This Privacy notice (this “Notice”) issued by Ngern Tid Lor Public Company Limited (together, “Company” , “our”) to inform individuals who we have relationships with, including our customer, visitors and users of our websites, including applications, other channels of communication (together, “ You” or “your”) about our practices with respect to the collection, use, disclosure, or transfer of your personal data.
- Personal data that we collect
We may collect your personal data directly from you (when you are our customer, or potential customer whose personal data are available to us by your use of our products and/or services or contact with us) or from other sources and/or through our affiliates, business partners from other third parties (e.g., distributors, agent, sub-broker, other reference person).
We shall rely on appropriate legal bases to collect, use, or disclose your personal data. The legal bases which we may rely on are any of the following: (1) to perform contract obligations and/or perform transaction with you (2) to allow us to meet our legal obligations (3) to pursue our and others’ legitimate interests management. (4) To prevent or suppress a danger to your life, body, or health. (5) to perform a task for public interest, to exercise official authority or for some processing of your personal data that your consent is required, we will obtain your consent separate from other processing which can rely on other lawful bases of processing.
We shall collect the following types of your personal data. However, the collection of your personal data shall depend on the type of our products and/or services in which you are interested.
- General Personal data
- Identification data such as title, first name, middle name, last name, first name abbreviation, nickname, alias, age, date of birth, gender, height, weight, marital status, nationality, country of birth, citizenship status, military status and details, signature, phone number and office phone number, Line ID, email, address, postal code, map or location images, present address, photo location, status of residence (e.g., house owner, head of householder, resident, welfare house, rental house and rental rates, monthly installment and period of residence), education level, Identification issued by governmental authorities (e.g., national ID number, driver's license number, passport number, foreigner registration number, government officer card, household registration) occupation, employment status, position and year’s experience.
- Financial details such as main source of income, financial document or certification issued by employer, additional source of income, bank account details, bank statement, copy of credit card, credit card number, expiry date, loan application form, payment history and credit history (e.g., credit bureau, information relating to cash flow and other similar information)
- Vehicle details related to title loan vehicle registration information such as province of registration, date of registration, mileage, brand, model, gear type, types of vehicle, color, size of engine, vehicle identification number, chassis number, period of ownership, kerb weigh, renewal date of compulsory motor insurance.
- Setting and preferences details such as your preferences, settings (including your preferred communication channels, login option preferences and/or transferring your preferences details) browsing history, and cookies.
- Products and Services details such as types of services (e.g., Personal loan under supervision, Nano finance under Supervision, motorcycle loans and auto loans, vehicle title loans, truck loans(C2C), truck loans(Dealer) truck loans (through agent), hire purchase service, car insurance, personal accident insurance, cancer insurance, payment protection insurance (PPI compulsory motor insurance, contract number, schedule policy number, details of insurance companies, premium payment methods, period of insurance (effective date to insurance coverage end), insurance premium details, reason for cancellation of insurance, terms of payment, payment amount per term, amount of final payment, vat, vehicle tax, first payment term, repayment due date, fee, ownership transfer fee rates and/or vehicle registration fee, vehicle tax fee, purpose of loan application, detail of loans (such as auto loans, cash price, down payment, term of payment, loan amount, interest rate, fees and effective interest rate) collateral appraisals value, collateral details, repayment method , refinance amount, total loan repayment, payment options (such as cash payment, deposit to bank account).
- Interaction details such as your voice recordings when you contact our call center, records of your queries, details and contents which have been interacted between us.
- Marketing details such as your marketing preferences, products and services that you are interested in, reference or preference inference from your communication or interaction with us, our affiliates, or our business partners.
- visitors and users of our websites such as cookies, user behavior, login details, search behavior, search history, language use on search engine, IP Address, Information about your use and interact with our online services or advertising including website visitor history , content visited, links that you click, features used and, time and frequency with which you have used online services of our company, number of website visits (such as from URL) and diagnostic data which may be combined or associated with any other personal data of you or carry out data profiling, we will treat this type of data and combined data or associated data as your personal data.
- Data in compliance to FATCA such as information which demonstrate whether you have the nationality or birthplace that is linked to the United States of America, whether you have legally surrendered American citizenship, you hold an American permanent resident card (GreenCard), you have an obligation to pay tax to Internal Revenue Service (IRS).
