Privacy Policy

To: Customers who use our service
Asava Company Limited (“Company”) places great importance on privacy and strives to protect your personal data or personal data of any person associated with your business. (“Personal Data”) pursuant to Thai law.

This Notice of Privacy Policy describes the following details:

Categories of personal data that the Company collects include data you provide to us about yourself or any person associated with your business (“You”), as well as your staff, employees, directors, representatives, shareholders or ultimate beneficial owners if you are a legal entity, and data that the Company acknowledges from having you are as our customer ,and any marketing information that you would like us to send to you.
Asava Company Limited recognizes that it is important to protect your personal data, and therefore has established this privacy policy in order to inform you, as the data subject, about the Company’s objectives for collection and use of your personal data. The Company is legally obligated to collect, use and disclose your personal data to the extent as necessary and within the scope of the law, and the Company affirms that we have complied with the Personal Data Protection Act, B.E. 2562 (A.D. 2019), to protect your personal data.

1. What is personal data?

Personal data can be divided into two categories as follows:
Personal data (in general) means personal data of a living person that can directly or indirectly identify the person, such as name, surname, address, email address, identification card number, telephone number, etc.
Sensitive personal data includes personal data that requires special protection, and special caution must be taken when collecting, using or disclosing this category of personal data, such as personal data relating to race, ethnicity, political opinion, religious or philosophic belief, sexual behavior, criminal background, health information, disability, labor union information, genetic information, and biological information, or information as prescribed by the Personal Data Protection Commission.

2. Where does the Company obtain your personal data from?

2.1 Personal data that the Company receives from you directly
The Company receives your personal data directly through normal and online channels from various sources including but not limited to:

• Your inquiry or request for information from the Company.
• When you apply to use the Company’s products and/or services.
• You have entered into any contract or agreement with the Company.
• You have registered by creating an account through the website or application, or using it through various social media accounts
• You have answered questionnaire or contacted the Company by phone, e-mail or through the Company’s employees.
• Customer survey
• When you participate in promotional activities with the Company.
• When you make your personal data publicly visible, and disclose it through social media. In such case, the Company will choose to collect only personal data that you opt to be publicly available.
• You have visited the Company’s website whereby the Company will collect data obtained from cookies. This data will allow the Company to provide better, faster, safer service and for your privacy when you use the service and/or access the platform.

Cookies are text files in your computer that are used to store your internet logs or your site visiting behavior. You can learn more details about cookies from www.avsavagroup.com

2.2 Your personal data that the Company obtains from external agencies/third parties (Third Party)
The Company may obtain your personal data from external agencies/third parties that is in the same network with the Company for operation relating to the collection, use or disclosure of personal data by order or on behalf of the Company, whereby your personal data will not be used other than for the purpose as specified or ordered by the Company, and the Company requires external agencies/third parties to maintain the confidentiality and protection of your personal data in accordance with the standards of personal data protection law of Thailand.

3. Categoriesof your personal data that the Company collects

The Company collects your personal data as necessary to carry out the operation under Company’s objectives. Personal data can be classified as follows:

3.1 General personal data

(1) Identity data such as first name, last name, identification card number, passport number, date of birth, gender, age, nationality, signature, photo, username, etc.
(2) Contact data such as address, copy of house registration, telephone number, fax number, e-mail address, geolocation,emergency contact, social media account, LINE ID, Facebook Instagram, etc.
(3) Financial data such as bank account number, credit card number, debit card, etc.
(4) Contact information with the Company, such as information relating to date, time and place of contact with the Company, image or audio recording information when contacting the Company, etc.
(6) Information about preferences, personal interest
(7) Video recording by CCTV
(8) Information on participation in meetings, trainings, seminars, activities or other projects organized by the Company, which may include still images, motion pictures and/or audio information during those meetings, trainings, seminars or activities.
(9) Other information necessary for litigation or execution, such as marital status, property-related information, etc.
(10) Comments, suggestions, complaints
(11) Screening information for epidemic prevention measures
(12) Information about the Company’s use of various electronic systems, including information about the use of the Application, browsing information, such as browsing history,IP Address, etc.

