Privacy Notice True Leasing Company Limited

Introduction

True Leasing Company Limited (the “Company”), as controller of personal data, realizes the significance of personal data protection, and you, as the Company’s customer, wish to be assured of security of your personal data.  Therefore, the Company has prepared this Privacy Notice to address how the Company has collected, used and disclosed your personal data, as the data subject.  This Privacy Notice is intended to provide details and procedures for personal data management.  The Company may update or revise this Privacy Notice to be in line with its provision of services and legal principles.  Should this Privacy Notice be changed, revised, supplemented or updated, the Company shall post such change, revision, supplement or update on its website.

1. Definitions

“personal data” refers to any information relating to a person who can be identified, directly or indirectly, which is classified as general personal data and/or sensitive personal data;

“general personal data” refers to any information relating to a person who can be identified, directly or indirectly, such as, customer data, news or information relating to any identifier of a person, e.g., first and last names, identification card number, identification card image, age, date of birth, gender, bank account number, credit card number, address, telephone number, e-mail, education, work experience, financial information, credit information, username and password, etc., including such biometric data as facial image, fingerprint, photograph;

“sensitive personal data” refers to any personal data relating to race, nationality, religion, political opinion, criminal records, genetic data, health data, disability, biometric data or any other data which affect the data subject in the same manner as prescribed by the Personal Data Protection Committee;

“controller” refers to True Leasing Company Limited, which shall have the power and authority to make decisions relating to the collection, use or disclosure of personal data;

“processing of personal data” refers to any collection, use and disclosure of personal data.

“Personal Data Protection Act” refers to the Personal Data Protection Act B.E. 2562 (2019) and its amendment.

2. Sources of Personal Data

The Company may obtain your personal data from the following channels:

2.1 The Company directly obtains your personal data when the Company collects your personal data from the procedures for provision of services as follows:

2.2.1 At the step of application for services or submission of a request for exercise of rights with the Company;

2.2.2 From your voluntary completion of a survey or e-mail correspondence or other communication channels between you and the Company;

2.2.3 From the use of services or products relating to services;

2.2.4 From the use of the Company’s website via your browser’s cookies;

2.3.5 From such purchase of goods and services via online channels, e.g., the Company’s website, online platform, booth, promotional activities of the Company.

2.2 The Company obtains your personal data from a third party which is entitled to lawfully disclose your personal data, including the Company’s agent and subcontractor that help the Company to proceed with your application for and the Company’s provision of services to you, whereby such data are collected via e-mail, telephone call or in the form of documents in respect of which the disclosing party is entitled to lawfully provide such personal data.

3. Objectives and Basis of Processing of Personal Data

3.1 Objectives of Processing of Personal Data

The Company processes your personal data for the following objectives:

3.1.1 For the purpose of ensuring that the use of services is smooth and complies with the applicable laws, rules and regulations and to perform its obligations under the applicable laws and regulations currently in force and/or to be revised in the future.

3.1.2 For the purpose of your authentication or identification upon use of the Company’s services, e.g., booking, booking confirmation, review of your previous bookings, data transmission to insurance companies, data transmission to financial service providers, etc.;

3.1.3 For the purpose of enhancing the efficiency and improving the provision of various services, e.g., customer relations service, responses to the requirements, handling of your application for services, etc.;

3.1.4 For the purpose of communication via telephone, SMS, MMS, e-mail, postal service and/or any channels to make inquiries or inform or survey or provide any other news and updates relating to the Company’s services as necessary;

3.1.5 For any other purposes relating to the Company’s business operations, e.g., for study, research, statistics, development of services, analysis of marking plan, marketing activities or related target advertising, including provision of contents, advertisements and public relations, activities and promotions, as well as advice as appropriate to ensure that the services match your interest;

3.1.6 For the purpose of facilitating notifications, delivery of documents and/or payment of service charges, fees relating to goods and services to you;

3.1.7 For execution and/or performance of contracts, including compliance with the conditions of services of the Company;

3.1.8 For after sales service, provision of services per your request, answers to questions, support for use, provision of information, acceptance of complaints and resolution of problems and issues;

3.1.9 For security of the Company’s premises and branches, e.g., incident review from video clips from CCTV;

3.1.10 For recording information, conversation and/or any communication between you and the Company, e.g., e-mails, telephone interviews, etc., for the purpose of development and management of communications and/or provision of the Company’s services;

3.1.11 For settlement of disputes, recovery, debt collection and enforcement;

3.1.12 For safety or suppression of harm to a person’s life, body or health;

3.1.13 For other objectives as empowered by law for collection, use or disclosure without obtaining your consent, as the data subject;

3.1.14 For compliance with the policies within the Company, its group, affiliated companies and businesses;

3.1.15 For provision of services of the Company’s group, affiliated companies and businesses, strategic partners of the Company and/or any other legal entities which the Company is a contractual party or has legal relationship under the law, whether in Thailand or abroad.

