Privacy Notice

MULTI RISK CONSULTANTS (THAILAND) LIMITED

Multi Risk Consultants (Thailand) Limited is aware and gives importance to the personal data protection. And in order for the compliance of the Personal Data Protection Act B.E. 2562, this Privacy Notice is made in order to explain the details and procedures of management and personal data processing that company derives from you. The purposes in collecting, using, disclosing, and processing data, including duration in the retention of the stated personal information and your rights as the owner of personal information have the details as follows:

Item 1. Definition

• ‘Company’ means Multi Risk Consultants (Thailand) Limited.

• ‘You’ means the owner of personal information that Multi Risk Consultants (Thailand) Limited does the personal data processing. Which includes clients, business partners, dealers, contractors, outside contact persons, and other related persons to the activities and operations of the company.

• ‘Personal Data’ means the information about individual which is able to identify that individual both directly and indirectly. But, does not include the information of the particular deceased.

• ‘Sensitive Personal Data’ means the personal information about the nationality, race, political opinion, belief in doctrine, religion or philosophy, sexual behavior, criminal record, health information, disability, labor union information, hereditary information, biological information, or any other information which affects the owner of information in the same way as the announcement from the personal data protection committee.

• ‘Personal Data Controller’ means the person or juristic person who has the authority for decision making about keeping, collecting, using, or disclosing of the personal information.

• ‘Personal Data Processor’ means the person or juristic person who operates in keeping, collecting, using, or disclosing of the personal information according to the order or on behalf of the personal data controller.

• ‘Personal Data Protection Law’ means the Personal Data Protection Act B.E. 2562 and other related subordinate laws. Also, it includes any additional revised versions of laws in the future.

Item 2. Channels and Sources of Personal Data

Company collects, uses, or discloses your personal information by deriving your personal information via channels as follows:

• 2.1 Personal Information that you provide directly to the company: You may provide your personal information to the company directly when you have intent to come for making contract, interest in using the company’s services no matter via website, social media, telephone, event, or any other channels. Or, when you send the document that has your personal information to the company. Or, when you make contact, enquire for information, or in case that you exchange cards to enter the company.

• 2.2 Personal Information that company collects automatically from you: Company may derive your personal information automatically. Such as, pictures recorded from the closed-circuit television (CCTV), technical information collection, activities and patterns of visit in your browsing automatically by using cookies and other similar technologies. In order that, you may have additional study for the details at “Cookies Notice” of the company.

Item 3. Collected Personal Data

• 3.1 Personal information that company collects under this privacy notice is the personal information of the owner in the types as follows:

• 1. Clients, partners of contract, and other related persons to the company’s business operation such as ordinary person who is the partner of contract or has relation to any agreements with the company. Which also means the client, business partner, vendor, supplier, service provider, work recipient, consultant, and other person in the similar form.

• 2. Outside contact persons and other outsiders such as a person who asks for permission to enter the area, deliveryman, and any other persons who make contact to request for information or service enquiry from the company. In order that, no matter it is the acquisition of personal information directly or indirectly.

• 3. Others such as the third party that you handover the personal information to the company. For example, the alternative contact person.

• 3.2 Your personal information that is collected and under this Privacy Notice. No matter it is the personal information you provide to the company directly or the personal information that the company receives from the outsiders. Such as,

• 1. Information about clients, partners of contract, or the persons related to the business operation of the company

  • 1.1 Information about clients such as name, surname, address, delivery place, ID number, telephone number, e-mail address, contact channel in social media, history of service usage, complaint, payment information, pay slip, bank account number, credit card number, satisfaction survey information, ID card copy, house registration copy, registration information through website, username, password, etc.
  • 1.2 Information about business partners such as name, surname, ID number, bank book copy, ID card copy, VAT Registration Certificate (P.P.20) (in case of a juristic person), etc.
  • 1.3 Information from the closed-circuit television: CCTV, slide, motion, including property related to you. Such as, vehicle when you access to the area inside the place, building, or any other areas of the company through the CCTV system and device. By installing the CCTV camera inside the critical point of the building’s areas such as the entrance door, hallway, etc.
  • 1.4 Technical information such as web browsing history, log, usage record like identifier device, computer’s IP address, device’s code, type of devices, mobile network information, connection information, geographic location information, type of browser.

• 2. Information of the outside contact persons and the other outsiders

• 2.1 Contact persons from outside such as name, surname, ID number, car registration number, etc.
• 2.2 Information from the closed-circuit television: CCTV, slide, motion, including property related to you. Such as, vehicle when you access to the area inside the place, building, or any other areas of the company through the CCTV system and device. By installing the CCTV camera inside the critical point of the building’s areas such as the entrance door, hallway, in front of the elevator, etc.

• 3. Information of Others such as the alternative contact person. In case that you give the personal information of other person to the company, you certify that you have already received consent and informed the owner of the stated personal information in keeping, using, and disclosing the personal information according to that is identified in this notice.