3.2 Sensitive personal data:
Personal data that is specifically required by law, including information about you regarding your race, ethnicity, political opinion, ideological, religious or philosophic belief, sexual behavior, criminal record, health information, disability, labor union information, genetic information, biological information or any other information affecting you in the in the same manner as prescribed by the Personal Data Protection Commission.

4. Objectives for the use of your personal data

Our company uses your personal data within the extent of data protection law, and collects only necessary information as follows:

• For the benefit of procuring or distributing products, providing or receiving services in various forms
• For financial and tax transactions related to the Company’s contractual performance.
• Study or research
• For the benefit of creating database for analysis, and offering any service or product of the Company and its group companies or anyperson who is distributor, agent or has connection with the Company
• For the benefit of improving the quality of operation, services and operation related to the Company’s business.
• For analysis and tracking of the use of services available on website, and for the purpose of retrospective review in case of usage problems
• For participation in the Company’s activities
• For accesscontrol,prevention and suppression of harm to life, body or health for you or other persons, control and prevention of communicable diseases, and security of the Company’s building, space inside the building, and premises
• For compliance with the law or regulations applicable to the Company at present and in the future

The Company may use more than onelawful basis for processing personal data depending on the purposes for each activity that uses your personal data.

5. Marketing activities and promotions

The Company may perform marketing and promotional activities or allow third parties that the Company has an agreement with to perform those activities in the following events.

• In the event that the Company uses your personal datafor direct marketing purpose with you, the Company will be able to do so if you have expressly given yourconsent and the Company has informed you about the use of your datafor direct marketing purpose with you only. You can withdraw your consent given to the Company for such direct marketing purpose at any time through the Company’s opt-out system.
• In performing direct marketing activities with you, the Company uses your information to analyze behaviors for service provision that meetsyour need.
• In the case of participating in the Company’s sales promotional activities, such as gaming activities or activities on various social networks to publicize the Company’s products and services to the public, the Company will not use your information for data processing indirect marketing activities, unless you have expressly given consent to the Companyin allowing the Company to use yourpersonal datafor direct marketing purpose, whereby the Company will inform you aboutour use of your information for direct marketing purpose, and you can withdraw your consent given to the Company for such direct marketing purpose at any time through the Company’s opt-out system.

6. Disclosure or sharing of personal data

6.1 The company does not disclose your personal data to external agencies/third parties, except in cases where it is necessary to disclose such data to external agencies/third parties in order to achieve operational objectives, or if such agency is legally obligated to request the Company to disclose such data. These external agencies/third parties include

• Affiliates
• Online advertising platform
• Marketing companies or consultants
• Regulatory agencies such as the Office of the Personal Data Protection Commission
• Agencies hired by the Company for data collection

6.2 The Company requires those agencies/third parties that the Company has disclosed or shared your personal data as specified above to maintain confidentiality and protect your personal data in accordance with the standards prescribed by the personal data protection law of Thailand, and use your personal data only for the purposes determined or ordered by the Company. Third parties will not be able to use your personal data other than for the aforementioned purposes.

6.3 When being requested, the Company may disclose your personal data to relevant authorities in order to comply with the law and achieve its objectives, such as for prevention of threat against life or body, for the purpose of law enforcement,allegation, exercising of rights, protection of legal rights, and fraud prevention, etc.

7. Retention and retention period of personal data

7.1 The Company collects your personal data in the Company’s information system, provides standardized security for the Company’s information system, and uses your personal data securely with the following measures.

• Restrict access to personal data that may be accessed by officers or employees.
• Provide technological means to prevent unauthorized access to computer systems.
• Destroy your personal data for security purpose when such data is no longer needed for the purpose of data collection by the Company.
• Establishmanagement procedures in case of personal data breach, or suspicious events,informthe Office of the Personal Data Protection Commission about such personal data breach in accordance with the conditions prescribed by law

7.2 Retention period of personal data
The Company will keep your personal data for 10 years after you are no longer the Company’s customer for the Company’s benefit in handling any contractual dispute that may arise during such period, unless there are legal grounds or technical reasons. The Company may retain your personal data for more than 10 years. If it is unnecessary for the Company to retain your information, the Company will then destroy, delete or anonymize yourpersonal data (so that such datawill be no longer linked to you).
For your personal data obtained from cookies that collect information when you visit the website, the Company will retain such data for no more than 13 months or as required by applicable laws.