- Third party information we may collect data relating to another person which you provided to us (e.g. your family member details, references, guarantors, contact person for debt collection, witnesses, beneficiaries, attorney including information provided to us in Friend referral campaign, for providing our service and/or to corporate entities. If you provide us with personal data of another person, you are responsible for ensuring that you have authority to provide us with such personal data by perform the following steps (a) you shall provide this privacy notice to explain our practice regarding personal data and (b) where consent is required or appropriate as a legal basis, you shall obtain an informed consent in accordance with this privacy notice.
- Social relationship details such as political status, relationship with directors, management, and persons with controlling power of Ngern Tid Lor Public Company Limited, relationship with other juristic persons (e.g., directorship, management, shareholding), and other relationships
- Views and opinion details such as data relating to the use of products and services that you are interested in, other information that you choose to send to us (including on or via social media platforms or online surveys), comments, feedbacks, complaints, recommendations, survey responses, inquiries, and any data you have voluntarily given during marketing or customer service-related communications, including your data that is disclosed on your social media profiles
- Any other details that you provide to us information relating to build relationship with you or maintain our relationships with you , your request regarding the products and services or information from our service that have been provided to you including from any other events.
- Sensitive Personal data
- Sensitive data such as criminal records, religion, health, disability, biometric (e.g., fingerprints and facial recognition). In any event, we will only collect, use, or disclose sensitive personal data based on your explicit consent or as otherwise permitted by law. If we have to collect personal data of minors, incompetent persons or quasi-incompetent persons, we shall obtain explicit consent from the persons exercising parental power, the legal curators, and the guardians (as the case may be), except where we can rely on other legal basis of processing apart from consent.
If we have not been acknowledged that we have collected personal data of minors without the consent of persons exercising parental power or from quasi-incompetent persons and incompetent persons without the consent of their legal curator and guardian (as the case may be), we will delete the personal data at the earliest convenience unless we can collect, use, disclose and/or transfer such personal data by relying on other legal bases apart from consent.
- Sources of personal data collection
We may collect your Data in various ways, including:
- (1)
Through the service channels We may collect your data directly from you both via branches or offices, either online or offline channels, or long distance service (e.g.telephones, mobile applications, and other promotional and marketing channels).
- (2)
From sources other than through the service channels We may collect your data from other sources such as when you contact us before carrying out transactions, applying for products and services, requesting for pitching documents or proposals, participating in transactions or entering into contracts (regardless of the channels through which the contacts are made and personal data is given such as through our branches, electronic platforms, online social networks, our line official account) and information from data room with respect to transactions.
- (3)
Other sources We may collect your data from other sources such as public sources, government data portal (e.g., reliable personal data from governmental authority database), your employer, the entities to which we provide the services (including their websites, online social networking profiles), service providers engaged by us to collect personal data on our behalf, and/or affiliates or our business partners (such as insurance companies or our business partners platform), or representatives of your current employer) and other third parties.
- Purpose of collection, use, disclosure and transferring your personal data
We may collect, use, disclose, and transfer your personal data for various purposes, depending on why and how you interact with us. The following are the purpose of processing of your personal data.
- Provision of the products and services such as to support and facilitate your application for products and services, credit approval process, to provide assistance and interact with you regarding the products and services, to provide customer service (including, but not limited to respond to your queries), to transfer ownership of vehicles, to process and provide you with quotation, to process and pass on your application form to third parties to offer an appropriate insurance plan, to deliver and receive insurance policy, to facilitate, to facilitate you when you wish to apply for products and services from other third parties (such as the issuance of insurance policies, insurance claim and compensation, cancellation of your insurance policies), to manage your account, to take steps in relation to application, contract or interact with you, to support and improve our products and services information provided to you, In some cases, for termination of contract or relationship with you, to process and consider your credit, to conduct risk assessment relating to loan and insurance approval, to verify your information which you provided to us or our service provider.
- Identity verification such as to carry out the processes and steps of customer identification in the Know Your Customer (KYC) procedure or Customer Due Diligence (CDD), to check the data or to conduct background checks in relation to anti-money laundering, allowing you to access your accounts, verification, affirmation, and for verification your identity and your signature, to verify your location and to record your personal identification security question for mobile applications or websites.
- Transactions and/or payments processing such as to proceed with payment or transactions, to manage and collect fees, to calculate, to deduct, to refund or to perform account clearing or reconciliation activities including any other financial activities including carrying out transactions, to keep payment records, to issue invoice or tax invoice or payment receipt and to deliver such documents.
