Customer Personal Data Protection Policy
Jaspal Company Limited and its Affiliates
As Jaspal Company Limited and its Affiliates (collectively referred to as the “Company”) recognize the importance of the protection of personal data which you have provided or will provide, therefore, the Company has prepared this Personal Data Protection Policy for your understanding and acknowledgement of the procedures of the Company in relation to the collection, use, and disclosure of your personal data subject to the Personal Data Protection Act B.E. 2562 (2019).
Scope of the Policy
This Policy covers the personal data which the Company has obtained or collected from your visit to the Company’s stores, purchase of goods and services, membership application, making suggestions, comments, or complaints, completing surveys or questionnaires or performing any activities as required via the Company’s websites, mobile phone applications, social media channels, and stores of the Company. This Policy does not cover your use of websites, mobile phone applications, and/or social media channels of third parties which can connect to the website, mobile phone applications and/or social media channels of the Company and stores which are not managed and supervised by the Company. For these reasons, the Company advises you to read this Personal Data Protection Policy in order to understand and acknowledge the methods, procedures, and purposes of the Company in relation to the collection, use, and disclosure of your personal data.
“Company” Jaspal Company Limited and its affiliates, e.g. Jaspal & Sons Company Limited.
“Personal Data” Any information relating to a Person, which enables or may enable the identification of this Person, whether directly or indirectly, but not including the information of a deceased Person.
Personal Data includes, but is not limited to, name, surname, age, gender, nationality, date of birth, national identification number, passport number, taxpayer identification number, address, telephone number, and e-mail address.
“Data Subject” A person whose personal data is collected. This term refers to “you” as a customer in this Policy.
“Person” A natural person. Any legal entities incorporated under any laws, including but not limited to, companies, associations, foundations, or other organizations, are excluded.
“Company’s Website” Websites of the Company and its affiliates.
“Company’s Store” Any stores under the management or supervision of Jaspal Company Limited and its affiliates.
Collection of Your Personal Data by the Company
During your access to or use of the Company’s Websites, mobile phone applications, social media channels, e-mail, phone calls and/or visits to the Company’s Stores, the Company may be required to collect or obtain Personal Data which may enable the identification of a Person, as follows:
- Personal data, including but not limited to, titles, name, surname, date of birth, age, national identification number, passport number, taxpayer identification number, nationality, etc.
- Contact information, including but not limited to, telephone number, postal address for delivery of goods, billing address, e-mail address, social media account, etc.
- Financial information, including but not limited to, debit and/or credit card information.
- Sale and purchase of goods and services transaction information, including but not limited to, receipt/refund of money information, date of payment, time of payment, amount of payment, purchase or purchase order number, date/time of receipt or delivery of goods, a Person’s message regarding the acceptance of goods, goods warranty information, complaints and claims, and other information in relation to the purchase of goods and services.
- Membership information, including but not limited to, membership account information, membership card number, reward points, membership type, date of membership application, period of membership, and other information in relation to membership.
- Behavioral information, including but not limited to, behavioral information in relation to the purchase of goods and services and feedback regarding services of the Company.
- Sensitive data, including but not limited to, data pertaining to race, ethnicity, religion, fingerprints, facial recognition, health data or data related to physical or mental conditions, genetic data, medical history, disability, and criminal records.
The Company will strictly collect Personal Data only to the extent necessary subject to the purposes specified in Clause 4 of this Personal Data Protection Policy.
For the collection, use, or disclosure of your personal data, the Company will make a written request for explicit consent or a request via electronic means prior to or during the collection of the Personal Data. A Person has the right not to consent and provide such data however, deciding not to consent or withdraw any consent, may result in the Company being unable to render services to you.
For the collection of data of any minor, quasi-incompetent person or incompetent person, the Company will collect the foregoing Personal Data only if the Company obtains consent from a parental guardian, curator or custodian of said minor or individual. If it is explicitly known by the Company, the Company will not collect Personal Data from any Person whose age is below twenty (20) or who is a quasi-incompetent or an incompetent person unless consent is obtained from a parental guardian, curator or custodian of said minor or individual in the event that consent must be obtained. If the Company is aware that it has unintentionally collected Personal Data from any person below the age of twenty (20), or who is a quasi-incompetent or incompetent, without obtaining consent from a parental guardian, curator or custodian, the Company will promptly delete such Personal Data or process only that part of the Personal Data which the Company is entitled to process based on any legal basis other than the request of consent.
The Personal Data given to the Company by a Person must be correct, complete, and true and will not cause any confusion. A Person must keep his/her Personal Data up-to-date and inform the Company of any changes via the contact channel specified in Clause 11. If you decide not to provide the Company with your Personal Data or if you choose to withdraw consent for the use of your Personal Data, it may result in the Company no longer being able to render services to you.
