Personal Data Protection Policy

AskMe Solutions & Consultants Co., Ltd.

AskMe Solutions & Consultants Co., Ltd. (hereinafter referred to as the “Company”) recognizes the importance of protecting personal data and is committed to maintaining appropriate information security measures in accordance with internationally recognized standards and the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) of Thailand.

Accordingly, the Company has established and published this Personal Data Protection Policy (“Policy”) to inform individuals who interact with the Company about its practices regarding the collection, use, disclosure, and protection of personal data.

This Policy applies to the Company’s employees, customers, business partners, and relevant third parties. All applicable individuals are required to comply with the provisions outlined below.

1. Personal Data

“Personal Data” refers to any information relating to an individual that enables the identification of that individual, either directly or indirectly. Such information includes, but is not limited to:

• Personal Identification Information: First name, last name, date of birth, gender, national identification number, passport number, and other identifying information.

• Contact Information: Residential address, workplace address, correspondence address (if different from the residential address), telephone number, email address, LINE ID, and social media accounts.

• Device and Technical Information: IP address, MAC address, Cookie ID, and other device identifiers.

• Other Information: Website usage data, voice recordings, photographs, videos, and any other information classified as personal data under applicable personal data protection laws.

• Information Provided Directly to the Company: Personal data provided directly by individuals, submitted through the Company’s representatives or communication channels, or obtained through the use of the Company’s products and/or services. This includes information collected through inquiries, visits, searches, seminars, digital platforms, websites, call centers, authorized representatives, or other communication channels.

• Information Obtained from Third Parties: Personal data received or accessed from sources other than the individual, including government agencies, financial institutions, financial service providers, business partners, credit information companies, and other data service providers. The Company will collect such information only with the individual’s consent where required by law, unless another lawful basis permits such collection.

“Sensitive Personal Data” refers to personal data specifically classified as sensitive under applicable laws.

The Company will collect, use, and/or disclose Sensitive Personal Data only when explicit consent has been obtained from the data subject or when such processing is otherwise permitted by applicable laws.

For the purposes of this Policy, unless otherwise specifically stated, the terms “Personal Data” and “Sensitive Personal Data” shall collectively be referred to as “Personal Data.”

2. Limited Collection of Personal Data

The Company collects and processes Personal Data for specific, legitimate, and clearly defined purposes, using lawful and fair methods.

The collection and retention of Personal Data shall be limited to what is necessary for providing the Company’s products and services, including electronic services, and for fulfilling the Company’s legitimate business purposes.

Where required by applicable laws, the Company will inform data subjects of the purposes of data collection and obtain their consent through electronic means or other methods prescribed by the Company.

The Company may collect Personal Data relating to individuals’ interests, preferences, and use of services to enhance service delivery and improve customer experience.

The categories of Personal Data collected may include:

• Personal Identification Information: First name, last name, date of birth, national identification number, passport number, and gender.

• Contact Information: First name, last name, address, email address, and telephone number.

• Business Partner Information: National identification number, address, email address, and other relevant information required for business transactions.

• Information Voluntarily Provided: Information submitted through registration forms, participation in Company activities, responses during conversations, questionnaires, surveys, or other interactions with the Company.

• Product and Service Information: Information related to the Company’s products, services, transactions, and service requests.

• Event and Promotional Information: Information provided when participating in Company activities, promotional campaigns, trade exhibitions, seminars, and other business-related events, including information submitted through the “Contact Us” form or similar communication channels.

• Cookies and Technical Information: Information automatically collected through cookies and similar technologies, including IP addresses and device information, when individuals access or use the Company’s online platforms.

• Website Browsing and Usage Information: Technical and browsing information, such as browser type, domain name, websites visited, access time, referring website addresses, and other information used to support customer services. The Company may also collect application usage logs generated through its applications and online platforms.

• Online and Offline Information: Personal Data collected through various online and offline channels, including user registration, communications through the Company’s social media platforms, and other interactions. Such information may include identification details, contact information, and other information relevant to providing services. The Company may also collect Personal Data through surveys and questionnaires.

The Company shall ensure that Personal Data is collected only to the extent necessary and in accordance with the purposes specified in this Policy and applicable laws.

3. Data Security Measures and Data Quality

The Company recognizes the importance of protecting the confidentiality, integrity, and security of Personal Data.

Accordingly, the Company has established appropriate technical and organizational security measures to protect Personal Data against unauthorized or unlawful access, loss, destruction, use, alteration, modification, or disclosure.

These measures are designed to prevent unauthorized processing or misuse of Personal Data and are implemented in accordance with the Company’s Cybersecurity Policy and applicable legal requirements.

Personal Data collected by the Company, including names, ages, addresses, telephone numbers, national identification numbers, financial information, and other personally identifiable information, shall be used solely for legitimate business purposes.

The Company shall take reasonable measures to ensure that Personal Data remains accurate, complete, and up to date, where necessary, and shall implement appropriate safeguards to protect the rights and interests of data subjects.

4. Purposes of Collection, Storage, and Use of Personal Data

The Company collects, stores, and uses Personal Data for legitimate business purposes, including providing products and services, improving customer experience, and supporting the Company’s business operations.

Such purposes may include, but are not limited to:

• Providing products, IT solutions, system-related services, technical support, and other services requested by or relevant to individuals.

• Developing, maintaining, and improving digital services, applications, and platforms.

