Thonburi Phanich

Introduction

Thonburi Phanich Co., Ltd. (referred to as “Thonburi Group” or “we” in this policy) recognizes the importance of your personal data and other related information (collectively referred to as “data”). To ensure that you have confidence in Thonburi Group’s transparency and responsibility in collecting, using, or disclosing your data, this policy has been established to comply with the Personal Data Protection Act B.E. 2562 (“Personal Data Protection Law”) and other relevant laws. This Privacy Policy (“Policy”) is designed to explain in detail the collection, use, and disclosure (collectively referred to as “processing”) of personal data by Thonburi Group, including its officers and individuals who act on behalf of or represent Thonburi Group, as outlined below.

Scope of the Policy

This Policy applies to the personal data of individuals currently or potentially related to Thonburi Group, whose personal data is processed by Thonburi Group, its officers, contracted employees, business units, or other entities operating under Thonburi Group, as well as contractors or third parties processing personal data on behalf of Thonburi Group (“personal data processors”) under various products and services, such as websites, systems, applications, documents, or other services managed by Thonburi Group (collectively referred to as “services”).

Individuals who have relationships with Thonburi Group, as mentioned above, include:

Individual customers
Officers, employees, and workers
Individual partners and service providers
Directors, authorized persons, representatives, agents, shareholders, employees, or others in similar relationships with legal entities associated with Thonburi Group
Users of Thonburi Group’s products or services
Visitors or users of the thonburi.com website, including systems, applications, devices, or other communication channels managed by Thonburi Group
Other individuals whose personal data is collected by Thonburi Group, such as job applicants, family members of officers, guarantors, beneficiaries of insurance policies, etc.

Items 1 to 6 are collectively referred to as “you.”

In addition to this Policy, Thonburi Group may provide specific “privacy notices” (“Notices”) for certain products or services to inform data subjects who are service users about the personal data being processed, the legal basis for processing, the retention period of personal data, and the rights of data subjects in relation to those specific products or services.

In the event of a significant conflict between the content of a privacy notice and this Policy, the terms of the specific privacy notice for that service will prevail.

Definitions

Thonburi Group refers to Thonburi Phanich Co., Ltd. and its affiliated companies.
Personal Data refers to information about an individual that allows for the identification of that person, whether directly or indirectly, but does not include information about deceased individuals.
Sensitive Personal Data refers to personal data as defined in Section 26 of the Personal Data Protection Act B.E. 2562, which includes data on race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disability, union membership, genetic information, biometric data, or any other data that similarly impacts the data subject as prescribed by the Personal Data Protection Committee.
Processing of Personal Data refers to any operation performed on personal data, such as collection, recording, copying, organizing, storage, updating, modifying, use, retrieval, disclosure, transfer, dissemination, merging, deletion, destruction, etc.
Data Subject refers to an individual who is the owner of the personal data collected, used, or disclosed by Thonburi Group.
Data Controller refers to a person or legal entity with the authority and duty to make decisions regarding the collection, use, or disclosure of personal data.
Data Processor refers to a person or legal entity that processes personal data on behalf of or under the direction of the Data Controller. The Data Processor does not have the authority to control the data.

Sources of Personal Data Collected by Thonburi Group

Thonburi Group collects personal data from various sources, including:

Personal data provided directly by the data subject through various service channels, such as application processes, registration, job applications, contracts, surveys, or the use of products, services, or other service channels managed by Thonburi Group, or when the data subject communicates with Thonburi Group at its premises or through other contact channels managed by Thonburi Group.
Data collected from the use of Thonburi Group’s websites, products, or services under a contract or mandate, such as tracking website usage behavior, products, or services using cookies or software on the data subject’s devices.
Personal data collected from sources other than the data subject, where such sources have the legal authority, reasons, or consent from the data subject to disclose the data to Thonburi Group, such as linking digital services of government agencies to provide public services to the data subject, or receiving personal data from other government agencies as part of Thonburi Group’s mandate to operate a central data exchange center to support government services to the public through digital systems.

Additionally, if you provide personal data of third parties to Thonburi Group, you are responsible for informing those individuals of the details of this Policy or the relevant product or service notice, as applicable, and obtaining their consent if necessary for the disclosure of their data to Thonburi Group.

Refusal to provide necessary personal data for Thonburi Group’s services may result in Thonburi Group being unable to provide all or part of those services to the data subject.

Legal Basis for the Collection of Personal Data

Thonburi Group will determine the appropriate legal basis for collecting your personal data, considering the context of the service provided.

