PRIVACY POLICY
BEN TECH CHEMICAL CO., LTD. (the “Company”) recognizes the importance of privacy and the protection of personal data. The Company has established appropriate governance and management of personal data in compliance with applicable personal data protection laws and other relevant laws. Therefore, the Company hereby provides the following information to you in compliance with the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”), with the key details as follows:
1. Personal Data
1.1 Definition of Personal Data
Personal Data means any information relating to a natural person that enables the identification of such person, whether directly or indirectly, excluding the personal data of a deceased person in particular.
Sensitive Personal Data means personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disabilities, trade union information, genetic data, biometric data (such as fingerprint scanning and facial recognition), or any other data which may affect the data subject in a similar manner, as prescribed by the Personal Data Protection Committee.
1.2 Personal Data Collected
The types of personal data collected by the Company in accordance with applicable laws include the following:
Personal Information: First name, last name, gender, date of birth, marital status, national identification number, passport number, other identification numbers, including personal information appearing on government-issued documents used for identity verification, taxpayer identification number, nationality, photographs appearing in passports, driver’s licenses, signatures, identification and authentication information, information obtained by banks from you in response to the Company’s identity verification questions (such as passwords, answers used when you forget your password, PINs, facial and voice recognition information, etc.), photographs, and CCTV footage.
Family Information: Names and contact information of family members, including spouse and children.
Contact Information: Address, telephone number, email address, and profile details through social media.
Education Information: Details of your education and qualifications.
Financial Information: Billing address, bank account information, credit card number, cardholder name or account details, transaction records, transaction instructions, and details of contracting parties.
Transaction Information: Name and surname of beneficiaries, address, and other details, including communications relating to bank transfers and relevant transactions.
Electronic Information: IP address, cookies, activity logs, identification information, online identifiers, unique device identifiers, and geolocation information.
CCTV and Geolocation Information: Information indicating the location of withdrawals or payments for security purposes, or information used to identify the location of nearby bank branches or service providers.
Sensitive Personal Data: Personal data specifically prescribed by law, including information relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disabilities, trade union information, genetic data, biometric data, or any other information which may affect you in a similar manner, as prescribed by the Personal Data Protection Committee.
2. Collection of Personal Data
When collecting personal data directly from the data subject, and when using or disclosing such personal data, the Company will obtain consent from the data subject before or at the time of collection where consent is required by law. The Company will process personal data only to the extent necessary for the clearly specified purposes communicated by the Company.
The Company collects various types of personal data. The types of personal data collected depend on each particular circumstance and the nature of the products, services, and/or transactions requested by you.
The Company collects your personal data from various sources, including:
When you purchase products and/or apply for or use the Company’s services;
Telephone conversations between you and the Company or its branch offices, including recorded telephone conversations, emails, text messages, or other forms of communication;
When you visit the Company’s website or use the Company’s mobile applications, including through cookies and other internet technologies used to collect personal data. For further information, please refer to the Company’s Cookie Policy;
Information obtained from insurance claims, policy documents, or other documents;
Financial reviews and explanations;
Customer surveys;
When you participate in promotional activities organized by the Company;
When you have clearly made your personal data publicly available, including information disclosed through social media. In such cases, the Company will collect only the personal data that you have chosen to make publicly available;
When the Company receives your personal data from third parties, such as your employer, the Company’s customers, credit information agencies, authorized government officials, or other government agencies.
The Company may also collect personal data from sources other than the data subject directly, including additional online and offline sources and commercially available information from third-party sources, such as publicly available media, only where necessary and in accordance with applicable laws. The Company may combine such information with your personal data collected under this Privacy Notice.
In certain circumstances, the Company may engage third parties that are not members of the Company’s group to collect information regarding your online activities when you visit the Company’s online resources. In addition, the Company may use personal data collected from websites that are not operated by companies within the Company’s group for advertising purposes related to your browsing behavior. If the Company carries out such activities, the Company will provide appropriate notice and offer suitable options enabling you to opt out of such collection.
3. Purposes of Collecting, Using, and Disclosing Personal Data
The Company collects, uses, and discloses your personal data for the following purposes:
To facilitate the provision or sale of products and the provision or receipt of various types of services;
To conduct financial and tax transactions related to the Company’s contractual obligations;
For research and studies;
To establish databases for analyzing and presenting services or products offered by the Company, companies within the Company’s group, or persons who are distributors, agents, or otherwise associated with the Company;
To improve the quality of the Company’s operations, services, and business-related activities;
To analyze and monitor the use of the Company’s website services and for retrospective investigation in the event of technical or operational issues;
To facilitate participation in various activities organized by the Company;
To verify or authenticate identity;
For access control, prevention and mitigation of risks to the life, body, or health of you or other persons, control and prevention of communicable diseases, and for maintaining the security and safety of the Company’s buildings, premises, and areas;
To comply with laws or regulations applicable to the Company, both currently and in the future.
The Company may collect, use, and/or disclose your personal data only where the Company has an appropriate legal basis for doing so, including disclosure to third parties.