- Communications and relationships management such as to inform you results of application for obtaining products and services, to contact you via SMS for delivering letters or documents (e.g., welcome letter, PIN number and credit card number, insurance policy, notifications on renewal of insurance products, bills or notifications letter based on due date, letter for debt collection) and tracking postal delivery status, notification with respect to collaterals value that you can reclaim, to provide technical support and solutions to you, to update your data , to provide support relating to services, to handle your complaint, to response and perform action according to your request and in connection with our products or services offered or provided by us and for account management and relationship management.
- Debt collection to collect outstanding or overdue payment by us or debt collection service provider, to reimburse money, to track and return asset, or to regain assets from you and to manage your account as appropriate to your situation (including exercising our legal right for debt collections and recoveries on overdue accounts )
- Advertising and marketing such as to provide you with promotion, special offers and privileges (including, but not limited offering discounts), to provide award and/or lucky draw campaign or any other collaborative marketing campaign or business partner campaign and direct advertising or one-to-one marketing, to display online advertisements, to provide offers or promotions tailored to the target customer, to process and manage your account and activities, to strategize and devise digital marketing plan, to manage social media relationship, to conduct market analysis and research , marketing research and assess or improve of market efficiency, to inform and update on social media regarding marketing campaign and update on our communications, announcements, news and or other form of information on products and services including advertising and reward from us, affiliates and our business partner, other related communications from agency.
- Recommendations and your preferences settings we collect information about your settings preferences such as our products or services that you may be interested to modify our advertisement, adjust your personal experience to recommend products or services which we believe may be of interest to you. In addition, we may use social media to display online advertisement and special offers. In some cases, we may offer products and services tailored to your interest and clickstream/online website history (including our company website)
- Improvement of products and services such as to improve our existing market efficiency, to improve ways of offering our products and services, to analyze data for system improvement (e.g. to develop a model of customer segmentation for enhanced efficiency in providing the products and services), to analyze data for improved business opportunities, to inspect bill or invoice and random welcome letter for accuracy improvement, to improve and solve problems to existing products and services and develop new services and products, to conduct customer satisfaction surveys for service improvement, to examine which parts of our online channels you visit and other online channels you interact with or which aspects of online channels you find most useful, to evaluate user interface and experiences, to test features or functionalities (Debug) and error repair, to analyze the use of our online products and services, to configure and improve website efficiency and improve your experience on platform use, to recognize your login in browser and device that you use, to identify and solve problems to existing products and services and to carry out qualitative development of data.
- Risk assessment such as to assess risks based on your profile and information obtained to determine eligibility for Products and Services, to evaluate your application or eligibility for services (such as to conduct credit scoring for auto loans products and approve your application for auto loans, to understand your objectives of loan application, business transaction, title loans and your source of income. In addition, to carry out risk assessment based on repayment capacity, to conduct an on-going risk assessment, to conduct data analysis to protect company from potential risk (e.g., develop a model to assess potential of non-performing loan (NPL) or assess potential of accidents) to control risk of the company, to verify and record of verification and credit risk records.
- Achieving our business purposes such as to adjust/modify your data accurate and complete, to maintain business records and other data to manage and maintain normal business operations and to manage internal process and comply with our internal procedure, policy and/or our internal process.
- Proceedings for legal purposes such as to protect security and stability of the company, to exercise legal rights and protect company interest, as and when necessary such as prevent fraud risk, and resolve fraudulent activities and to conduct fraud risk assessment, to find, detect fraudulent activities, to make a legal claim of Intellectual property infringement or bringing any legal claims, to manage and to prevent property loss, to conduct and verify against Sanction List, to manage risks, to conduct an internal audit process and record, to manage assets and systems, to control other business, to prevent and protect security for life, body, health, to investigate and verify compliance with terms and conditions of the company, to monitor incident, to protect and report criminal fault and to bring security and stability to the company, to make references and used as evidence for legal claims or legal proceedings.
- Proceedings for legal purposes such as to comply with law, legal proceedings or government authorities' orders which may include orders from government authorities outside Thailand, and/or cooperate with court, regulators, government authorities and law enforcement bodies when we reasonably believe that we are legally required to do so, and when disclosing your personal data is strictly necessary to fulfill the said legal obligations, proceedings, government orders, our and our affiliates' codes of conduct and internal policies; to exercise our rights or defend against legal claims ( including to collect outstanding or overdue payment, to carry out public auction, to recover an overdue accounts), to maintain record keeping and resolve complaints and disputes, to process data for activities and process result of activities and to report credit result and to supervise and carry out tax reporting and to disclose for review/audit purpose.