• 4. Sensitive data the identification document may have the personal sensitive information such as religion, blood group. Please be informed that company has no purpose in keeping the stated information. Please cross out or close up the information before delivering the document to the company. If you do not process by the above mentioned, company may cross out or close up the stated information. In case that company has the necessity in keeping the sensitive personal information, company will arrange to have the adequate security measure and request for your consent before collecting the information. Except, there is the exemption of law not to request for consent. Such as, labor protection, social security, prevention of vital danger, public health benefits, compliance of law, or other exceptions according to the regulations of Personal Data Protection Law.

Item 4. Purposes and Lawful Basis in Collecting, Using, and Disclosing the Personal Data

• 4.1 Company does data processing of your personal information for the following purposes (overall are called ‘stipulated purposes’) and under the lawful basis as follows:

  • 4.1.1 To enable company in doing business operations according to the purposes (contract) such as to be the memorizing for compliance with contract which you are the partner of contract with the company. Or, to be used in the operation according to your request before making that contract. Or, to be used for accomplishment of the company’s business operations. Such as, for the purpose of purchasing management, the identification verification of customer, the consideration for customer qualification, credit verification, credit approval, service providing, delivery, repair and maintenance, cash receipt, communication with you, follow up on installment for using service, registration for new partner / customer, freelance management, or the compliance with any contracts which you are the partner with the company.
  • 4.1.2 To perform the duty according to the legal obligations such as for the compliance with laws related to the company. Or, for the compliance with the order from the legal authority. Such as, Computer-related Law, Tax Law of the Revenue Code (issuing of tax invoice, cash receipt, invoice), writ of court or prosecutor, or any other laws related to the company’s business operations.
  • 4.1.3 To operate the necessary task under the legitimate interest by not over than the scope that the personal data owner can anticipate reasonably such as the collection of information of the deliveryman or the outside contact person through the CCTV record, the exchange of cards before the accessing the company’s area, visitor records. This is in order to control the access to the building and the security of company, personnel, other persons, including the company’s properties and information. The management for customer or partner of contract is the data processing for providing service, verifying the identification document, accepting complaint, accepting problem notice, answer to the enquiry, conducting activity, satisfaction survey, development on providing services, including to be the information in communicating with you.
  • 4.1.4 It is necessary for the operation for public task or the operation in using the jurisdiction provided to the company.
  • 4.1.5 To prevent or stop the danger to vital interest in order to prevent or stop the vital danger or to the personnel health such as the emergency contact, the infectious disease control.
  • 4.1.6 Consent when the company could not use the exception or reference from the lawful base according to the above identified information, company will request for the particular consent from you. By doing so, company will do the stated personal data processing according to the informed purpose and consent received from you. Or, in case that the company does data processing which is the sensitive information, company will take operation according to the regulations of law or the consent received form you clearly. Such as, the offer for service or privilege to you. By you can revoke the consent any time via the contact channel according to no. 9.
  
  In the event, that you do not give consent or request to withdraw consent or request to delete, destroy or suspend the use of such information will affect any service related to the company's insurance against you Including the insurer may refuse insurance.

• 4.2 Due to your personal information that the company will do the data processing for the stipulated purposes according to the above item 4.1, in the part that is related to the compliance with contract, the access to make contract with you, or the compliance with law, company has to do the data processing with your personal information which is the information necessary to achieve the stated purposes. Please be informed that if you do not provide your personal information to the company, there might be impacts to the compliance of law or the company may not be able to provide services or operate the duty under the contract made with you. Or, may not be able to go for making contract with you, (depends on each case).

• 4.3 In case that company will use your personal information for other purpose that is not identified in the above statements, company will make the additional privacy notice to explain and inform you about the use of information in the stated purpose first.

Item 5. Disclosure of Personal Data

• 5.1 Company may disclose your personal information under the stipulated purposes and according to the criteria stipulated by law to the following agencies and persons.

  • 5.1.1 Government agency, agency in charge of legal governance such as Revenue Department, Ministry of Commerce, Department of Business Development, and banks, etc.
  • 5.1.2 Agency that request to disclose the information by the legal authority such as the information request for suing or prosecuting or that is related to the process of law. Such as, Royal Thai Police, Department of Special Investigation, Office of the Attorney General, Court, police officer, Personal Data Protection Committee Office, etc.
  • 5.1.3 Departments in company in order to take operation according to your purposes, company may disclose your personal information to the Accounting Department, Finance Department, Purchasing Department, and other related departments.
  • 5.1.4 Other agencies such as National Credit Bureau (NCB), debt collection service provider, publisher or printing service provider, delivery service provider, external auditor, legal consultant, etc.

• In case that company discloses your personal information to others persons, company will arrange to have the appropriate measure to protect the disclosed personal information. And, to comply with the standard and responsibility of personal data protection according to the regulations of Personal Data Protection Law.

