your personal data is for a specific purpose, under a legal basis and with appropriate security measures |
| (d) | The Company and other financial institutions, as well as third parties, where the law requires disclosure to help such persons recover funds mistakenly credited to your account, or to trace the flow of funds where you are the victim of a financial crime |
| (e) | Lawyers, credit bureau companies, anti-fraud agencies, courts, agencies or any persons to whom the Company is required or permitted to disclose personal data under any law, regulation or order |
| (f) | Third parties that provide services to the Company, such as Business Online Public Company Limited |
| (g) | Social media service providers (in a secure manner) or external advertising companies, to display messages to you and others about the Company's products and services; external advertising companies may use your online activity history to deliver advertising that may interest you |
| (h) | Third-party collateral providers |
| (i) | Any other persons who provide benefits or services relating to your products or services (such as insurance companies); and/or |
| (j) | Your attorneys-in-fact, sub-attorneys, agents or legal representatives who are duly authorised by law |
6. Retention period for personal data
The Company will retain your personal data for as long as you are a customer of the Company or have a relationship with the Company, or for as long as necessary to fulfil the relevant purposes set out in this Notice. Once your relationship with the Company ends (for example, after you close all accounts held with the Company, or from the date of your transaction with the Company, or where the Company declines your application for a service, or where you cancel the Company's services), the Company will retain your personal data for the period that is appropriate and necessary for each type of personal data and purpose, as required by the PDPA.
The Company will retain your personal data in accordance with the statute of limitations or the period prescribed by applicable law (for example, anti-money laundering law: 5-10 years from the end of the relationship, as the case may be; the law on counter-terrorism and proliferation of weapons of mass destruction financing; accounting law; tax law; labour law; and other laws the Company must comply with, both in Thailand and abroad). In addition, the Company may need to retain recordings from the closed-circuit television cameras at the Company's head office and branches and/or audio recordings of services provided through the Call Center, in order to prevent fraud, maintain security and investigate suspicious transactions that you or related persons may report to the Company.
The Company will take appropriate steps to delete or destroy personal data, or to anonymise it so that it can no longer identify you, when it is no longer necessary or when the above period ends.
7. Use of personal data for the original purposes
The Company is entitled to continue to collect and use the personal data about you that the Company collected before the date on which the provisions of the PDPA relating to the collection, use and disclosure of personal data came into force, for the original purposes. If you do not wish the Company to continue collecting and using such personal data, you may notify the Company to withdraw your consent at any time.
8. Security
The Company applies internal security measures and strictly enforces its policies to keep your personal data secure, including data encryption and measures to prevent unauthorised access to data. The Company requires its personnel to comply with appropriate personal data protection standards and policies, and to safeguard the data and apply appropriate measures when using, sending or transferring your personal data.
The Company will keep your personal data secure through technical safeguards, administrative safeguards and physical safeguards in order to maintain the confidentiality, integrity and availability of personal data and to prevent unauthorised or unlawful access to, collection, alteration, modification, use and/or disclosure of personal data, as required by applicable law.
The Company has put in place appropriate measures to prevent personal data breaches, including policies, rules and criteria for personal data protection, such as measures controlling access to personal data and the secure and appropriate use of equipment for storing and processing personal data, restrictions on access to personal data, the assignment of user access rights to personal data, the authorisation of designated employees to access data, and user responsibilities, in order to prevent unauthorised access to, disclosure of, learning of or unlawful copying of personal data, or the theft of equipment used to store or process personal data. The Company also maintains audit trail measures for the access, alteration, deletion or transfer of personal data that are appropriate to the methods and tools used to collect, use or disclose personal data, as well as audits to assess the effectiveness of compliance with its personal data protection policies, rules and criteria.
In addition, the executives, employees, staff, contractors, agents, advisers and recipients of data from the Company are obliged to keep personal data confidential in accordance with the confidentiality measures established by the Company.
9. Use of cookies
For the convenience of users accessing its website, the Company may use cookies to verify the accuracy of users' identity data and to collect data and statistics on the use of the website. “Cookies” are small computer files that temporarily store necessary data on the user's computer so that communication is faster and more convenient, and they are effective only while the website is in use. Cookies expire or cease to have effect when the user finishes using the Company's website or data links, or when the user deletes the cookies or takes action to prevent the cookies from working any further.
The Company uses cookies with the security and privacy of users as its primary concern, and stores two types of cookies, namely
1. Cookies that store data, which the Company stores in its service systems for the operation of the website and for use in the Company's business only, and which will not be disclosed or used for any other purpose except as required by law
2. Cookies that store website usage statistics, through which the Company's systems monitor browsing behaviour and the use of data links, such as the date and time of visits to the website, the websites or web pages visited, the type of search and the internet service provider. The Company collects such behavioural data solely for the purposes of improving the website and reaching its target audience
The Company will use the data recorded or collected by cookies for statistical analysis or for other activities of the website or the Company's business, in order to improve the efficiency and quality of the Company's website services.
10. Your obligations
You are responsible for ensuring that the personal data you provide to the Company, whether by yourself or on your behalf, is accurate and up to date, and you must inform the Company as soon as possible if that data changes.
Once you have entered into a contract with the Company, you have a contractual obligation to provide personal data to the Company so that you can exercise your legal rights. Failure to fulfil this obligation may result in the loss of your legal rights.
You are required to provide personal data, such as contact details and payment details, to the Company so that the Company can enter into a contract with you. If you do not provide such personal data, the Company may be unable to exercise its rights and perform its obligations under the contract effectively.
11. How to contact the Company
If you have any questions or would like further details about the Company's Privacy Notice, please contact us through the following channels.
• ThaiAce Capital Co., Ltd.
Head office: 555 Nawamin Road, Khlong Kum, Bueng Kum, Bangkok 10240 (on the main road, between Soi Nawamin 52 and Soi Nawamin 54) Tel: 02-744-2222
• Data Protection Officer (DPO)
By e-mail: dpo@thaiace.co.th, or at the Company's address above
• To exercise your rights under the PDPA
Please contact the Company through the Company's offices or call 02-744-2222 ext. 6415, 6411
12. Changes to this Privacy Notice
The Company may change or amend this Privacy Notice from time to time. The Company will publish the current Privacy Notice on the Company's website at www.tcapital.co.th