Should the Company subsequently change the objectives of its processing of personal data, the Company shall keep you updated via the Company’s website at https://www.trueleasing.co.th

4. Description and Period of Personal Data Storage

4.1 Description of Personal Data Storage

The Company stores personal data in the form of hard copy and/or soft copy by electronic means, with efficient security measures to prevent any loss, unauthorized or undue access to, use, modification, revision or disclosure of personal data.

4.2 Period of Personal Data Storage 

The Company shall keep your personal data only for such period as necessary for the above objectives or during the existence of such contract or legal relationship between you and the Company or within the timeframe for exercise of rights of claim under the law by contractual parties or enforcement of rights under the law or challenge to any rights of claim under the law by the Company.

Upon the lapse of the period of personal data storage or when the Company is no longer entitled or unable to claim the basis of processing of your personal data, the Company shall erase or destroy or render such personal data unidentifiable in respect of the data subject within a reasonable period of time.

5. Contact Channels

You may contact the Company or its Data Protection Officer (DPO) to submit any request regarding your personal data to exercise such available rights via the following channels:

5.1 Information of the Controller

Company :  True Leasing Company Limited

Contact Address     :  18 True Tower,  Ratchadaphisek Road, Huaikhwang,  Bangkok, Thailand, 10310      

Contact Channels    :  Call Center: 1279

Email                  :  Autorentalbytls@wg.co.th

  https://www.trueleasing.co.th

5.2 Information of the Data Protection Officer

Name :  Kamonwan Hundee

Contact Address     :  616  Luang Pang Road, Thapyao, Lat Krabang, Bangkok,    Thailand, 10210 

Contact Channels :  Telephone: 02 859 7975

Call Center           :  1279

Email                  :  dpotrueleasing@wg.co.th

             https://www.trueleasing.co.th

6. Rights of Data Subjects

The Company may collect, store, use, distribute or take any other arrangements relating to your personal data on the legal basis of processing of personal data under the Personal Data Protection, pursuant to which you shall have the rights to take the following arrangements:

6.1 Right to withdraw consent

You are entitled to withdraw your consent which has been given to the Company in the processing of personal data at any time during the period your personal data remains in the Company’s possession.

The Company hereby informs you that any incomplete personal data or withholding of consent to the processing of personal data may restrict your rights to use certain services of the Company or may render the Company unable to provide any services to you should such personal data be necessary for the Company’s provision of services to you.

6.2 Right of access to personal data

You are entitled to access and request a copy of your personal data which are under the Company’s responsibility, and also request the Company to disclose how your personal data have been obtained without consent to the processing of personal data.

6.3 Right to rectification of personal data

You are entitled to request the Company to rectify or add your personal data to be correct, up-to-date, complete and not misleading.

6.4 Right to erasure and destruction of personal data

You are entitled to request the Company to erase or destroy your personal data kept by the Company or render such personal data unidentifiable in respect of the data subject, in any of the following events:

(a) You withdraw your consent or object to the collection, use or disclosure of personal data relating to you;

(b) When it is no longer necessary to collect, use or disclose personal data according to the objectives to which you have given consent;

(c) When the Company fails to comply with the applicable laws on personal data protection.

6.5 Right to suspension of use of personal data

You are entitled to request the Company to temporarily suspend the use of your personal data should the Company be in the course of fact-finding or review of your objection.  In addition, should you be entitled to request the Company to erase or destroy your personal data, you may request the Company to suspend the use of your personal data instead of erasure or destruction.

6.6 Right to data portability

You are entitled to request to obtain or request the Company to send or transfer your personal data to another controller or at the request of other authorities.