If Thonburi Group needs to collect your personal data to perform a contract, comply with legal obligations, or enter into a contract, refusal to provide the data or opposition to processing activities may result in Thonburi Group being unable to carry out or provide the requested services in whole or in part.

Types of Personal Data Collected by Thonburi Group

Thonburi Group may collect or receive the following types of personal data, depending on the services you use or the context of your relationship with Thonburi Group. The types of data listed below represent a general framework for personal data collection by Thonburi Group. However, only data relevant to the products or services you use or have a relationship with will apply.

Personal Identification Information: Data that identifies you, such as titles, names, surnames, nicknames, signatures, ID card numbers, nationality, driver’s license numbers, house registration information, etc.

Contact Information: Information used to contact you, such as home phone numbers, mobile phone numbers, fax numbers, email addresses, postal addresses, social media usernames (Line ID, MS Teams), and residence locations, etc.

Cookies

Thonburi Group collects and uses cookies and similar technologies on its websites or on your devices, depending on the service you use, to ensure the security of Thonburi Group’s services and to provide you, the user, with a convenient and optimal experience when using Thonburi Group’s services. This data may be used to improve Thonburi Group’s websites to better meet your needs. You can set or delete cookies yourself from the settings in your web browser.

Purposes for Collecting Personal Data

Thonburi Group collects your personal data for various purposes, depending on the type of products or services you use, the nature of your relationship with Thonburi Group, or other relevant considerations. The purposes outlined below represent a general framework for Thonburi Group’s use of personal data. Only the purposes related to the products or services you use or have a relationship with will apply to your data.

To perform public tasks assigned to Thonburi Group or necessary for exercising Thonburi Group’s legal powers as stipulated in the Royal Decree Establishing the Digital Government Development Agency (Public Organization) B.E. 2561 and related laws, regulations, or orders.
To provide and manage Thonburi Group’s services, whether under a contract with you or Thonburi Group’s mandate.
To conduct Thonburi Group’s transactions.
To manage, monitor, and facilitate services that align with your needs.
To store and update your information, including documents referencing you.
To maintain records of personal data processing as required by law.
To analyze data, resolve issues related to Thonburi Group’s services.
To manage internal organization matters, including recruitment, board member or position appointments, and qualification assessments.
To prevent, detect, avoid, and investigate fraud, security breaches, or prohibited or illegal activities that could harm both Thonburi Group and data subjects.
To verify identity, prove identity, and verify information when you apply for Thonburi Group’s services, contact for services, or exercise legal rights.
To improve and update the quality of products and services.
To evaluate and manage risks.
To send notifications, confirm orders, communicate, and provide updates to you.
To create and deliver relevant and necessary documents or information.
To verify identity, prevent spam, or unauthorized or illegal actions.
To assess how data subjects access and use Thonburi Group’s services, both in aggregate and individually, for research and analysis purposes.
To comply with legal duties towards regulatory authorities, tax authorities, law enforcement agencies, or Thonburi Group’s legal obligations.
To conduct necessary actions for the legitimate interests

Types of Individuals to Whom Thonburi Group May Disclose Your Personal Data

For the purposes stated in Section 9, Thonburi Group may disclose your personal data to the following individuals. The types of data recipients listed below represent a general framework for Thonburi Group’s disclosure of personal data. Only the data recipients relevant to the products or services you use or have a relationship with will apply.

Our Affiliated Companies: Including but not limited to the following:

Thonburi Phanich Co., Ltd.

Thonburi Automotive Assembly Plant Co., Ltd.

Thonburi Energy Storage Manufacturing Co., Ltd.

Our Service Providers: We may engage companies, agents, or contractors to provide services on our behalf or assist in our business relationships with you. We may disclose your personal data, including but not limited to (1) infrastructure developers, software developers, website developers, and IT service providers, (2) payment service providers, (3) research agents, (4) data analytics service providers, (5) survey agents, (6) marketing, advertising, and communication agents, (7) transportation service providers, (8) external management service providers, (9) data storage and cloud service providers, (10) customer service centers, (11) insurance service providers, and (12) commercial banks. During our business relationships, service providers may need access to your personal data. However, we will only provide our service providers with the data necessary to perform their services, and no service provider is permitted to use your data for any purpose other than what is stated in this Privacy Policy.

Mercedes-Benz (Thailand) and Other Distributors: As an authorized vehicle distributor for Mercedes-Benz, we may disclose your personal data related to reservations, payments, interests, warranties, after-sales services, and maintenance through the dealer management system, warranty system, and other centralized systems.

