Cathay Leasing Privacy Policy

Privacy Policy

Cathay Leasing Co., Ltd. (“the Company”) recognizes the importance of protecting the personal data of data subjects (“you”). The Company has therefore adopted this Privacy Policy (“the Policy”) to set out the principles and guidelines governing the Company’s collection, use, and/or disclosure of personal data (“processing”), as well as your rights as a data subject under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

1. Categories of Personal Data Processed by the Company

The Company processes your personal data for the purposes described in this Policy. In this Policy, Personal Data means any information relating to an individual that enables the identification of that individual, whether directly or indirectly, but does not include information relating to deceased persons. Personal Data may be categorized as follows:

1.1 General Personal Data

1. Personal details, such as name, surname, gender, age, date of birth, nationality, national identification number, passport number, marital status, and photographs.
2. Contact information, such as address, telephone number, and email address.
3. Financial information, such as bank account number.
4. Device information, such as IP address, cookies, and Closed-Circuit Television (CCTV) footage.

1.2 Sensitive Personal Data refers to personal data under Section 26 of the PDPA, such as race, health data, religious beliefs, and biometric data. For the purposes of this Policy, Personal Data includes both General Personal Data and Sensitive Personal Data.

2. Collection of Personal Data

In general, the Company collects your personal data directly from you through your interactions with the Company. In some cases, however, the Company may receive your personal data from other sources, including:

1. Personal data received from companies within the Group.
2. Personal data received from business partners.
3. Personal data received from individuals related to you, such as family members, referrers, or contacts who have informed or demonstrated to the Company that they are authorized to provide your personal data to the Company for processing under this Policy.

3. Purpose of Collection, Use, and/or Disclosure of Personal Data

The Company collects, uses, and/or discloses your personal data to perform activities within the scope and purposes as follows:

3.1 If you are a Customer of the Company:

1. To enter into and perform a contract agreed with the Company.
2. To provide services to you according to the contract.
3. To process payments under the contract between you and the Company.
4. To offer news, offers, benefits, and promotions of the Company.
5. For marketing and data analysis purposes.
6. To maintain security within the Company, such as CCTV recording.
7. To resolve disputes or conflicts that may arise between you and the Company related to service provision.
8. To comply with the PDPA or other laws relevant to the aforementioned purposes.

3.2 If you are a Vendor or Service Provider of the Company:

1. To enter into and perform a contract or service agreement agreed with the Company.
2. To perform obligations under the contract.
3. To process payments and communication.
4. To resolve disputes or conflicts that may arise between you and the Company related to contract performance.
5. To comply with the PDPA or other laws relevant to the aforementioned purposes.

3.3 If you are an Employee of the Company:

1. For personnel recruitment and internship processes.
2. To perform employment contracts between you and the Company, such as salary payment.
3. To comply with laws applicable to the Company as an employer, including laws and requirements relating to labor protection, the Social Security Fund, the Workmen’s Compensation Fund, and the Revenue Department.
4. To maintain security within the Company, such as CCTV recording.
5. To resolve disputes or conflicts that may arise between you and the Company related to contract performance.
6. To comply with the PDPA or other laws relevant to the aforementioned purposes.

The Company relies on the following legal bases when processing your personal data. Depending on the relevant purpose, the Company may rely on one or more of these legal bases:

1. Contractual Basis: The Company has a duty to process your personal data to enter into a contract with you or to perform obligations under a contract with you. In the event that you do not provide any personal data to the Company for the specified purposes, the Company may be unable to enter into or perform said contract.
2. Legitimate Interest Basis: The Company may need to process your personal data for the legitimate interests of the Company or others. Such legitimate interests shall not override your fundamental rights and freedoms.
3. Consent Basis: The Company may need to obtain your explicit consent to process Sensitive Personal Data and/or for any other purpose where other legal bases cannot be applied.
4. Legal Obligation Basis: The Company may need to process your personal data to comply with legal requirements.

4. Disclosure of Personal Data

The Company may be required to disclose your personal data to third parties for processing purposes. Such persons or entities may include, but are not limited to:

4.1 Companies within the Group.

4.2 Business partners.

4.3 Government agencies and regulatory bodies, such as the Revenue Department.

4.4 External service providers, such as IT service providers and data analysis service providers.

4.5 Consultants and auditors.

4.6 Financial institutions, such as banks providing payment services.

5. International Transfer of Personal Data

For the purposes specified in this Privacy Policy, the Company may disclose or transfer your personal data to individuals, organizations, or servers located outside Thailand, where personal data protection standards may or may not be equivalent to those of Thailand. The Company will implement appropriate measures to ensure that your personal data is transferred securely, that the recipient applies appropriate personal data protection standards, and that the transfer complies with the requirements of the PDPA.