6.7 Right to object to processing of personal data

You are entitled to object to the storage, use, collection, and disclosure of personal data relating to you should such personal data collected by the Company with the exemption from the data subject’s consent are necessary for lawful or legitimate interests or such personal data are collected, used or disclosed for direct marketing or research.

6.8 Right to complain

In the event where the Company or its staff breach or fail to comply with the Personal Data Protection or any notifications issued by virtue of this Act.  In this connection, you may file a complaint with the Office of the Personal Data Protection Committee.

The Company shall collect, use and disclose personal data of a minor, incompetent person and/or quasi-incompetent person only upon receipt of consent from the legal representative, guardian or curator (as the case maybe).  The Company has the intention to collect, use and disclose personal data from the foregoing persons without consent as prescribed by law.  The Company shall erase such personal data, except where the Company is legally entitled to proceed with such collection, use and disclosure. 

7. Categories of persons or agencies to whom the collected personal data may be disclosed

The Company may disclose such collected personal data to any persons, legal entities and agencies as listed below.

7.1 Companies in the group, affiliated companies and businesses;

7.2 Service providers of the Company:  The Company may disclose your personal data to any service providers of the Company, provided that such service providers shall use your personal data only to the extent permitted by the Company only on a need-to-know basis:

-Professional consultants, e.g., financial advisors, legal consultants;

-Basic infrastructure and information technology service providers;

-Data storage service providers, including cloud service providers;

-Marketing service providers, including data and statistical service providers;

-Advertising, public relations and communications service providers;

-Service providers relating to payment networks and systems;

-Payment agencies;

-Financial institutions whose services are used by the Company to provide services to you;

-Data verification service providers;

This includes any other legal entities which the Company is a contractual party or has legal relationship under the law, whether in Thailand or abroad, and such persons or legal entities may be located in any country where the personal data protection standards may not be sufficient, although the Company shall ensure that such persons or legal entities have a secured data storage system;

7.3 Strategic partners of the Company with strategic partnership arrangements with the Company;

7.4 Assignees of rights and/or obligations from the Company;

Should the Company wish to assign its rights and obligations, including partial or entire business, business merger, its shareholding restructuring, it is necessary for the Company to disclose your personal data to the assignees (including potential assignees);

7.5 Persons or agencies as prescribed by law;

This is required by the applicable laws, rules and regulations, as well as orders of government agencies, regulatory bodies or court orders.

8. Collection and Use of Personal Data in the Form of Cookies

The Company may access personal data in respect of your interest and/or preference and/or your use of website by using cookies on the Company’s website and applications, so as to enable the Company to offer services in response to your requirements as much as possible.  Such personal data shall be kept in the form of cookies.  In order for the Company to send or show any news and information regarding services or offers from the Company to you on the website, it is necessary for the Company to keep and use such data relating to your visit to the website.  Such data shall be kept in the form of cookies, which are a small element of data sent by the website to your browser and recorded in your computer and/or communication devices, e.g., tablet, smartphone, etc.  Upon your next visit to the Company’s website, these cookies will enable the Company to properly manage your preference in order to facilitate your return to visit the Company to be more convenient.  Furthermore, cookies are also used to measure online traffic, change the contents in accordance with your past and current usage or for the purpose of advertising and public relations.  However, you may change your browser settings to disable the Company’s use of cookies.  In this regard, you may read more details regarding cookies at http://allaboutcookies.org/.

The Company may contact with any third party advertising networks which collect IP addresses and other data by using cookies to keep records of the operations of the web server, and such third parties may use such data for advertising products and services in line with your interest (including advertising for other companies not related to the Company), and as such, you may see these advertisements on any other websites.  These procedures help the Company manage and monitor its marketing achievements.  However, you may choose not to accept data in those advertising networks through their respective network systems.

9. Privacy Notices of Other Websites

This Privacy Notice applies only to the services and use of the Company’s website.  Should you visit any other website, even via any link available on the Company’s website, you should read and comply with the privacy notice of that website separately from the Company.  In this respect, the Company shall not be responsible for any contents of such website or treatment of personal data by such website.

10. Security of Personal Data

The Company realizes the significance of security of your personal data, and as such, arranges for appropriate security measures for personal data in line with confidentiality of personal data, and restricts access to your personal data by the Company’s unconcerned staff, employees and agents to prevent any loss, unauthorized or unlawful access thereto, destruction, use, modification, revision or disclosure thereof.