Business Partner Privacy Policy

Kasemsubsiri Co., Ltd.  (the “Company”, “we“, “us” or “our“) commits to safeguard your Personal Data (as defined below). This Business Partner Privacy Policy (“Privacy Policy“) describes how we collect, use, disclose, and/or transfer to others, including any transfer outside of Thailand, Personal Data of employees, personnel, authorized persons, directors, shareholders and other contact persons (“you” or “your“) of our business partners (e.g. suppliers, vendors, service providers and outsourcers) (each a “Business Partner“), and tells you about data protection rights.  

Your Personal Data is collected, used, disclosed, and/or transferred outside of Thailand by us because we have an existing or potential business relationship with you or the Business Partner you work for, act for or represent. For example, our Business Partner provides products or services to us, or work together with us to provide our customers products or services, or otherwise communicates with us in relation to any business.

“Personal Data” means any identified or identifiable information about you as listed below. In order to offer you with our products and services, we may collect Personal Data directly or indirectly from you or other sources (e.g. publicly available information) or through our parent company, affiliates, subsidiaries, business partners, official authorities, or third parties. The specific type of data collected will depend on the context of your interactions with us, and the services or products you need or want from us and within Kasemsubsiri Group including One Bangkok Group and Frasers Property Management Services (Thailand) Co., Ltd.

The following are example of Personal Data that may be collected:

1. Personal details, such as title, full name, gender, age, nationality, date of birth, job title, position, workplace, work history, information on government-issued cards, issuing and expiry date (e.g., national identification number, passport number), information on house registration, work permit, license plate number, photograph, signature, company certificate, employee ID, approval details, username and password;
2. Contact details, such as postal address, telephone number, location data, email address, LINE ID, WhatsApp ID, WeChat ID, Facebook account, Twitter account, Messenger account, QR code;
3. Financial details, such as income, salary, bank account details (e.g., bank account number, bank name, branch, account type), credit/debit card number, financial statement, payment term and other financial related information;
4. Technical details, such as Internet Protocol (IP) address, Mac address;
5. Other information collected, used and/or disclosed in connection with the relationship between us and the Business Partner, such as, information you give us in contracts, forms or surveys
6. Others person information, such as name of parents

“Sensitive Data” means Personal Data classified by law as sensitive data. We will only collect, use, and disclose Sensitive Data, and transfer it across borders, if we have received your explicit consent or as permitted by law.

We will also collect, use, disclose and/or cross-border transfer the following Sensitive Data about you:

• Sensitive data, such as sensitive data as shown in the identification document (e.g., religion, racial or ethnic origin), cult, philosophical beliefs, genetic data (e.g. an individual’s gene sequence), biometric data (e.g. fingerprints, facial recognition, retinal scans), health data, criminal records

If you provide Personal Data of any third party to us, e.g. their name and telephone number for emergency contact, please provide this Privacy Policy for their acknowledgement and/or obtaining consents where applicable. 

2.1. The purpose of which you have given your consent:

We rely on your consent to collect, use, disclose and/or cross-border transfer your Sensitive Data for the following purposes:

• Sensitive data as shown in the identification document (e.g., religion, racial or ethnic origin): for verification and authentication purpose;
• Religion: for preparation of religion activities;
• Genetic data (e.g. an individual’s gene sequence): for verification and authentication purpose
• Biometric data (e.g. fingerprints, facial recognition, retinal scans): for verification and authentication purpose, and for security purpose;
• Health data: for preparation of food and beverage;
• Criminal records: for security purpose.

Where legal basis is consent, you have the right to withdraw consent at any time. This can be done so, by contacting Kasemsubsiri Co., Ltd. The withdrawal of consent will not affect the lawfulness of the collection, use and disclosure of your Personal Data and Sensitive Data based on your consent before it was withdrawn.

2.2. The purposes we may rely on and other legal grounds for processing your Personal Data

Depending on the nature of our relationship with you, we collect, use and/or disclose your Personal Data for the following purposes, on the legal basis of legitimate interests, entering into or performance of contract, legal compliance, consent, or any other basis as permitted by applicable laws, as the case may be:

1. Business purposes: such as, to proceed with the transaction made by Business Partner, and perform any obligations and/or request made by Business Partners; to communicate with the Business Partner about products, services and projects of us or Business Partner (e.g., by responding to inquiries or requests);
2. Business Partner selection: such as, to verify your identity and Business Partner status, to conduct background checks and screening on you and the Business Partner; to evaluate suitability and qualifications of you and the Business Partner, to issue request for quotation and bidding; to execute contract, purchase order or purchase requisition with you or the Business Partner;
3. Relationship management: such as, to update your personal data and maintain data accuracy; to maintain contracts, associated documents, agreement references and evidences of work of Business Partner in which you may be referred to, to plan, perform, and manage the (contractual) relationship with the Business Partner (e.g., by performing transactions and orders of products or services, processing payments, issuing invoice, arranging shipments and deliveries); to handling with your request or complain, to provide update, support services and keep tracks and records;
4. Business analysis and improvement: such as, to conduct research, data analytics, assessments, surveys and evaluation, reports on our products, services and your or the Business Partner’s performance;
5. Registration and Authentication: such as, to register, verify, identify, and authenticate you or your identity;
6. IT systems and support: such as, to maintain our IT operations, management of communication system, operation of IT security and IT security audit; and to maintain internal business management for internal compliance requirements, policies, and procedures as well as risk management and fraud prevention;
7. Dispute handling, such as, to solve disputes, enforce our contracts, establish, and exercise or defense of legal claims;
8. Any investigation, complaints and/or crime or fraud prevention;
9. Compliance with internal policies and applicable laws, regulations, directives and regulatory guidelines;
10. Liaising and interacting with and responding to government authorities or courts or tribunals;
11. Life: to prevent or suppress danger to a person’s life, body, or health.