Third Parties as Required by Law: In certain circumstances, we may be required to disclose your personal data to comply with legal obligations, including to law enforcement agencies, courts, regulators, government agencies, or other third parties when we believe it is necessary to fulfill legal obligations or to protect our interests or rights.

Advisors: This includes lawyers, technical experts, financial advisors, auditors, who assist in our business operations and disputes or legal proceedings.

Thai Hire Purchase Business Association: We may transfer your personal data to the Thai Hire Purchase Business Association.

Business Transfers: We may choose to buy or sell assets, and customer data may be disclosed or transferred as part of evaluating or executing such transactions. Additionally, if we (or our assets) are merged or acquired, or if we are unable to continue our business, become bankrupt, or undergo a change in control, personal data may be one of the assets transferred or handed over to a third party.

We will not sell, distribute, or lease your personal data to third parties unless we have your permission or as required by law.

We may use your personal data to send you direct marketing information related to us and/or third parties that we believe may interest you.

Transfer of Personal Data to Foreign Countries

In some cases, Thonburi Group may need to transfer your personal data to foreign countries to fulfill the purposes of providing services to you, such as transferring personal data to cloud systems with platforms or servers located abroad (e.g., Singapore, the United States, etc.) to support IT systems outside of Thailand. This depends on the services you use or are involved in with Thonburi Group.

However, at the time of preparing this policy, the Personal Data Protection Committee has not issued a list of destination countries with adequate personal data protection standards. Therefore, when Thonburi Group needs to transfer your personal data to a destination country, Thonburi Group will take steps to ensure that the personal data transferred has adequate protection measures according to international standards or will comply with conditions to allow the transfer as required by law, such as:

Compliance with laws requiring Thonburi Group to transfer personal data abroad.
Notifying you and obtaining your consent in cases where the destination country has inadequate personal data protection standards, according to the list of countries determined by the Personal Data Protection Committee.
Necessary for performing a contract to which you are a party with Thonburi Group or to take steps at your request before entering into the contract.
Necessary for Thonburi Group’s contract with other individuals or legal entities for your benefit.
Necessary to prevent or mitigate danger to your life, body, or health or that of others when you cannot give consent at the time.
Necessary to carry out a mission for the important public interest.

Retention Period of Your Personal Data

Thonburi Group will retain your personal data only for as long as it is necessary to fulfill the purposes for which the data was collected, as detailed in the policy, notices, or as required by relevant laws. Once the retention period expires, or your personal data is no longer necessary for the stated purposes, Thonburi Group will delete, destroy, or anonymize your personal data according to the data deletion and destruction standards to be announced by the Committee or as per international standards. However, in cases of disputes, the exercise of rights, or legal proceedings related to your personal data, Thonburi Group reserves the right to retain the data until the dispute is resolved or a final order or judgment is issued.

Services by Third Parties or Subcontractors

Thonburi Group may assign or subcontract third parties (personal data processors) to process personal data on behalf of or in the name of Thonburi Group. These third parties may offer services such as hosting, outsourcing, or cloud computing services/providers, or other forms of subcontracting.

When assigning third parties to process personal data as personal data processors, Thonburi Group will establish agreements specifying the rights and duties of Thonburi Group as the Data Controller and the third party as the Data Processor. This includes detailing the type of personal data assigned for processing, the purpose, and scope of processing, and other relevant agreements. The Data Processor is responsible for processing the personal data within the scope specified in the agreement and according to Thonburi Group’s instructions, without processing the data for other purposes.

If the Data Processor assigns a subcontractor (sub-processor) to process personal data on behalf of the Data Processor, Thonburi Group will require the Data Processor to establish an agreement with the sub-processor that meets or exceeds the standards of the agreement between Thonburi Group and the Data Processor.

Security of Personal Data

Thonburi Group has measures in place to protect personal data by restricting access to personal data to specific officers or individuals with the authority, duty, or assignment to use the data for the purposes previously informed to the data subject. These individuals must adhere strictly to Thonburi Group’s personal data protection measures and are responsible for maintaining the confidentiality of personal data they have access to during the performance of their duties. Thonburi Group maintains both organizational and technical security measures that meet international standards and comply with the requirements set by the Personal Data Protection Committee.

Additionally, when Thonburi Group transfers, discloses, or shares personal data with third parties, whether for the purpose of providing services according to its mission, contract, or other agreements, Thonburi Group will implement appropriate security measures and confidentiality standards as required by law to ensure that the personal data collected by Thonburi Group remains secure at all times.

Linking to External Websites or Services

Thonburi Group’s services may link to third-party websites or services, which may have different privacy policies from this Policy. Thonburi Group recommends that you review the privacy policies of such websites or services to understand the details before using them. Thonburi Group is not affiliated with and has no control over the personal data protection measures of these third-party websites or services and cannot be held responsible for the content, policies, damages, or actions arising from the use of these third-party websites or services.

