1. Personal data that the Company collects, uses, and/or discloses
1.1 Personal Data is data that can directly or indirectly identify you, i.e.
1.1.1 Personal data that you give directly to or through the Company, or available to the Company by your use of products and/or services, contact, visit, search via digital channels, branches, website, assigned persons or other means.
1.1.2 Personal data received or accessed by the Company from other sources not directly from you. For example, government entities, companies in travel industry, airlines, business partners, and information service provider, etc. The Company will collect data from other sources only when your consent is given as consistent with laws unless where necessary for the Company as permissible under laws.
Your personal data that the Company collects, uses and/or disclose are such as
– Personal information such as name, surname, age, date of birth, marital status, national identification number, passport number;
– Contact information such as home address, workplace, telephone number, E-mail, LINE account ID;
– Financial information such as saving account numbers, balance, bank/financial statements, credit card details;
– International travel information such as travel dates, period of stay at destination countries, type of visas;
– Data related to devices or machines such as IP address, MAC address, Cookie ID; and
– Other information such as website-visiting data, voice, still picture, moving picture, and other information deemed personal data under the Personal Data Protection Laws
1.2 Sensitive Data is personal data that is specially categorized by law and will be collected, used and/or disclosed by the Company only when the Company has obtained explicit consent from you or where necessary for the Company as permissible under law. The Company may collect, use and/or disclose Sensitive Data, e.g., data concerning health, disability, biometric, religion
(Unless otherwise specified in this Policy, personal data and sensitive data about you above will be collectively called “Personal Data”)
2. Purposes of collecting, using and/or disclosing your Personal data
The Company will collect your Personal Data for your benefits in using products and/or services; for performing legal obligations required by any law applicable to Company or you; and for any purposes provided in this Policy, as follows;
2.1 For your benefits in using the Company’s products and/or services that meet your own purposes and for other purposes necessary under laws
2.1.1 To allow you to use the Company’s products and/or services that meet your purposes under your contract with the Company or to take steps at your request prior to using the Company’s products and/or services for instance,
(1) to booking accommodations, booking/reserve seats with airlines, issue exchange orders for admission tickets/transportation passes, issue admission tickets/transportation passes, apply visa; and/or
(2) to take any steps in relation to the providing of any products and/or services, e.g. processing, contact, notification, outsource, right and/or duty assignment, notification of debt payment, and debt collection.
2.1.2 To comply with relevant or applicable law (Legal Obligation), for instance,
(1) to comply with an order from a competent authority; and/or
(2) to comply with Embassy and Consulate Law and/or Regulation, Air Navigation Law, Life Insurance Law, Non-life Insurance Law, Tax Law, Anti-money Laundering Law, Counter-Terrorism and Proliferation of Weapon of Mass Destruction Financing Law, Computer Law, Bankruptcy Law, and other laws to which the Company is subject both in Thailand and in other countries including regulations and rules issued pursuant to such laws.
If the company is required to collect, use and/or disclose your Personal Data to meet our legal obligations or enter into an agreement with you, the company may not be able to provide (or continue to provide) our products and/or services to you if the company cannot collect your Personal Data when requested.
2.1.3 To take necessary steps for the Company’s legitimate interests or other individual or juristic person which are not overriding your reasonable expectations (Legitimate Interest), for instance,
(1) to record voice conversation with call center or images from CCTV;
(2) to maintain relationship with customers, e.g. complaint handling, satisfaction survey, customer service by the Company’s staff, notification or offer on any products and/or services of the same types you are using for your benefits;
(3) to manage risks, monitor, manage within organization including to refer such tasks to affiliated companies in the conglomerate;
(4) to anonymize your Personal Data (Anonymous Data);
(5) to prevent, respond, and minimize potential risks arising from corruption, cyber threat, including sharing Personal Data to enhance work standards of affiliated companies/other companies in the same business in order to prevent, respond, and minimize the above risks;
(6) to collect, use and/or disclose the Personal Data of directors, representatives, agents of customers that are juristic person;
(7) to contact, voice or image recording during meetings, trainings, seminars or booth activities;
(8) to collect, use, and/or disclose the Personal Data of person under court’s receivership order; and
(9) to receive – dispatch documents and/or parcels.