• Conducting market research, customer analysis, and service improvement activities.

• Organizing marketing campaigns, promotional activities, seminars, and business events.

• Establishing and maintaining customer databases for business operations and customer relationship management.

• Providing information about products, services, promotional offers, and benefits that may be relevant to individuals’ interests.

• Analyzing customer preferences and offering products or services distributed, represented, or provided by the Company.

• Fulfilling contractual obligations and supporting business relationships.

• Complying with applicable laws, regulations, legal obligations, and requirements imposed on service providers, whether currently in force or subsequently enacted.

• Carrying out other lawful business activities that are not prohibited by applicable laws.

The Company shall retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, subject to any applicable legal or regulatory retention requirements.

If the purposes of collecting or processing Personal Data change, the Company shall notify the relevant data subjects accordingly.

5. Limitations on the Use and/or Disclosure of Personal Data

The Company may disclose Personal Data to third parties where consent has been obtained from the data subject or where such disclosure is permitted under applicable laws.

Any recipient of Personal Data shall collect, use, and/or disclose such information only within the scope of the consent provided by the data subject or as otherwise permitted under this Policy and applicable laws.

The Company may disclose Personal Data to relevant parties for the purposes described in this Policy, including:

• Personal Data Processors

• Business Partners

• External Service Providers

• Authorized Representatives and Agents

• Subcontractors

• Financial Institutions

• Auditors and External Assessors

• Government Authorities and Regulatory Bodies

• Legal Entities or Individuals Having Contractual or Business Relationships with the Company

• Directors, Executives, Employees, Contractors, Representatives, and Consultants of the Company or the relevant receiving organizations

Such disclosures shall be made only where appropriate and in accordance with applicable legal requirements.

The Company may engage third-party information technology service providers to store, manage, or process Personal Data on its behalf.

These service providers shall be required to implement appropriate information security measures and shall not collect, use, or disclose Personal Data beyond the purposes and instructions specified by the Company.

The Company shall take appropriate measures to ensure that Personal Data disclosed to third parties remains adequately protected.

6. Rights of Data Subjects

Under the Personal Data Protection Act B.E. 2562 (2019), data subjects are entitled to exercise certain rights concerning their Personal Data, subject to applicable legal requirements and limitations.

The Company recognizes and respects these rights, which may include:

6.1 Right of Access and Data Portability

You have the right to request access to your Personal Data, obtain copies of your Personal Data, and request the transfer of your Personal Data where applicable under the law.

You may also request information regarding the sources from which the Company obtained your Personal Data.

Such requests may be submitted in accordance with the procedures established by the Company, including through its designated office or communication channels.

6.2 Right to Rectification

You have the right to request the correction, modification, or updating of your Personal Data if such information is inaccurate, incomplete, misleading, or outdated.

The Company shall take appropriate steps to ensure that Personal Data is accurate and up to date.

6.3 Right to Object, Erasure, Withdrawal of Consent, and Restriction of Processing

Subject to applicable laws, you have the right to:

• Object to the collection, use, or disclosure of your Personal Data.

• Request the deletion, destruction, or anonymization of your Personal Data.

• Withdraw consent previously granted for the processing of your Personal Data.

• Request the suspension or restriction of the use of your Personal Data.

However, the Company may continue to retain or process certain Personal Data where necessary to comply with legal obligations or where another lawful basis applies.

6.4 Right to Lodge a Complaint

You have the right to lodge a complaint with the relevant supervisory authority if you believe that the Company’s collection, use, or disclosure of your Personal Data violates applicable personal data protection laws.

6.5 Limitations on Data Subject Rights

The exercise of the rights described above may be subject to limitations under applicable laws.

In certain circumstances, the Company may be unable to fulfill a request or may be legally entitled to refuse it, including where:

• Compliance with applicable laws or court orders is required.

• The processing of Personal Data is necessary for reasons of public interest.

• Exercising the requested right may adversely affect the rights or freedoms of other individuals.

• Other lawful grounds justify the refusal of the request.

If the Company refuses a request to exercise data subject rights, the Company shall inform the data subject of the reasons for such refusal, as required by applicable laws.

7. Data Protection Officer (DPO)

The Company is committed to complying with the Personal Data Protection Act B.E. 2562 (2019) and other applicable personal data protection laws and regulations.

To support compliance with these requirements, the Company has appointed a Data Protection Officer (DPO) responsible for overseeing and monitoring the Company’s activities relating to the collection, use, and disclosure of Personal Data.

The DPO is responsible for supporting the Company’s compliance with applicable personal data protection laws and promoting appropriate data protection practices throughout the organization.

In addition, the Company has established internal policies, regulations, procedures, and instructions to ensure that relevant employees and personnel perform their duties in accordance with the Company’s Personal Data Protection Policy.

These measures are implemented in alignment with the policies and directives established by the Company’s Personal Data Management and Cybersecurity Governance Committee.

For inquiries, concerns, requests to exercise data subject rights, or complaints relating to Personal Data protection, please contact:

Data Protection Officer (DPO)
AskMe Solutions & Consultants Co., Ltd.
Email: dpo@askme.co.th

AskMe Solutions & Consultants Co., Ltd.
108 Bangkok Thai Tower, 8th Fl., Room 801,
Rang Nam Road, Thanon Phayathai,
Ratchathewi, Bangkok 10400
Tel : (+66) 2245-1335-7
Email: dpo@askme.co.th