Privacy Notice

Dear Customers,

ICBC (Thai) Leasing Company Limited (“ICBC Leasing”, “we” or “our”) values a privacy and strives to protect your personal data or personal data relating to individuals connected to your business (collectively referred to as “Personal Data”) based on the law of Thailand.

This Privacy Notice explains: -

• What kind of Personal Data do we collect? This includes what you tell us about yourself or the individuals connected to your business (collectively referred to as “you”, “your” or “yourself”) and what we learn by having you as the customer, and the choice you give us about what marketing information you want us to send to you
• How do we use your Personal Data?
• Who do we disclose the Personal Data to?
• What are the choices we offer, including how to access and update your Personal Data?
• What are your privacy rights and how the law protects you?

1. What kind of Personal Data do we collect?

We collect many different kinds of your Personal Data, depending on various circumstances and nature of requested products, services and/or transactions performed.

We may collect the Personal Data about you from a variety of sources as follows: -

• When you apply for our products and/or services
• When you talk to us on the phone or in branch, including recorded calls, posts, e-mails, notes and other means
• When you use our websites or mobile device applications. This includes cookies and other internet tracking software to collect the Personal Data. Please refer to our Cookies Policy for more information
• Insurance claims or other documents
• Financial reviews and interviews
• Customer surveys
• When you take part in our competitions or promotions
• When you manifestly publish your Personal Data, including via social media (e.g., we may collect your Personal Data from your social media profile(s), to the extent that you choose to make your profile publicly visible)
• When we receive your Personal Data from third parties, e.g., your employer, our customers, credit reference agencies, law enforcement authorities, etc.
• When you purchase any of our products or services from the third parties

We sometimes collect the Personal Data from additional online and offline sources including commercially available third-party sources, such as credit reporting agencies (including the National Credit Bureau). We may combine this information with the Personal Data we have collected about you under this Privacy Notice.

In some instances, we may engage unaffiliated third parties to collect the Personal Data about your online activities when you visit our online sources. We may also use the Personal Data collected across non-affiliated websites for the purpose of serving you advertisements related to your browsing behaviour. While we engage in this practice, we will provide an appropriate notice and choice so that you can opt-out such processing.

The categories of Personal Data about you that we process, subject to the applicable law, are as follows: -

• Personal details: given name(s), preferred name(s), surname, gender, date of birth, marital status, personal identification number, passport number, other government issued number(s) as well as other personal data appeared on government issued documents, tax identification number, vehicle chassis number, nationality, image of passport, driving license, signatures, authentication data (e.g., passwords, mother’s maiden name, PINs, facial and voice recognition data), photographs, visual images and CCTV images
• Family details: names and contact details of family members and dependents
• Contact details: address, telephone number, email address and social media profile details
• Education history: details of your education and qualifications
• Financial details: billing address, bank account numbers, credit card numbers, cardholder or accountholder name and details, instruction records, transaction details and counterparty details
• Electronic data: IP addresses, cookies, activity logs, online identifiers, unique device identifiers and geolocation data

2. How do we use your Personal Data?

We may collect and disclose your Personal Data only if we have proper reasons and it is lawful to do so. This includes sharing it outside ICBC Leasing.

We will rely on one or more of the following lawful grounds when processing your Personal Data: -

• When it is to fulfil a contract we have with you;
• When it is our legal duty;
• When it is in our legitimate interest; and/or
• When you consent to it.

The purposes for which we may process your Personal Data, subject to the applicable law, and legal basis on which we may perform such processing, are: -

When we rely on the legitimate interests as the reason for processing the Personal Data, it has considered whether your rights are overridden by our interests and has concluded that they are not.

3. Who do we disclose the Personal Data to?

We may share your Personal Data with others where it is lawful to do so, including where we or they: -

• need to provide you with a requirement under a contract, or products and/or services you have requested, e.g., to fulfil a payment request

• have public or legal duties to do so, e.g., to assist with detecting and preventing fraud, tax evasion and financial crime, etc.
• need to, in connection with a regulatory reporting, litigation or asserting or defending legal rights and interests;
• have legitimate business reasons to do so, e.g., to manage risk, verify identity, enable another company to provide you with the services you have requested or assess your suitability for the products and/or services
• ask for your permission to share it, and you agree.

We may share your Personal Data for these purposes with others, including: -

• other ICBC group companies and any sub-contractors, agents or service providers who work for us or provide the services to us or other ICBC group companies, including their employees, sub-contractors, service providers, directors and officers
• any trustees, beneficiaries, administrators or executors
• people who give guarantee, warranty or other securities for any amount you owe us
• people you make the payment to and receive the payment from;
• other financial institutions, lenders and holders of securities over any properties or assets you charge to us, credit reference agencies, payment service providers and debt recovery agents
• any insurance brokers, dealers, intermediaries and/or any other entities who introduce you to us or deal with us for you
• any people or companies where required in connection with a potential or actual corporate restructuring, merger, acquisition or takeover, including any transfer or potential transfer of any of our rights or duties under our agreement with you
• law enforcement, government agencies, courts, dispute resolution bodies, our regulators, auditors, tax authorities, trade associations and any parties appointed or requested by our regulators to carry out investigations or audits of our activities
• other parties involved in any disputes, including disputed transactions
• fraud prevention agencies who will also use it to detect and prevent fraud and other financial crime and to verify your identity
• anyone who provides instructions or operates any of your accounts, products or services on your behalf, e.g., Power of Attorney, solicitors, intermediaries, etc.
• anybody else that we have been instructed to share your Personal Data with by you

There may be instances which we may share non-personally identifiable information about you to third parties, such as advertising identifiers or one-way coding (cryptographic hash) of a common account identifier, such as a contact number or e-mail address, to enable the conduct targeted advertising.

