Privacy & cookie policy

Privacy Policy (Personal Data Protection Policy) of BM Corporation Co., Ltd. and Its Affiliated Companies

BM Corporation Co., Ltd. and its affiliated companies (hereinafter collectively referred to as the “Company”) respect the right to privacy and attach importance to the protection of the personal data of persons who are connected with or transact with the Company. The Company has therefore prepared this Personal Data Protection Policy in order to establish clear and appropriate rules, mechanisms, supervisory measures and management of personal data in accordance with the personal data protection law and other relevant laws. The Company hereby informs you of the following information in compliance with the Personal Data Protection Act B.E. 2562 (2019), the essential particulars of which are as follows.

1. Scope of Application

This Personal Data Protection Policy applies to the work performed by all employees, meaning permanent employees, fixed-term contract employees and temporary employees, as well as data processors acting on behalf of the Company, agents, consultants and recipients of data from the Company.

2. Definitions

2.1. “Personal Data” means any information relating to a person which enables the identification of such person, whether directly or indirectly, but specifically excluding the information of deceased persons.

2.1.1 Personal data that you have provided to the Company directly, or that the Company holds as a result of your use of products and/or services, or your contacting, visiting or searching through digital channels, branches, websites, the Call Center, authorised persons or any other channel.

2.1.2 Personal data that the Company has received or is able to access from other sources and not directly from you, such as government agencies, companies within the business group and business partners. The Company will collect data from other sources only upon receiving your consent as required by law, unless the Company has a necessity in a case permitted by law.

Your personal data that the Company collects, uses and/or discloses includes, for example:

• Personal information, such as first name, surname, age, date of birth, marital status, national identification number and passport number
• Contact information, such as residential address, place of work, telephone number, e-mail address and LINE ID
• Device or tool information, such as IP address, MAC address and Cookie ID
• Other information, such as website usage, voice, still images, moving images, and records of interactions and communications between you and the Company in any form or by any means whatsoever, including but not limited to telephone, e-mail, chat messages and communications via social media, and any other information deemed to be personal data under the personal data protection law

Where the Company collected your personal data before 1 June 2021, the Company will handle such data in accordance with the provisions of the law on personal data protection.

2.2. “Sensitive Personal Data” means data that is genuinely personal to an individual but is sensitive and may pose a risk of unfair discrimination, such as race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data which affects the data subject in a similar manner as prescribed by the Personal Data Protection Committee.

2.3. “Processing” means any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure (by transmission, transfer, dissemination or otherwise making accessible or available by any means), arrangement, combination, blocking or restriction, erasure or destruction.

2.4. “Data Subject” means a natural person who is the owner of personal data, where such personal data can identify that person, whether directly or indirectly.

2.5. “Data Controller” means a person or juristic person having the power and duty to make decisions regarding the collection, use or disclosure of personal data.

2.6. “Data Processor” means a person or juristic person who carries out activities in relation to the collection, use or disclosure of personal data pursuant to the orders of, or on behalf of, the Company; provided that the person or juristic person carrying out such activities is not a data controller.

3. Collection of Personal Data

The Company will retain your personal data for the period necessary while you are a customer of, or have a relationship with, the Company, or for the entire period necessary to achieve the relevant purposes set out in this Policy. It may be necessary to continue retaining the data thereafter if required or permitted by law, for example retention under the law on the prevention and suppression of money laundering, or retention for the purpose of proof and examination in the event of a possible dispute within the prescription period prescribed by law, for a period not exceeding 10 years. The Company will delete or destroy the personal data, or render it data that cannot identify you, when it is no longer necessary or upon the expiry of such period. The purposes for which the Company collects, uses or discloses data are as follows.

3.1 Legal obligations of the Company. As the Company is subject to supervision and is required to comply with the relevant laws and regulations, the Company needs to collect, use or disclose your personal data for various purposes in order to comply with the laws and regulations of government agencies and/or authorities having supervisory duties over the Company, including but not limited to the following purposes:

3.1.1 To comply with the Personal Data Protection Act, as amended;

3.1.2 To comply with laws (such as the securities and exchange law, the anti-money laundering law, the law on the prevention and suppression of the financing of terrorism and the proliferation of weapons of mass destruction, and other laws with which the Company is required to comply, both in Thailand and abroad), including identity verification, background checks, Know Your Client procedures, Customer Due Diligence and other checks (including checks against public databases of regulatory authorities and/or lists of designated persons), as well as ongoing actions to ensure compliance with any applicable law; and/or

3.1.3 To comply with the regulations and/or orders of persons having authority (such as court orders, or orders of government agencies, authorities having supervisory duties over the Company, or competent officials).

3.1.4 The Company will keep your personal data securely in accordance with Technical Measures and Organizational Measures in order to maintain appropriate security in the processing of personal data and to prevent personal data breaches. The Company has established policies, regulations and rules on personal data protection, such as security standards for information technology systems and measures to prevent recipients of data from the Company from using or disclosing the data for purposes other than those specified, or without authority or unlawfully. The Company has updated such policies, regulations and rules from time to time as necessary and appropriate.