Purposes of the Collection, Use, and Disclosure of Personal Data
The Company collects Personal Data for the following purposes:
- The communication and providing necessary information of the Company in relation to goods, updated lists of goods, lists of promotions or campaigns arranged or to be arranged by the Company, and any privileges for your benefits. The provision of information will be conducted via e-mail, SMS, or any appropriate method to which you have consented.
- The provision of any privileges, including but not limited to, privileges on birthdays and/or in birth months, and reward points privileges which can be redeemed for discounts or premiums.
- The invitation to any events and/or product launches of the Company.
- The delivery of documents, including but not limited to, catalogues and birthday cards.
- The delivery of goods and acceptance of returned goods purchased by you from the Company.
- The management and arrangement of completing payments in relation to commercial transactions of the purchase of goods between you and the Company.
- The process and analysis for the purpose of improving goods and services deemed appropriate and suitable to a Person’s needs, as much as possible.
Market research, surveys, analysis of internal markets, creating customer data, analysis of customer patterns and choices for purchase of goods, and the planning and analysis of statistics and trends in relation to goods and/or services of the Company.
- Any other purposes which are required for the proceeding, maintenance, and management of business and relationships between a Person and the Company.
Disclosure of Personal Data to any Third Parties
The Company may disclose your Personal Data to any third parties to the extent necessary in order to comply with the purposes specified in this Policy. The Company will send your Personal Data to the following third parties:
- Any agents, affiliates or related companies located within or outside Thailand.
- Any agents, contractors, or service providers who are third parties that will render services to the Company or a Person (e.g. service providers in relation to the delivery of goods, storage and warehousing, logistics, production and delivery of documents, including but not limited to, catalogues or birthday cards, consultants or experts, and/or telecommunications, information technology, or marketing and promotions providers).
With regard to third parties to which the Company will disclose Personal Data, the Company will have appropriate measures to ensure that Personal Data is protected and secure, including but not limited to, execution of agreements with conditions that third parties are entitled to use Personal Data to the extent stipulated in the agreements and the execution of Non-disclosure Agreements for the purposes of confidentiality of the obtained Personal Data for business operation.
- Government officers or government agencies subject to the laws, rules, and regulations prescribed by relevant legislation.
Your Rights as the Data Subject
If the Company collects, uses, or discloses your Personal Data subject to the purposes specified in this Policy, you have the following rights pursuant to the Personal Data Protection Act B.E. 2562 (2019):
- The right to be informed with regard to the collected Personal Data, methods of collection, purposes of the use of the Personal Data, people and/or third parties who will receive the Personal Data, and the period for which the Personal Data will be retained.
- The right to access and obtain a copy of your Personal Data which is under the responsibility of the Company.
- The right to request the sending or transferring of your Personal Data to any other data controller.
- The right to object to the collection, use, or disclosure of your Personal Data at any time.
- The right to request for the erasure, destruction, or anonymization of your Personal Data.
- The right to request for the temporarily restriction of the use of your Personal Data.
- The right to request for the Company to make your Personal Data accurate, complete, and up-to-date.
- The right to complain to the Company or the Personal Data Protection Committee if you believe any of your rights have been violated by the Company causing damage to you as the Data Subject.
- The right to request for the disclosure by the Company of the method(s) used to obtain your Personal Data if you have never consented to provide this information.
If you wish to exercise the foregoing rights, you are required to make a written statement. The Company will use its best efforts to perform actions in due course and no later than the period prescribed by law. The Company will strictly comply with the laws concerning your rights as the Data Subject.
The exercising of rights to request the erasure, destruction, or anonymization of your Personal Data, temporary restriction of use, or withdrawal of consent may result in the Company being unable to render services to you.
The Period for which Personal Data will be Retained
The Company will retain your Personal Data within the period necessary for the purposes specified in this Policy except for the case that the longer period of retention is required by laws. After the expiration of the retention period, or if your Personal Data is no longer required, the Company will erase, destroy, or anonymize such Personal Data.
Personal Data Protection Measures
The Company provides appropriate security measures for preventing the unauthorized or unlawful loss, access to, use, alteration, correction, or disclosure of Personal Data, and such measures will be reviewed by the Company when it is necessary, or when the technology has changed in order to efficiently maintain the appropriate security and safety
Revision of the Personal Data Protection Policy
The Company reserves the rights to revise and amend this Personal Data Protection Policy as deemed necessary and appropriate. Any revision or amendment will be announced and published on the Company’s Website or by any other appropriate method.
Information about Cookies
Contact the Company
If you have any queries in relation to this Personal Data Protection Policy or if you wish to exercise the rights specified in Clause 6, or if you wish to withdraw the consent for the collection, use, or disclosure of your Personal Data, please contact the Company at:
Jaspal Company Limited
Data Protection Officer (DPO) at e-mail: firstname.lastname@example.org
This Personal Data Protection Policy is prepared in accordance with the Personal Data Protection Act B.E 2562 (2019) and published in both Thai and English. If there are any discrepancies in terms of meanings or interpretations between the Thai and English versions, the Thai version must prevail.
This Policy is announced on 26 May 2020.