Except as described in this Privacy Notice, we will not use the Personal Data for any purposes other than the purposes as described to you in this Privacy Notice. Should we intend to collect, use or transfer additional information which are not described in this Privacy Notice, we will notify you and obtain your consent prior to the collection, use and disclosure where we are required to get the consent according to the applicable law. You will also be given the opportunity to consent or to decline approval of such collection, use and/or transfer of your Personal Data.

We will continue to adhere to this Privacy Notice with respect to the information we have in our possession relating to prospective, existing and former clients and investors.

Cross-border Transfer of Personal Data

Your Personal Data may be transferred to and stored/processed in other countries.

Such countries may not have the same level of protection for the Personal Data. When we do this, we will ensure it has an appropriate level of protection and that the transfer is lawful. We may need to transfer the Personal Data in this way to carry out our contract with you, fulfill the legal obligations, protect the public interests and/or for our legitimate interests. In some countries, the law might compel us to share certain Personal Data, e.g., with tax authorities or National Bank. Even in these cases, we will only share the Personal Data with people who have the right to see it.

4. Retention of Personal Data

We retain your Personal Data for as long as it is necessary to carry out the purposes for which it was collected, e.g., for business and legal purposes, or compliance with the applicable laws.

We may keep your Personal Data for up to 10 years after you stop being our customer to ensure that any contractual dispute that may arise can be processed within that time. However, in the event of regulatory or technical reasons, we may keep your Personal Data for more than 10 years. If we do not need to retain your Personal Data for longer than it is legally necessary, we will destroy, delete or anonymize it.

Where you receive the products and/or services from third party, e.g., insurance company, who has been introduced to you by us, such third party may keep your Personal Data in accordance with additional terms and conditions applying to their product and services.

5. Accuracy of Your Personal Data

We need your help to ensure that your Personal Data is current, complete, and accurate. Please inform us of any changes to your Personal Data by: -

We will occasionally request the updates from you to ensure the Personal Data we use to fulfill the purposes of collection; use and/or disclosure are current, accurate and complete.

6. What are your privacy rights and how the law protects you?

• Right to withdraw: This enables you to withdraw your consent to our processing of your Personal Data, which you can do at any time. We may continue to process your Personal Data if we have another legitimate reason to do so
• Right to Access: This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it
• Right to Correct: This enables you to have any incomplete or inaccurate information we hold about you corrected
• Right to Erasure: This enables you to ask us to delete or remove, destroy or anonymize your Personal Data where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below)

• Right to Object: This enables you to object to the processing of your Personal Data where we are relying on the legitimate interest and there is something about your particular situation which makes you want to object to the processing on this ground. You also have the right to object where we are processing your Personal Data for direct marketing purposes and profiling activities (the automated processing of your information to help us evaluate certain things about you, for example, your personal preferences and your interests) relating to direct marketing
• Right to Restrict Processing: This enables you to ask us to suspend the processing of your Personal Data, for example, if you want us to establish its accuracy or the reason for processing it
• Right to Portability: In some cases, you will be able to obtain a copy of your Personal Data that is generally available in electronic form. This right can only be used in the case of Personal Data you submit to us and the processing of such Personal Data is done with your consent or in the event that such personal data needs to be processed in order to be able to fulfil obligations under the contract; and
• Right to Lodge a Complaint: This enables you to file the complaint with a related government authority, including but not limited to, the Thailand Personal Data Protection Committee in the event you see that we, our staff or service provider violates or fails to comply with the Personal Data Protection Act B.E. 2562 ("PDPA") or other announcements issued by virtue of PDPA.

Handling of Complaints

In the event that you wish to make the complaint about how we process your Personal Data, please contact us and we will try to consider your request as soon as possible. This does not prejudice your right to file the complaint with a government authority that has a data protection authority.

7. Security of Your Personal Data

Information is our asset and therefore we place a great importance on ensuring the security of your Personal Data. We regularly review and implement up-to-date physical, technical and organizational security measures when processing your Personal Data. We have internal policies and controls in place to ensure that your Personal Data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the performance of their duties. Our employees are trained to handle the Personal Data securely and with utmost respect, failing which they may be subject to a disciplinary action.

8. Your Responsibilities

You are responsible for making sure that the Personal Data you give us or provided on your behalf, is accurate and up to date, and you must tell us as soon as possible if there are any updates.

You have some responsibilities under your contract to provide us with the Personal Data. You may also have to provide us with the Personal Data in order to exercise your statutory rights. Failing to provide the Personal Data may mean that you are unable to exercise your statutory rights.

Certain Personal Data, such as contact details and payment details, must be provided to us in order to enable us to enter into the contract with you. If you do not provide such Personal Data, this will hinder our ability to administer the rights and obligations arising as a result of contract efficiently.

9. Revision of Our Privacy Notice

We keep our Privacy Notice under a regular review and thus the Privacy Notice may be subject to change. The date of the last revision of the Privacy Notice can be found on the top of the page.

10. Contact Us

If you have any questions in regard to the protection of your Personal Data or if you wish to exercise your rights, please contact: -

Last modified date 5 January 2021