• In case that company sends or transfers your personal information abroad, company will take operation to ensure that the sending or transferring to the countries of destination, international organizations, or the recipients of information in foreign countries have the adequate personal data protection standard. In some cases, company may request for your consent for the transfer of your personal information abroad. In order that, with reference to the regulations of the Personal Data Protection Law.

Item 6. Personal Data Retention Period

• 6.1 Company will keep your personal information by the time period necessary for achievement of the stipulated purposes in the personal data processing of that person. Company many keep your personal information for the time longer than the stated period if the regulations of law or the retention of that personal information is necessary for the establishment of legal right of claim of the company. Such as, according to the Accounting and Tax Law, Revenue Code, or other related laws. Or, in case that the company is in the process of law until the end of case and after the stated time period, company will delete, destroy, or make the information unable to identify the personal information immediately.

• 6.2 Company will keep the record of closed-circuit television (CCTV) within 7 day. When it is due, the information will be automatically delated. In case that it is necessary to keep the information as the evidence in investigation or prosecution, company will keep it until the case is ended.

Item 7. Rights of the Owner of Personal Data

In the position of owner of personal information, you have the following rights under the criteria, procedures, and conditions according to the regulations of Personal Data Protection Law. In order that, if you would like to use your right via the ‘Data Subject Right Request Form’ you can make contact to the company according to no. 9.

• 7.1 Right to revoke the consent If you give consent to the company in keeping, using, and / or disclosing your personal information (no matter it is the consent that the information owner gives before the date that the Personal Data Protection Law is effective or after that), you have the right to revoke the consent at any time that your personal information is in the company’s possession. Except, there is the legal limitation of that right or the contract that is still beneficial to you. Company will inform you about the impacts that might occur from the revocation of the stated consent.

• 7.2 Right to access the personal data You have the right to access or request for a copy of your personal information that is in the company’s responsibility. Including, request the company to disclose the acquisition of the stated personal information that you do not give consent. In order that, company has the right to reject the request if the stated access or request for a copy have impact to the liberty of other persons. Or, when it is the case that you do not have the right to access to the stated personal information.

• 7.3 Right to transfer the personal data You have the right to request the company to transfer your personal information to another personal data controller.

• 7.4 Right to oppose the collection, use, disclosure of personal data You have the right to oppose the collection, use, and / or disclosure of your personal information at any time if it is the personal information collectible for the direct marketing purpose. Or, for the objectives of scientific or statistic research. In order that, company can reject the request if it is the necessity for mission operation for the company’s public benefits Or, when it is the case that company shows more importance of the legitimate reasons or for the establishment of right of claim, and the compliance with laws.

• 7.5 Right to request to delete or eliminate the data You have the right to request to delete or destroy the personal information or make the personal information unable to identify the form when you perceive that personal information is collected, used, and / or disclosed illegally. Or, you perceive that company has no necessity in keeping the personal information according to the related purposed in this notice. Or, when the owner of information uses the right the revoke the consent or the right to oppose by the above-mentioned statements. In order that, company may reject the stated request if that personal information is needed to be collected by the time period stipulated by law. Or, it is the information necessary for the company’s business operation.

• 7.6 Right to request to suspend the use of data You have the right to request to suspend the use of personal information temporally in case that company is in the process of verification according the request for the right to modify the personal information or request to oppose. Or, any other case that company has no necessity and has to delete or destroy the personal information but you request to suspend the use of information instead.

• 7.7 Right to request to modify the data You have the right to request to modify your personal information to be correct when your personal information is incorrect, not up to date, incomplete, or causes the misunderstanding.

• 7.8 Right to notice the complaint in case that company violates or do not comply with the Personal Data Protection Law, you have the right to submit the complaint notice to the Personal Data Protection Committee Office according to the law.

Item 8. Security in Personal Data Retention

Company selects the storage system of personal information which has the appropriate mechanism and technique. And, there is the security measure according to the Personal Data Protection Law and the related laws. Including, the limitation to the access of your personal information for only company’s related staff and employees. This is in order to prevent your personal information from bringing to be used, publicized, destroyed, or accessed without your permission.

Item 9. Contact Details

If you have any questions about this Privacy Notice, you can contact the company by this following contact details:

• Personal Data Controller Details
• Company Name: Multi Risk Consultants (Thailand) Limited
• Address: 100/64-66 Vongvanij Building B, 21st Floor, Rama IX Road, Huai Khwang, Bangkok 10310
• Phone no.: 0-2645-0040
• E-mail: dpo@mrc.co.th

Item 10. Modification of the Privacy Notice

Company may have the modification to this Privacy Notice sometimes in order to make it conform to any changes related to the data processing of your personal information. And, to be conform to any changes in the Personal Data Protection Law or the other related laws. Company will inform you the significant changes via the appropriate channel.

This Privacy Notice is effective on 17th May 2022.