2.2 To enable you to receive benefits from using products and/or services according to your given consent, for instance,
(1) For you to receive products and/or services that are better and suitable for your need;
(2) For you to receive offers, privileges, recommendations and other information including eligibility to attend special activities;
Regardless of being products and/or services, privileges, promotions, information or special activities of the Company, companies in conglomerate, or person of whom the Company is an agent, agent, and business partner or a third party associated with the Company, depending on your given consent.
3. Disclose your Personal Data
The Company may disclose your Personal Data to other person to the extent permissible under your consent or law. The persons or entities receiving such data will collect, use, and/or disclose the Personal Data to the extent permissible under your consent or related to this Policy
The Company may disclose your Personal Data for various purposes, e.g. providing services to you; analyzing and developing products and/or services, conducting research or analyzing statistical data; promoting sales and advertising by the Company; managing organization; preventing corruption; allowing the Company’s supporting service providers; verifying customers’ identity, etc. The Company may disclose the data to other persons or entities. For example, companies in conglomerate, the Personal Data processors, business partners launching products with the Company (Co-branding), external service providers, the Company’s agents, sub-contractors, auditors, external auditors, competent authority, prospective assignees and/or assignees in any transaction or business merger of the Company, any corporations or individuals under relationship or contract with the Company; including executives, staffs, employees, contractors, agents, the Company’s advisor and of those person or entity who receive the data, etc.
4. Send or transfer your Personal Data to other countries
The Company may send or transfer your Personal Data to affiliated companies/companies in the same business located in other countries or to other receivers in ordinary course of the Company’s business, e.g. sending or transferring the Personal Data to be stored on server/cloud in other countries.
If the receiving countries do not maintain adequate standard levels, the Company will ensure that the sending and the transferring are in compliance with legal requirements and will put in place the Personal Data protection measures as necessary, appropriate and in consistent with confidentiality measures. For example, entering into confidentiality agreement with receivers in such country; or in case of affiliated companies/companies in the same business being the receivers, setting out the Personal Data policy that is audited and certified by competent authorities under relevant law and controlling the sending and transferring to comply with such policy instead of legal requirements.
5. Retain your Personal Data
The Company will retain your Personal Data for as long as necessary or for as long as necessary in connection with the purposes set out in this Policy.
The Company may erase or destroy the Personal Data, or make the Personal Data become the anonymous data when it is no longer necessary or when the period lapses.
6. Protection of Personal Data
The Company will take good retain of your Personal Data to ensure appropriate security in the Personal Data processing and preventing Personal Data breach. The Company has set out policies, rules and regulations on Personal Data protection, e.g. security standards of information technology and measures to prevent data receivers from using or disclosing the data outside the purposes or without authorization or unlawfully. The Company has amended the policy, rule and regulation as frequently as necessary and appropriate.
Moreover, the Company’s executives, staffs, employees, contractors, agents, advisers and data receivers are obligated to keep the Personal Data in confidence pursuant to confidentiality measure provided by the Company.
7. Rights of the Data Subject
Your rights described here are legal rights that you should be informed. You may exercise any of these rights within legal requirements and policies at the present or as amended in the future as well as regulation set out by the Company. In the event that you are a minor who is not sui juris by marriage or has no capacity as a sui juris person by law, the consent of the holder of parental responsibility over the child is required to exercise the rights.
7.1 Withdrawal of consent: If you have given consent to the Company to collect, use and/or disclose your Personal Data (whether before or after the effective date of the Personal Data Protection law), you have the right to withdraw such consent at any time throughout the period your Personal Data available to Company, unless it is restricted by laws or you are still under beneficial contract.