- Managing websites and platforms such as to operate information technology, to manage communication systems, to implement information technology security and inspect information technology security, to maintain, use, follow up, inspect, and manage websites and platforms, to facilitate and ensure the accuracy, efficiency and security of websites and platforms, to facilitate you when you access our websites and platforms, to improve platforms layouts and content and to enable you to access our existing system and to provide technical support to you.
- Corporates transactions In the event of sale, transfer, merger, reorganization, or similar event, to disclose and transfer your personal data to one or more third parties as part of that transaction
- Protecting vital interest to prevent or suppress a danger to a person’s life, body or health
- Preventing security risk such as to inspect network logging records, to inspect security incidents, to perform security inspections, to prevent damage to data, fraudulent action or deception or illegal activities including activities relating to data maintenance.
- Purposes for processing sensitive personal data
- To submit your copy of your identification card to relevant authorities and/or organizations. :
Religion (as revealed in your identification card)
- Remark : We do not intend to collect or record your sensitive personal data revealed in your identification card on our system.
- To conduct background check, proceed our underwriting process, to use for our products and services : Criminal records
- To request proposal for insurance policy and to proceed insurance claim or to claim insurance compensation, to take steps relating to claim compensation, to proceed payment on behalf of the insured for insurance compensation in excess of permitted rate by law : Health data
- To request proposal for insurance policy and to proceed insurance claim or to claim insurance compensation, to take steps relating to claim compensation,, to proceed payment on behalf of the insured for insurance compensation in excess of permitted rate by law : Disability data
- To authenticate and verify customer's identity and to carry out the Electronic Know Your Customer (E-KYC processes), to create customer’s electronic signature : Biometric data (e.g., fingerprints, facial recognition data)
Remark: Please be informed that we collect your personal data where required by law, to enable us to enter into contract or to perform contractual obligation under the contract, to carry out/organize event in accordance with terms and condition, to perform any action for the above mentioned. If you do not provide us with certain types of personal data when requested, we may not be able to archive the above mentioned purposes.
- Who we may disclose your Personal Data to
We may disclose your Personal Data to the following parties for the purposes as described above.
- Financial group and group companies of Bank of Ayudhya Public Company Limited (BAY) We may disclose your Personal Data to other Financial group and group companies BAY.
For more information, please click on the link below to access Fact Sheet: (https://www.krungsri.com/bank/th/InvestorRelations/GeneralInformation/FACT-SHEET.html)
- Business Partners We may disclose your Data to companies that we have collaborated with to offer or enhance services to our existing or prospect customers such as Insurance company, payment platform provider, analytics service provider, research agencies, survey agencies, marketing agencies, advertisement service providers, telecommunications service providers, marketing service providers.
- Service providers We may engage other companies to provide services on behalf of us and to support us in our business operations. We may disclose your data to these service providers, or they may collect your data on our behalf, for various business purposes such as data and/or document storage, cloud service, information technology service providers, platform service, network service, infrastructure service, software service providers, website developer, risk management service providers, automatic call distributors, auto response platform providers, websites, applications, call center service providers, SMS sending service providers, supporting platform service providers, business administrative service providers, debt collectors, ,audit advisors, legal advisors printing service providers, news reporters and public relations service providers.
- Third parties We may disclose or transfer your data to your representatives/third parties that have roles in delivering services to you or someone acting on your behalf or third parties including agents, representatives, dealers/distributors that delivery your loan application to us, payment system service providers and credit card payment service providers, guarantor, third parties who claim for compensation, financial specialists who assist in securitization operations and/or valuation of company assets, debt collection agencies and assets seizure agencies.
- Third parties as an authorized or permitted person by you We may disclose your data based on your consent or your instruction
- Credit bureau We may disclose your data to Credit rating agencies including disclosing to the National Credit Bureau (NCB) to report and inspect your financial status and to comply with other legal requirements.
- Prospective buyer (including agencies and advisors) if we intent to sell all or any part of our business or if any third parties acquires the entire asset, your personal data shall be transferred as part of our assets. In such cases, we will inform our buyer that any purpose of personal data processing must demonstrate their compliance with this privacy notice.
- Government authorities and others organizations to which personal data are disclosed in accordance with a legal obligation or necessary purposes we may your data for legal or necessary purposes to government entities, law enforcement bodies, court, regulatory agencies or any third parties for compliance with law and/or necessary purposes such as
- To comply with the request from regulatory agencies or government agencies for the purposes of responding to requests from regulators, to comply with legal orders, to inspect or investigate by government agencies, to comply with the law enforcement request, lawful orders or legal procedures/claims.
