The companies, as listed in SUMMIT GROUP (collectively referred to as the “Companies”) acknowledge and recognize the importance of the right to privacy and the right to personal data of all persons which are important rights guaranteed and protected by law. As certain data that the Companies needs to receive from you for the benefit of providing services and operating the business of the Companies are of the nature of personal data that are protected by law, the Companies are committed to establishing good standards in the performance and protection of such personal data. In order to ensure that the collection, use or disclosure of such personal data is in accordance with the requirements of the Personal Data Protection Act B.E. 2562, the Companies have prepared this Personal Data Protection Notice to inform you of the details of your personal data that the Companies collect, use or disclose, the period of retention of such personal data, including the need and purpose for collecting, using or disclosing your personal data, and your legal rights. Please carefully read and understand this Personal Data Protection Notice for the benefit of exercising any of your relevant rights to the Companies.

If you have any questions regarding personal data under this Personal Data Protection Notice, you can contact the Companies through the channels that are most convenient for you as detailed below.

How do the Companies collect your personal data?

In collecting your personal data, the Companies will collect your personal data directly from our interaction with you through various channels, such as through you filling in your data in a request form, contract, letter, or other documents; or through electronic systems such as filling in data via the Companies’ website, cookies, applications, or through other channels. In certain cases, the Companies’ may receive your data from other sources, such as referrals about you from your friends or associates, or from any public source that the data are generally disclosed, etc.

In collecting your personal data, the Companies will collect personal data only as necessary under lawful purposes, and only for the purposes that have been notified to you before or at the time of the collection of personal data.

What personal data of yours do the Companies collect?

In the operation of the Companies’ businesses, the Companies are required to collect your personal data for the purpose of operating business and providing services to you.

Using your personal data for marketing

The Companies may use your personal data to offer products or services that may be of benefit to you and may contact you from time to time to inform you of existing or new products or services. The Companies may also disclose your personal data to related companies or trading partners so that such related companies or trading partners can inform you of their products or services through various marketing channels by electronic communication, e-mail, telephone, text messages and other forms of communication. This is only to the extent that you have given your consent.

If you wish to change any contact method that you have previously informed the Companies or if you no longer wish to receive any of the above marketing information, you can notify the Companies at any time in order to exercise your relevant rights in the “Contact with the Companies” section.

In what cases do the Companies disclose your personal data?

The Companies will retain your personal data without disclosing your personal data to third parties or the public except where it is for purposes that have been notified to you, or where your express consent has been received, or where there are legitimate grounds to do so.

Transferring of personal data abroad

In the operation of Companies’ businesses, the Companies will not transfer or disclose your personal data to recipients located abroad, except where it is for purposes that have already been notified to you, or where your express consent has been received, or where there are legitimate grounds to do so.

Data security and personal data protection

The Companies have taken various measures to keep your personal data safe. This includes restricting access of data to personnel who have relevant duties and responsibilities, fostering understanding and conducting training to the Companies’ employees and personnel to comply with appropriate personal data protection standards, assigning duties to both the Companies’ personnel and data processors to comply with appropriate personal data standards, including the duty to prevent data leaks and the duty to implement security measures appropriate to the processing of data.

If you have reason to suspect that your personal data has been violated or if you have questions about the Companies’ protection of your personal data, you can contact the Companies in the “Contact with the Companies” section.

Rights of the data subject

As a data subject, you are entitled to the protections under the Personal Data Protection Act B.E. 2562 as follows:

(1) Right to withdraw consent

In cases where the Companies have requested and obtained your consent to collect, use or disclose your personal data, you have the right to withdraw such consent to the Companies’ collection, usage, or disclosure of the data at any time. The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof.

(2) Right to request access and right to obtain a copy of the personal data

You have the right to request access and obtain copies of your personal data collected by the Companies. The Companies will consider your request in order to take appropriate actions within 30 days of the date of receipt thereof. However, the Companies reserve the right to reject such request if such refusal is in accordance with the law or court order and such access to and/or obtaining a copy of personal data may cause damage to the rights and freedoms of other persons.

(3) Right to request for disclosure of the acquisition of personal data that the Companies have obtained without your consent or from other sources

You have the right to request for disclosure of the acquisition of personal data that the Companies have obtained without your consent. If the Companies have obtained your personal data from a source other than from you directly and intend to collect such data, the Companies will notify you within 30 (thirty) days of the date of such receipt in order to request consent, unless it falls within the legal exemption, in which case, you have the right to request the Companies to disclose the source from which your personal data has been obtained.