Withdrawal of your consent may affect your use of products and/or services. For example, you may not receive privileges, promotions or new offers, products and/or services that are enhanced and consistent with your needs, or not receive beneficial information, etc. For your benefits, you are advised to learn and ask for consequences before withdrawing your consent.
7.2 Data Access: You have the right to request access to and obtain copy of the Personal Data related to you, which is under the Company’s responsibility or to request the disclosure of acquisition of the Personal Data obtained without your consent.
7.3 Data Received: You have the right to receive your Personal Data from the Company. The Company shall arrange such Personal Data to be in the format which is readable or commonly used by ways of automatic tools or equipment, and can be used or disclosed by automated means. You are also have rights to:
7.3.1 request the Company to send or transfer the Personal Data in such formats to other Data Controllers if it can be done by the automatic means;
7.3.2 request to directly obtain the Personal Data in such formats that the the Company sends or transfers to other Data Controllers, unless it is impossible to do so because of the technical circumstances.
Your Personal Data above must be under your consent given to the Company to collect, use, and/or disclose; or those the Company deems necessary to collect, use and/or disclose to allow you to use products and/or services that meet your need under your contract with the Company; or to take steps at your requests before using products and/or services; or as legally required by competent authority.
7.4 Objection: You have the right to object to collection, use and/or disclosure of your Personal Data at any time, in the following circumstances:
7.4.1 Where the Personal Data is collected with the exemption to consent requirements for the conduct of a task carried out in the public interest by the Company, or the exercising of official authority vested in the Company, or it is necessary for legitimate interests of the Company or any other persons or juristic persons other than the Company, except where such interests are overridden by the fundamental rights of your Personal Data, unless the Company can prove that the collection, use and/or disclosure of your Personal Data can be demonstrated by the company that there is a compelling legitimate ground, or for establishment, compliance or exercise of legal claims, or defense of legal claims;
7.4.2 The collection, use, and/or disclosure of such Personal Data is for the purpose of direct marketing;
7.4.3 The collection, use, and/or disclosure of the Personal Data for the purpose of scientific, historical or statistic research, unless it is necessary to performance of a task carried out for reasons of public interest by the Company.
7.5 Data Erasure or Destruction: You have the right to request the Company to erase, destroy or anonymize your Personal Data. In case the collection, use and/or disclosure of your Personal Data is against relevant laws; or retention of the data by the Company is no longer necessary in connection with related purposes under this Policy; or when you request to withdraw your consent or to object to the processing as earlier described.
7.6 Data Suspension: You have the right to request the Company to suspend processing your Personal Data during the period where the Company examines your rectification or objection request; or when it is no longer necessary and the Company must erase or destroy your Personal Data pursuant to relevant laws but you instead request the company to suspend the processing.
7.7 Data Rectification: You have the right to rectify your Personal Data to be updated, complete and not misleading.
7.8 Complaint: You have right to complain to competent authorities pursuant to relevant laws if you believe that the collection, use and/or disclosure of your Personal Data is violating or not in compliance with relevant laws.
7.9 The exercise of rights above may be restricted under relevant laws and it may be necessary for the Company to deny or not be able to carry out your requests, e.g. to comply with laws or court orders, public tasks, your request in breach of rights or freedom of other persons, etc. If the Company denies the request, the Company will inform you of the reason.
8. Contact the Company and the Data Protection Officer
If you have any inquiries regarding collection, usage and/or disclosure of your Personal Data as well as a request to exercise your rights under this Policy, you may contact the Company and/or the Data Protection Officer via the following channel:
- JTB (Thailand) Limited (Head office), 54 Harindhorn Building, 9th Floor, Room 9C, 9D,9E and 9I, North Sathon Road, Silom Sub-district, Bangrak District, Bangkok, 10500
- Data Protection Officer: E-mail email@example.com