- To comply with other legal purposes such as to enforce our terms and conditions, to exercise our legal rights or defend against legal claims or when we consider that it is necessary or appropriate to protect our legal right, to prevent or suppress a danger to a person’s life, body, or health, to protect private property, to detect and prevent fraud or resolve fraudulent activities.
- Transfer of your Personal Data to other countries
Your personal data are processed and protected in accordance the data protection law applicable to Thailand. We may need to disclose or transfer your Personal Data to Cloud platforms or servers located overseas, to provide information technology support outside of Thailand, or transfer to other third parties for lawful purpose such as to conduct credit scoring and for risk assessment purpose and some recipients of your Personal Data are located in another country for which the Personal Data Protection Committee under the Thai Personal Data Protection Act B.E. 2562 has not been ruled that such country has adequate data protection standard. When it is necessary for us to transfer your Personal Data to a third country with a level of data protection standards not equivalent to Thailand, we will ensure that an adequate degree of protection is afforded to the transferred Personal Data.
- How long we will store your personal information
We will store your Personal Data for as long as it is necessary for the purposes for which it was collected, as explained in this Notice and in accordance with the applicable data protection law. Generally, your personal data shall be retained 10 years after end of relationship or from the last date that you interact with us. However, we may retain your Personal Data for a longer period as long as your personal data are necessary to be retained or in order to comply with applicable laws and regulations and our requirements.
- Your rights
Subject to the applicable data protection laws in Thailand, you may have a number of rights regarding the collection, use, disclosure and/or transfer of your personal data, including:
- Right of access : you can obtain information relating to the collection, use, disclosure and/or transfer of your Personal Data, and a copy of your Personal Data, together with information regarding the source of those Personal Data ;
- Right to rectification : where you consider that your personal data is inaccurate, not up to date or incomplete, you can require that such personal data be modified accordingly;
- Right to be forgotten : you can request the deletion, destruction or anonymization of your personal data to the extent permitted by law. However, we may not approve your request if there are any other individual rights which may be affected by your request, or if the deletion, destruction or anonymization may affect security, contract or if it is not permitted by law.
- Right of restriction : you can request us to restrict the use of your personal data if you believe that the use of your personal data is not appropriate, or you would like to restrict/object the use of your personal data instead of deletion or destruction of your personal data.
- Right to data portability : where legally applicable, you have the right to request us to provide your Personal Data in a structured, commonly used and machine-readable format, and transmit it to another organization but you can exercise this right provided that (i) you have provided us with such personal data and (ii) our processing of your personal data rely on your consent or our contract with you
- Right to object of data processing : you can object to the collection, use, disclosure and/or transfer of your Personal Data (e.g. your Personal Data for direct marketing purposes).
- Right of consent withdrawal : your consent: where you have given your consent for the collection, use, disclosure and/or transfer of Personal Data, you have the right to withdraw your consent at any time.
- Right to complaint : you are also entitled to lodge a complaint with the competent authority regarding the collection, use, disclosure and/or transfer of your Personal Data by us or on our behalf. We would, however, appreciate the chance to deal with your concerns before you approach the competent authority, so please contact us in the first instance.
Your request for exercising any of the above rights may be limited by the applicable laws. There may be certain cases where we can reasonably and lawfully decline your request. If you would like to exercise your rights, you may contact us at the address in “Contact us” section.
- Changes of this Notice
This privacy notice may be amended or updated from time to time for various purposes, such as to keep up with changing technology, to comply with recent law changes. Any changes in privacy notice will take effect after we publish on our websites and if any significant changes have been made to our privacy notice, we will provide you with information and/or obtain your consent (if required).
- Links to other websites
For users of our websites, platforms, applications and customer, you may notice some links to websites operated by third parties. Please be assured that our communication channels will take you to the secured and protected sites, which committed to protect your privacy. In general, these third parties websites are not within our control and we shall not be responsible for the contents, or policies of any linked sites, unless clearly specified otherwise. Your personal data provided to third party linked sites shall be processed by third parties and shall be governed by privacy notice/policy of the linked sites (if any) and not subject to this privacy. Under these circumstances, your personal data shall not subject to our control and we shall not be responsible for any processing of your personal data provided to third party linked sites.
- Contact Us
We have recognized the importance of personal data protection of our customer and we are committed to fulfill our obligation according to the Personal Data Protection Act, B.E. 2562. You may contact our Data Protection Officer (DPO) for any complaints regarding our privacy practices by email us at: [email protected] or if you have any queries or you would like to exercise your right in relation to your personal data, you may contact us through the following contact details:.