Data Protection Officer

Thonburi Group has appointed a Data Protection Officer to monitor, supervise, and advise on the collection, use, or disclosure of personal data, as well as to coordinate and cooperate with the Office of the Personal Data Protection Committee to ensure compliance with the Personal Data Protection Act B.E. 2562.

Your Rights Under the Personal Data Protection Act B.E. 2562

The Personal Data Protection Act B.E. 2562 grants several rights to data subjects. These rights will take effect when the relevant legal provisions come into force. The details of these rights include:

Right to Access Personal Data: You have the right to request access to, obtain a copy of, and ask for the disclosure of the source of your personal data that Thonburi Group has collected without your consent, except where Thonburi Group has the legal right to deny your request, such as by law or court order, or where exercising your rights may adversely affect the rights and freedoms of others.
Right to Rectify Personal Data: You have the right to request the correction, completion, and updating of your personal data if you find that your personal data is incorrect, incomplete, or outdated.
Right to Erasure or Destruction of Personal Data: You have the right to request that Thonburi Group erase or destroy your personal data or anonymize your data, provided that the exercise of this right is subject to legal conditions.
Right to Restrict Processing: You have the right to request the restriction of the use of your personal data under the following circumstances:
While Thonburi Group is verifying the accuracy, completeness, and currency of your personal data as requested by you.
When your personal data has been unlawfully collected, used, or disclosed.
When your personal data is no longer necessary for the purposes for which it was collected by Thonburi Group, but you request that Thonburi Group retain it for legal purposes.
While Thonburi Group is determining the legality of the processing of your personal data or the necessity of retaining, using, or disclosing your data for public interest, resulting from your exercise of the right to object to the collection, use, or disclosure of your personal data.
Right to Object to Processing: You have the right to object to the collection, use, or disclosure of your personal data unless Thonburi Group can demonstrate that there are legitimate grounds for processing that override your objections, such as legal obligations, the establishment of legal claims, the exercise or defense of legal claims, or for public interest.
Right to Withdraw Consent: If you have given consent to Thonburi Group to collect, use, or disclose your personal data (whether the consent was given before or after the Personal Data Protection Act B.E. 2562 came into force), you have the right to withdraw your consent at any time during the retention period of your personal data by Thonburi Group, except where there are legal limitations that require Thonburi Group to continue retaining the data or where a contract between you and Thonburi Group provides benefits to you.
Right to Data Portability: You have the right to request that Thonburi Group transfer your personal data to you or another Data Controller in a commonly readable or usable format, provided that this right is subject to legal conditions.

Consequences of Non-Compliance with the Privacy Policy

Failure to comply with this Policy may result in disciplinary action under Thonburi Group’s regulations (for officers or employees of Thonburi Group) or under the Data Processing Agreement (for personal data processors), depending on your relationship with Thonburi Group. You may also be subject to penalties under the Personal Data Protection Act B.E. 2562, including related laws, regulations, and orders.

Filing a Complaint with a Supervisory Authority

If you believe that Thonburi Group has not complied with the Personal Data Protection Law, you have the right to file a complaint with the Personal Data Protection Committee or the supervisory authority appointed by the Personal Data Protection Committee or as provided by law. Before filing such a complaint, Thonburi Group encourages you to contact us first to allow Thonburi Group to understand the facts, clarify issues, and address your concerns at the earliest opportunity.

Amendments to the Privacy Policy

Thonburi Group may consider updating, amending, or modifying this Policy as appropriate, and will notify you through the website www.thonburi.com, with the effective date of each revised version specified. Thonburi Group recommends that you regularly review the updated Policy through the application or specific activity channels managed by Thonburi Group, especially before disclosing personal data to Thonburi Group.

Continued use of Thonburi Group’s products or services after the effective date of the updated Policy constitutes your acknowledgment and agreement to the terms of the new Policy. If you disagree with the details of this Policy, please stop using the services and contact Thonburi Group for further clarification.

Inquiries or Exercising Your Rights

If you have any questions, suggestions, or concerns about Thonburi Group’s collection, use, and disclosure of your personal data, or about this Policy, or if you wish to exercise your rights under the Personal Data Protection Law, you can contact us at:

By phone: +66 2-405-8818

By mail: Address to: 84/1, 4th Floor, Viriyaphan Building, Charan Sanitwong Road, Bang Phlat Subdistrict,

Bang Phlat District, Bangkok 10700, Thailand.