8. Cookies Policy

8.1 Functionality cookies:
The Company uses cookies to improve the functionality of our website (Functionality Cookies) for the collection of website visiting information in orderto help the Company to provide better, faster and safer service. This type of cookies allows the Company to recognize your device or browser so that the Company can provide content to suit your personal interests more quickly, and helps making the service and platform more convenient and useful to you. To disable cookies, you can configure your device by reviewing assistance feature of your browser or device.

8.2 Analytic cookies:
The Company uses analytic cookies provided by third parties to collect information about the use by the Company’s website visitors. The Company anonymizes all information of website visitors (Anonymization), and passes it to third parties who may be able to use it, or disclose such information to other parties who may process it as permitted by law. Third parties will not combine your information obtained from our website with information that the third parties already have. You can choose to disable this type of cookies on the Company’s website.

9. Privacy policy of other websites

This Privacy Policy applies only to the Company’s services and use of the Company’s website. If you click on any link to otherwebsites (even through channels on the Company’s website), you are required to review and abide by the privacy policies appearing on those websites, separately from those of the Company.

10. Amendment to the Privacy Policy Notice

The Company will regularly review the effectiveness of the Privacy Policy. Should there be any changes to the Privacy Policy, such changes will be posted or published on the Company’s website or other platforms.

11. Rights of personal data subject

As the personal data subject, you have the right to proceed in accordance with the extent of the Personal Data Protection Act, B.E. 2562 (A.D. 2019), as follows:

1. You have the right to withdraw your consent (Right to withdraw Consent) for the processing of personal data that you have given your consent to the Company throughout the period that the Company retains your personal data.
2. You have the right to access your personal data (Right of Access) and request the Company to make a copy of such personal data for you.
3. You have the right to request the Company to your correct personal data or add incomplete information (Right to Rectification).
4. You have the right to request the Company to delete your data for certain reasons (Right to Erasure).
5. You have the right to request the Company to suspend the use of your personal data for certain reasons (Right to Restriction of Processing).
6. You have the right to transfer personal data you have provided to the Company to another data controller or yourself for certain reasons (Right to Data Portability).
7. You have the right to object the processing of your data for certain reasons (Right to Object).
8. You have the right to claim for compensation in case of personal data breach that causesany damages.

To exercise those rights, you may contact the Company as a personal data controller at the address below in order to request for action according to the above rights, and the Company will process your request within 30 days. The Company will consider your request within the extent of the Personal Data Protection Act, B.E. 2562 (A.D. 2019), and in the event that the Company refuses your request, the company will give a reason for such refusal.

The Company may need to ask certain information from you in order to verify your identity, and validate your right to access personal data (or for exercising of any other rights), which is our safety measure to ensure thatyour personal data will not be disclosed to persons who do not have the right to access such information. The Company may contact you and ask for further information about your request so that the Company will be able to respond faster.

The Company will put our best effort to respond to all legitimate requests within 30 days. In some cases, the Company may take more than 30 days if your request is complicated or if you have submitted more than one request. In those events,the Company will notify you and keep you informed about the status of your request periodically.

12. Security of your personal data

Information is considered as the Company’s property, and the Company therefore places great importance on the security of your personal data. The Company will monitor and implement physical, technical and administrative security measures that are up-to-date when collecting, using and/or disclosing your personal data. In this regard, the Company have established policies and internal controls to ensure that your personal data will not be lost, accidentally destroyed, misused, disclosed and accessed by people in general who are not employees performing the Company’s duties, provided that the Company’s employees will receive training on how to handle personal data securely. If the employees fail to proceed in accordance with such training, the employees will be subject to disciplinary action.

13.How to contract us.

Asava Co.,Ltd.
1, 1/1, 1/2 Sukhumvait 45 (Suksamer), North Klongton, Wattana, Bangkok 10110
E-mail : contact_dpo@asavagroup.com

Data Protection Officer
1, 1/1, 1/2 Sukhumvait 45 (Suksamer), North Klongton, Wattana, Bangkok 10110
E-mail : contact_dpo@asavagroup.com