(4) Right to obtain personal data and request the Companies to transfer or forward your personal data to another data controller, in the event that the Companies transform your personal data into a format that can be read or used by an automated device and can be forwarded by automatic means

You have the right to obtain your personal data from the Companies in the event that the Companies transform your personal data to a format that can be read or used by automated equipment or device and can be used or disclosed by automatic means. This right includes the right to request the Companies to transfer or forward personal data in such form to other personal data controllers whenever possible by automated means and the right to directly receive the personal data that the Companies transfer or forward in such form to the other personal data controllers unless it is not possible due to technical conditions. The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof. However, the Companies reserve the right to reject any such requests if the forwarding or transfer of personal data is for the exercise of duties for the public benefit or the exercise of duties in accordance with the law of the company or may breach the rights and freedoms of other persons.

(5) Right to object to the collection, use, or disclosure of the personal data

You have the right to object to the collection, use, or disclosure of your personal data by the Companies in accordance with the law or where it is:

1. The collection of personal data in the case where the consent from the data subject is not required because it is necessary for the legitimate interests of the Companies or another juristic person who is not the data controller; this is unless the Companies can prove overriding legitimate grounds for the collection, use, or disclosure of the personal data; or

2. The collection, use, or disclosure of personal data is for the purpose of direct marketing.

When the Companies receive your request to exercise such right, the Companies will immediately separate your data from other data. However, the Companies reserve the right to reject your request if the Companies can prove that the collection, use or disclosure of personal data in the case where the consent from the data subject is not required because it is necessary for the legitimate interest of the Companies was based on overriding legitimate grounds, or was for the establishment of legal rights, the compliance with law or exercise of legal claims, or for raising the defense of legal claims. The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof.

(6) Right to request the Companies to erase or destroy or make personal data unidentifiable

You can request the Companies to erase or destroy your personal data and/or make your personal data become unidentifiable in the following circumstances:

1. When it is no longer necessary to retain the personal data according to the specific purpose;

2. When you withdraw your consent to the collection, use or disclosure of the personal data and the Companies have no legal grounds for collection, use or disclosure of such personal data;

3. When you exercise your right to object to the collection, use or disclosure of personal data and the Companies do not have any grounds to refuse; or

4. When the personal data has been unlawfully collected, used, or disclosed.

The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof. However, the Companies reserve the right to reject such request if it is necessary and the Companies have legitimate grounds according to the law to reject such request.

(7) Right to request the Companies to suspend the use of your personal data

You can request the Companies to immediately suspend the use of your personal data in the following circumstances:

1. Where the Companies are in the process of verifying for accuracy and completeness, or updating personal data and not causing any misunderstanding at your request;
2. Where the personal data may be erased or destroyed, but you want to suspend the use of the personal data instead of the erasure or destruction thereof;
3. When it is no longer necessary to retain the personal data according to the specific purpose, but it is necessary you to request that such personal data be retained for the establishment of legal rights, the compliance with law or exercise of legal claims, or for raising the defense of legal claims; or
4. When the Companies are in the process of considering the objection to the collection, use or disclosure of your personal data.

The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof. However, the Companies reserve the right to reject such request if it is necessary and the Companies have legitimate grounds according to the law to reject such a request.

(8) Right to request the Companies to rectify your personal data to be accurate, current, complete, and not cause misunderstanding

In the case that any change occurs which may affect the personal data that you have provided to the Companies or that the Companies have collected, if it is still within the retention period of the personal data, you may request the Companies to rectify or update your personal data at any time. The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof.

(9) Right to complain in case of breach of the requirements according to the Personal Data Protection Act B.E. 2562

If you find that there is any breach or violation of the requirements according to the Personal Data Protection Act B.E. 2562 with respect to your personal data, you can make a complaint to the Companies and/or the relevant government entity. The Companies will consider your request in order to take appropriate actions within 30 (thirty) days of the date of receipt thereof.

Contact with the Companies

You can contact the Companies through the following channel:

Personal Data Protection Department

Use of cookies to collect personal data

Cookies are a form of file containing text. Cookies are created when a user accesses a website on which the server creates a cookie. Cookies will be recorded on your browser when you visit that website. The content in cookies can only be retrieved for viewing or reading by the server that created the cookie and will be sent back to the origin website in each visit. The text contained in cookies often contains data that can identify persons, the name of the website, as well as certain numbers and letters. Cookies store details of your browsing behaviour and what is frequently chosen by you and your browser.

More details about the collection, use and disclosure of your personal data via cookies can be found in our “Cookie Policy”

Other websites

This website may contain links to other websites. If you click on links to other websites, you may allow third parties to collect and disclose your data. The Companies do not control those other websites and are not responsible for their operations in relation to personal data protection. When you leave the Companies’ websites, the Companies recommends that you read the personal data protection policy of every website you visit.