6. Personal Data Retention Period

The Company will retain your personal data for as long as necessary to achieve the purposes described in this Policy. However, the Company may be required to retain your personal data for a longer period if required by applicable law. The Company will delete, destroy, or anonymize your personal data when it is no longer necessary or upon the expiration of the applicable retention period.

7. Rights of the Data Subject

When the PDPA provisions regarding the rights of data subjects are in effect, you have the following rights, subject to the criteria and conditions prescribed by the PDPA:

1. Right to withdraw consent: In cases where the Company has obtained your consent to process personal data, you have the right to withdraw such consent at any time by sending a notice of withdrawal to the Company.
2. Right of access: You have the right to request access to and obtain a copy of all personal data relating to you, including requesting disclosure of the acquisition of personal data for which you did not provide consent.
3. Right to data portability: You have the right to request the Company to send or transfer your personal data to another person.
4. Right to object: You have the right to object to the processing of your personal data that the Company processes under its legitimate interests. Additionally, you have the right to object to the processing of your personal data if the Company processes it for marketing purposes and profiling.
5. Right to erasure: You have the right to request the deletion or destruction of your personal data, or to make it anonymous, unless the Company has legal grounds to refuse your request.
6. Right to restriction of processing: You may have the right to request that the Company restrict the processing of your personal data in the following cases:
   • In cases where it is under the process of verification as you have requested to exercise your right to rectify your personal data.
   • In cases concerning personal data that you have previously requested the Company to delete, but you subsequently requested that the Company restrict the processing of your personal data instead.
   • In cases where the personal data processing period has expired, but you have requested the Company to restrict the processing due to legal reasons.
   • In cases where it is under the process of verification regarding an objection to the processing of personal data.
7. Right to rectification: You have the right to request that your personal data be corrected to be accurate, current, complete, and not misleading.
8. Right to lodge a complaint: You have the right to lodge a complaint with the Company, relevant government agencies, and the Personal Data Protection Committee. You may exercise these rights by notifying the Company through the channels and methods specified by the Company. The Company reserves the right to consider and process your request in accordance with the requirements of the PDPA.

8. Security of Personal Data

The Company implements security measures for personal data, including both Organizational Measures and Technical Measures, based on the principles of Confidentiality, Integrity, and Availability, to prevent loss, unauthorized access, use, alteration, or disclosure. Furthermore, the Company will implement security measures covering Administrative Safeguards, Technical Safeguards, and Physical Safeguards regarding Access Control. The Company restricts access to your personal data, permitting only individuals who have a necessity to access such data to perform their duties. In the event that a third party processes your personal data, such processing must be in accordance with the Company’s instructions as specified in a Data Processing Agreement between the data controller and the data processor.

9. Personal Data Breach

In the event of a breach of your personal data, the Company will notify the Office of the Personal Data Protection Committee without delay, within 72 hours of becoming aware of the incident. In cases where the breach poses a high risk to your rights and freedoms, the Company will notify you of the breach along with remedial measures without delay through various channels.

10. Handling of Personal Data in Specific Cases

10.1 Customers and Vendors or Service Providers

If you are a customer, vendor, or service provider to the Company, the Company may request that you notify the Company of any corrections to your personal data to ensure it remains accurate, current, and complete.

10.2 Employees of the Company

If you are an employee of the Company working in connection with personal data, the Company requires you to:

1. Strictly comply with and prioritize compliance with the PDPA and this Policy. Failure by an employee to comply with the PDPA or this Policy constitutes a serious breach of duty, which may result in disciplinary action according to the Company’s procedures and may lead to liability and penalties as prescribed by law.
2. Attend personal data protection training according to the scheduled training, and when notified to attend, you must prioritize and cooperate strictly in such training.
3. Not disclose personal data of data subjects that you have learned or obtained due to your work to others, unless otherwise required by law.
4. Report any personal data breach to your supervisor to jointly investigate the facts of the incident and inform relevant authorities immediately upon discovering the breach, to further notify the Office of the Personal Data Protection Committee within the time prescribed by the PDPA.

11. Policy Amendment

The Company may amend this Policy from time to time. Any amended terms and conditions of this Policy will be communicated through the Company’s communication channels as the Company deems appropriate.

12. Company Contact Details

If you have any suggestions or inquiries regarding the collection, use, and/or disclosure of your personal data, or if you wish to exercise your legal rights, you may contact the Company at dpo@cathayleasing.co.th.

This Policy is effective from June 1, 2022 onwards.