In addition, executives, employees, staff, contractors, agents, consultants and recipients of data from the Company have a duty to keep personal data confidential in accordance with the confidentiality measures established by the Company.

3.2 Contracts you have entered into with the Company

The Company will collect, use or disclose your personal data in accordance with your requests and/or the agreements you have made with the Company, including but not limited to the following purposes:

3.2.1 To act upon your requests prior to entering into a contract with the Company, to consider approval of the provision of products and/or services, and to deliver products and/or services to you, including any action of the Company which, if not carried out, would affect the operations or services of the Company or would prevent the Company from providing services fairly and continuously;

3.2.2 To provide services via the internet, mobile applications and other online product platforms;

3.2.3 To verify identity, and to track, record or send notifications of your transactions through the Company's website;

3.2.4 To prepare various reports (such as transaction reports requested by you, or internal reports of the Company);

3.2.5 To demand payment of debts that you owe to the Company.

3.3 Legitimate interests of the Company

The Company will rely on the legitimate interest basis, taking into account the interests of the Company or of other persons and your fundamental rights in respect of the personal data that the Company will collect, use or disclose, including but not limited to the following purposes:

3.3.1 To manage the business of the Company and of the companies within the Company's financial business group (such as compliance monitoring and auditing, risk management, and monitoring, preventing and investigating fraud, money laundering, terrorism, misconduct or other crimes, including but not limited to checking the credibility of any person connected with the Company's corporate customers);

3.3.2 To manage the relationship between the Company and you (such as customer care, satisfaction assessments and complaint handling);

3.3.3 To maintain security (such as CCTV recording, registration, exchange of identification cards for visitor passes, and/or photographing visitors before they enter the Company's buildings, etc.);

3.3.4 To control access to buildings and to ensure that the Company's buildings and premises are safe and secure for the Company's personnel and visitors, as well as for the property and information located or stored in the buildings; to monitor and inspect access to buildings, secured locations, protected rooms, information technology infrastructure or operational data, and other areas (collectively, the “Buildings and Premises”), thereby preventing unauthorised access to the Company's Buildings and Premises; and to prevent, detect and investigate security-related incidents, such as unauthorised access to the Company's Buildings and Premises, theft, fire or physical assault;

3.3.5 To develop and improve the Company's products, services and work systems in order to raise the Company's service standards and/or to best respond to your needs, as well as to research and analyse data and to offer products and services, taking into account your fundamental rights in respect of your personal data;

3.3.6 To record images and/or sound in connection with meetings, training, seminars, recreational activities or marketing promotion activities; and/or

3.3.7 In the case of the Company's corporate customers, the Company will collect, use and disclose the personal data of directors, authorised signatories or representatives;

3.3.8 Risk management, compliance monitoring and auditing, and internal organisational management, including transfer to companies within the same group of undertakings for such purposes, under the group's personal data protection policy (Binding Corporate Rules);

3.3.9 Rendering personal data into data that cannot identify any individual (Anonymous Data);

3.3.10 Receiving and sending parcels;

3.3.11 Receiving billing submissions and receiving cheques;

3.3.12 Preventing, responding to and mitigating the risk of fraud, cyber threats, payment default or breach of contract, and various unlawful acts (such as money laundering, the financing of terrorism and the proliferation of weapons of mass destruction, and offences against property, life, body, liberty or reputation), including the sharing of personal data in order to raise the operating standards of the companies within the same group of undertakings/business in preventing, responding to and mitigating the above risks.

3.4 Your consent

In some cases, the Company may request your consent to collect, use or disclose your personal data so that you receive the greatest benefit and/or so that the Company can provide services that meet your needs, including but not limited to the following purposes:

3.4.1 Where it is necessary to collect and use sensitive personal data (such as using fingerprint recognition data or a photograph of your national identification card (which contains your sensitive personal data, namely religion and/or blood group) to verify and confirm your identity before conducting a transaction);

3.4.2 To collect and use your personal data and any other information for research and analysis in order to best develop products and services that genuinely meet your needs, and/or to contact you to offer products, services and benefits specifically suited to you;

3.4.3 To send or transfer your personal data to foreign countries which may have inadequate personal data protection standards (unless it is a case in which the Personal Data Protection Act permits such action without consent); and/or

3.4.4 Where you are a minor, an incompetent person or a quasi-incompetent person, for whom the consent of the father and mother, parent, guardian or curator (as the case may be) is required (unless it is a case in which the Personal Data Protection Act permits such action without consent);

3.4.5 To disclose your personal data and any other information to companies within the Company's financial business group and to the Company's trusted business partners for the following purposes: (1) to research and analyse your personal data and any other information in order to best develop products and services that genuinely meet your needs; and (2) to contact you to offer products, services and benefits specifically suited to you.

3.5 Other legal bases

In addition to the above legal bases, the Company may collect, use or disclose your personal data to other persons with your consent or under the criteria under which the law permits disclosure. The persons or entities receiving such data will collect, use and/or disclose your personal data within the scope to which you have consented or the relevant scope set out in this Policy.