The Company will rely on at least one of the following legal bases for collecting, using, and/or disclosing personal data:
Performance of a Contract: Where the processing is necessary for the performance of an agreement between the Company and you, such as where the Company requires your personal data to provide services to you under a contract or prior to entering into a contract with you;
Legal Obligation: Where the Company is required to collect, use, and/or disclose your personal data to comply with applicable laws or legal obligations;
Legitimate Interests: Where the Company collects, uses, and/or discloses your personal data for the Company’s legitimate interests as permitted by law, except where such legitimate interests are outweighed by your fundamental rights and/or freedoms; and/or
Consent: Where you have provided consent to the Company to collect, use, and/or disclose your personal data for a specific purpose.
The personal data collected by the Company for the above purposes may be necessary for the performance of a contract or compliance with applicable laws. If you do not provide such necessary personal data, you may be in breach of applicable legal requirements, or the Company may be unable to administer or manage the contract or facilitate certain processes for you.
If the purposes for collecting personal data are subsequently changed, the Company will notify you and take any other actions required by law, including maintaining records of such amendments as evidence.
Unless otherwise specified in this Privacy Notice, the Company will not use your personal data for purposes other than those specified herein. If the Company intends to collect, use, and/or disclose additional personal data for purposes not specified in this Privacy Notice, the Company will notify you and obtain your consent before such collection, use, and/or disclosure, except where the Company is legally permitted to do so without obtaining your consent. You have the right to provide or refuse consent to the collection, use, and/or disclosure of your personal data.
4. Disclosure of Personal Data
The Company may disclose your personal data to other persons where permitted by law, including in the following circumstances where the Company or such other person:
Is required to perform obligations under a contract relating to products or services (for example, to process payment requests);
Has a legal obligation to do so (for example, to investigate and prevent fraud, tax evasion, financial crime, or money laundering);
Is required to make legal reports, initiate or defend legal proceedings, exercise legal rights, or protect legal claims;
Acts for the Company’s legitimate interests (for example, for risk management, identity verification, enabling other companies to provide services requested by you, or assessing your suitability for products and/or services); and/or
Has obtained your consent to disclose such information.
The Company may disclose your personal data for the above purposes to the following parties:
Other companies within the Company’s group and contractors, agents, or service providers working for or providing services to the Company or other companies within the Company’s group, including their employees, subcontractors, service providers, directors, and officers, as well as the Company’s business partners;
Persons appointed to manage or administer assets or benefits, official receivers, or execution officers;
Guarantors or persons providing other forms of security in respect of amounts you are liable to pay to the Company;
Any person to whom you make payments and/or from whom you receive payments;
Agents, the Company’s representatives, finance departments, payment systems, business partners, and other companies through which you make investments;
Other financial institutions, lenders, security holders, Revenue Department officials, trade associations, credit information agencies, payment service providers, and debt collection agents;
Fund managers providing asset management services to you and brokers who refer you to the Company;
Any person or company involved in a corporate restructuring, merger, or acquisition that has occurred or may occur, including the transfer of any rights or obligations of the Company under a contract between the Company and you;
Law enforcement authorities, government agencies, courts, judicial proceedings, dispute resolution bodies, regulators of the Company, auditors, and any persons appointed or requested by the Company’s regulators to audit the Company’s operations;
Any other person involved in any dispute that may arise, including disputes relating to transactions;
Anti-fraud agencies that use such information to investigate and prevent fraud and other financial crimes and to verify your identity;
Any person authorized to give instructions or manage your account, products, or services on your behalf (such as an authorized representative or attorney);
Any person to whom you have instructed the Company to disclose your personal data; and/or
Other relevant parties for marketing purposes.
5. Retention of Personal Data
The Company will retain your personal data only for as long as necessary to fulfill the purposes for which such data was collected, including purposes relating to legal reporting, providing requested services, or complying with applicable laws.
Personal data will be stored in documentary and/or electronic form and kept in locations with restricted access, such as servers or cloud storage provided by the Company’s service providers.
The Company will retain your personal data for a period of 10 years after you cease to be a customer of the Company. This is to protect the Company’s interests in relation to any contractual disputes that may arise during such period. However, where supported by legal or technical reasons, the Company may retain your personal data for longer than 10 years. Once the Company no longer has a legitimate need to retain your personal data, the Company will destroy, delete, or anonymize such data so that it can no longer be linked to or identify you.
6. Minors, Incompetent Persons, and Quasi-Incompetent Persons
The Company will not collect personal data from minors, incompetent persons, or quasi-incompetent persons until consent has been obtained from the person exercising parental power, guardian, or curator, as applicable, in accordance with the conditions prescribed by law.
If the Company was previously unaware that the data subject was a minor, incompetent person, or quasi-incompetent person and subsequently discovers that the Company has collected such personal data without the consent of the person exercising parental power, guardian, or curator, as applicable, the Company will promptly delete or destroy such personal data unless there is another lawful basis permitting the Company to collect, use, or disclose such data.