Where we need to collect your Personal Data as required by law, or for entering into or performing the contract we have with you or Business Partner and you fail to provide that data when requested, we may not be able to fulfill the relevant purposes as listed above.

We will only collect, use, and/or disclose sensitive data on the basis of your explicit consent or where permitted by law. 

We may disclose or transfer your Personal Data to the following third parties who collects, uses and discloses Personal Data in accordance with the purpose under this Policy. These third parties may be located in Thailand and areas outside Thailand. You can visit their privacy policy to learn more details on how they collect, use and disclose your Personal Data as you are also subject to their privacy policies.

3.1. Kasemsubsiri Group‘s data ecosystem

As Kasemsubsiri Co., Ltd. is part of a Frasers Group, TCCA Group, OBC Group, GOLD Group, TCC Tech Group which all collaborate and partially share customer services and systems including website-related services and systems, we may need to transfer your Personal Data to, or otherwise allow access to such Personal Data by other companies within Frasers Group, TCCA Group, OBC Group, GOLD Group, TCC Tech Group for the purposes set out in this Privacy Policy. This will allow other companies within Frasers Group, TCCA Group, OBC Group, GOLD Group, TCC Tech Group to rely on consent obtained by Kasemsubsiri Co., Ltd. Please see list of companies and scope of activities within Frasers Group, TCCA Group, OBC Group, GOLD Group, TCC Tech Group ‘s data ecosystem.

3.2. Our service providers

We may use other companies, agents or contractors to perform services on behalf of or to assist with the business relationship with you. We may share Personal Data including, but not limited to (1) computer program developer, software developer, IT service providers and IT support company; (2) marketing, advertising media, designer, creative, and communications agencies; (3) campaign, event, and market organizers, and CRM agency; (4) data storage and cloud service providers; (5) property management service provider; (6) sale agencies; (7) logistic and courier service providers; (8) payment and payment system service providers; (9) research agencies; (10) analytics service providers; (11) survey agencies; (12) call center; (13) telecommunications and communication service providers; (14) outsourced administrative service providers; (15) printing service providers.

In the course of managing our business relationship, the service providers may have access to your Personal Data. However, we will only provide our service providers with the information that is necessary for them to perform the services, and we ask them not to use your information for any other purposes. We will ensure that all the service providers we work with will keep your Personal Data secure.

3.3. Our business partners

We may transfer your Personal Data to our Business Partner to conduct business and services provided that the receiving Business Partner agrees to treat your Personal Data in a manner consistent with this Privacy Policy, such as financial institution partner, access solution company, telecommunication company, sponsors, co-branded partners and other third parties that we conduct joint marketing and cross promotion with.

3.4. Third parties required by law

In certain circumstances, we may be required to disclose or share your Personal Data in order to comply with a legal or regulatory obligations. This includes any law enforcement agency, court, regulator, government authority or other third party where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights, the rights of any third party or individuals’ personal safety, or to detect, prevent, or otherwise address fraud, security or safety issues.

3.5. Professional advisors

The professional advisors include but not limit to (i) legal consultants who assist in running our business and provide litigation services for the defending or bringing of any legal claims, (ii) auditor who provide accounting and audit service to us.

3.6. Assignee of rights and/or obligations

Third parties as our assignee, in the event of any reorganization, merger, business transfer, whether in whole or in part, sale, purchase, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock or similar transaction; will comply with this Privacy Policy to respect your Personal Data.

We keep your Personal Data only for so long as we need the Personal Data to fulfil the purposes we collected it for, and to satisfy our business and/or our legal and regulatory obligations. How long we keep your Personal Data depends on the nature of the data. Some information may be retained for longer, where we are required to do so by law.

Subject to applicable laws and exceptions thereof, you may have the following rights to:

1. Access: You may have the right to access or request a copy of the Personal Data we are collecting, using and disclosing about you. For your own privacy and security, we may require you to prove your identity before providing the requested information to you.
2. Rectification: You may have the right to have incomplete, inaccurate, misleading, or not up-to-date Personal Data that we collect, use, disclose and/or transfer (domestic and/or cross border) about you rectified.
3. Data Portability: You may have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to send or transfer such data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are processing such data on the basis of your consent or to perform a contract with you.
4. Objection: You may have the right to object to certain collection, use and disclosure of your Personal Data such as objecting to direct marketing.
5. Restriction: You may have the right to restrict the use of your Personal Data in certain circumstances.
6. Withdraw Consent: For the purposes you have consented to our collecting, using and disclosing of your Personal Data, you have the right to withdraw your consent at any time.
7. Deletion: You may have the right to request that we delete or de-identity Personal Data that we collect, use, disclose and/or transfer (domestic and/or cross border) about you, except we are not obligated to do so if we need to retain such data in order to comply with a legal obligation or to establish, exercise, or defend legal claims.
8. Lodge a complaint: You may have the right to lodge a complaint to the competent authority where you believe our collection, use and disclosure of your Personal Data is unlawful or noncompliant with applicable data protection law.