7. Security Measures
The Company has established appropriate and stringent security measures in accordance with its information technology security policies and practices to prevent the loss, unauthorized access, destruction, use, alteration, modification, or unauthorized or unlawful use of personal data.
8. Your Rights as a Data Subject
As the data subject, you have rights under the Personal Data Protection Act B.E. 2562 (2019), including the following rights:
8.1 Right to Withdraw Consent
You have the right to withdraw your consent to the processing of personal data that you have provided to the Company, except where the withdrawal of consent is subject to limitations under applicable laws or a contract that provides benefits to you as the data subject.
The withdrawal of consent will not affect the processing of personal data for which you previously provided lawful consent.
8.2 Right to Access Personal Data
You have the right to request access to and obtain a copy of your personal data held under the Company’s responsibility, including requesting information regarding the source of such data where you did not provide consent to the Company.
8.3 Right to Data Portability
You have the right to request the Company to transfer your personal data that you have provided to the Company, subject to the conditions prescribed by law.
8.4 Right to Object to the Collection, Use, or Disclosure of Personal Data
You have the right to object to the processing of your personal data, including the collection, use, or disclosure of such data, subject to the conditions prescribed by law.
8.5 Right to Erasure
You have the right to request the Company to delete or destroy your personal data or anonymize such data in accordance with the conditions prescribed by law.
8.6 Right to Restrict the Use of Personal Data
You have the right to request the Company to restrict the use of your personal data in accordance with the conditions prescribed by law.
8.7 Right to Rectification
If you believe that the personal data held by the Company is inaccurate, or if your personal data has changed, you have the right to request the Company to correct your personal data so that it is accurate, up to date, complete, and not misleading.
8.8 Right to Be Informed of Amendments to This Privacy Notice
The Company may periodically review and amend this Privacy Notice as appropriate to ensure that your personal data continues to receive appropriate protection.
8.9 Right to Lodge a Complaint
You have the right to lodge a complaint with the competent authority under the Personal Data Protection Act B.E. 2562 (2019) if the Company violates or fails to comply with the requirements of the Act.
Where a data subject submits a request to exercise any rights under the Personal Data Protection Act B.E. 2562 (2019), the Company will process such request within the period prescribed by law. However, the Company reserves the right to refuse or decline to act upon such request where permitted or required by law.
Where the data subject chooses to provide only certain personal data, this may affect the Company’s ability to provide services to the data subject in full. The Company may also be unable to work with or provide certain services to the data subject if the data subject refuses to provide personal data required by the Company.
9. Cookies Policy
The Company collects and uses cookies and similar technologies on websites under the Company’s management or on the devices of data subjects. This is done for security purposes in providing the Company’s services and to provide users with convenience and a positive experience when using the Company’s services.
Such information may be used to improve the Company’s website and make it better suited to your needs. You may configure or delete cookies through the settings of your web browser.
For further details regarding the Company’s Cookie Policy, please refer to the Company’s Cookie Policy.
10. Your Responsibilities
You are responsible for ensuring that the personal data you provide to the Company, whether provided by you personally or on your behalf, is accurate and up to date. You are also responsible for promptly notifying the Company if such information changes.
Once you enter into a contract with the Company, you may be required under the contract to provide personal data to the Company so that you can exercise your legal rights. Failure to comply with such obligations may result in the loss of certain legal rights.
You may be required to provide personal data, such as contact information and payment information, to the Company so that the Company can enter into a contract with you. If you fail to provide such personal data, the Company may be unable to exercise its rights or effectively perform its obligations arising from the contract.
11. International Transfer of Personal Data
The Company may need to transfer customers’ personal data to other countries. Where the Company is required to transfer personal data internationally, the Company will do so only where one of the following conditions is satisfied:
The destination country has been determined by the Personal Data Protection Committee to have adequate personal data protection standards;
The overseas organization receiving the data is subject to personal data protection policies that have been reviewed and certified by the Office of the Personal Data Protection Commission;
Where the destination country does not have adequate personal data protection standards, the Company will ensure that the transfer is carried out in accordance with applicable laws and will implement appropriate and necessary safeguards consistent with confidentiality standards, such as entering into an agreement with the recipient in the destination country to ensure that your personal data is protected under standards equivalent to those applicable in Thailand;
The transfer is necessary for the exercise of legal rights;
You have provided consent after being informed of the inadequate personal data protection standards of the destination country or international organization receiving your personal data;
The transfer is necessary for the performance of a contract to which you are a party or for taking steps at your request prior to entering into such contract;
The transfer is necessary for the performance of a contract between the Company and another person or legal entity for your benefit;
The transfer is necessary to prevent or suppress a danger to the life, body, or health of a person where such person is unable to provide consent at that time; or
The transfer is necessary for the performance of an important task carried out in the public interest.
12. Amendments to This Privacy Notice
The Company will regularly review this Privacy Notice. Accordingly, this Privacy Notice may be amended from time to time. The latest version and the date of the most recent amendment will be indicated at the top of this Privacy Notice.