The Company may disclose your personal data for various purposes, such as to provide services to you; to analyse, develop and improve products and/or services; to conduct research or compile statistical data; for sales promotion and public relations of the Company; for business management; for fraud prevention; and to enable others to provide support services to the Company for customer identity verification. The Company may disclose the data to various persons or entities, such as companies within the financial business group, data processors, business partners issuing co-branded products, external service providers, agents of the Company, subcontractors, auditors, external inspectors, credit rating agencies, asset management companies, legally authorised persons, prospective transferees and/or transferees of rights in transactions or mergers and acquisitions of the Company, and any juristic persons or persons having a relationship or contract with the Company, including the executives, employees, staff, contractors, agents and consultants of the Company and of the persons or entities receiving such data.

Where your personal data is disclosed to other persons for the marketing purposes of the recipients, such as for sales promotion, public relations or the offering of products and/or services of the recipients to you, the Company will inform you of the names of the recipients to assist you in deciding whether to give consent.

3.5.1 To prepare historical documents or archives for the public interest, or for purposes relating to research or statistics;

3.5.2 To prevent or suppress a danger to a person's life, body or health;

3.5.3 Where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in competent officials.

4. Purposes of the Collection or Use of Personal Data

4.1. The Company will collect or use the personal data of data subjects for the benefit of the Company's operations, or to improve the quality of work so that it is more efficient, and/or to comply with the laws or regulations relevant to the Company's operations. The Company will store and use such data only for the period necessary for the purposes notified to the data subject or as prescribed by law.

4.2. The Company will not take any action different from that specified in the purposes of collection, unless:

(1) the new purpose has been notified to the data subject and the consent of the data subject has been obtained; or

(2) it is in compliance with the Personal Data Protection Act or other relevant laws.

5. Sources of Personal Data

Generally, the Company collects personal data directly from you, but in some cases the Company may obtain your personal data from other sources, in which case the Company will act in accordance with the Personal Data Protection Act. Personal data that the Company collects from other sources may include but is not limited to the following:

5.1 Data that the Company receives from companies within the Company's financial business group, business partners and/or any other persons with whom the Company has a juristic relationship;

5.2 Data that the Company receives from persons connected with you (such as your family, friends or referrers);

5.3 Data that the Company receives from corporate customers in your capacity as a director, authorised signatory, representative, authorised person or contact person;

5.4 Data that the Company receives from government agencies, authorities having supervisory duties over the Company, credit information companies and/or external service providers (such as publicly disclosed information);

5.5 Certain technical data regarding your devices, activities and browsing patterns, and your website usage history (Browsing), collected automatically using Cookies and other similar technologies.

6. Rights of the Data Subject

Your rights under this section are legal rights that you should be aware of. You may request to exercise these rights subject to the provisions of law and the policies currently in force or as may be amended in the future, as well as the rules established by the Company. If you are under 20 years of age or your legal capacity to enter into juristic acts is restricted by law, you may request to exercise your rights by having your father and mother, the person exercising parental power, or a person having authority to act on your behalf submit the request. The details are as follows.

6.1 Right of access to and to obtain a copy of personal data. You have the right to access and obtain a copy of your personal data held by the Company, except where the Company is entitled to refuse your request under the law or a court order, or where your request would have an effect that may cause damage to the rights and freedoms of other persons.

6.2 Right to request rectification of personal data. You have the right to request the Company to rectify or update your personal data that is inaccurate or incomplete, so that it is current, complete and not misleading.

6.3 Right to request erasure of personal data. You have the right to request the Company to delete or destroy your data, or to render your data into data that cannot identify you, except where the Company has lawful grounds to refuse your request. This applies where the Company considers that it no longer needs to retain the data for the relevant purposes set out in this Policy, or when you have exercised your right to withdraw consent or your right to object as stated above.

6.4 Right to request restriction of the use of personal data. You have the right to request the Company to restrict the use of your personal data in certain cases (for example, where the Company is examining your request to exercise the right to rectify personal data or to object to the collection, use or disclosure of your personal data, or where you request the Company to restrict the use of personal data instead of deleting or destroying personal data that is no longer necessary, because you need the Company to retain your personal data for the establishment, compliance with or exercise of legal claims, or the defence of legal claims).

6.5 Right to object to the collection, use or disclosure of personal data. You have the right to object to the collection, use or disclosure of your personal data where the Company carries out such activities on the legitimate interest basis, or for purposes relating to direct marketing or scientific, historical or statistical research, except where the Company has lawful grounds to refuse your request (for example, where the Company can demonstrate compelling legitimate grounds for the collection, use or disclosure of your personal data, or that it is for the establishment, compliance with or exercise of legal claims, or for the public interest of the Company). If you lodge an objection, the Company will continue to collect, use and/or disclose your personal data only to the extent that the Company can demonstrate legal grounds that are more important than your fundamental rights, or that the processing is for the establishment of legal claims, compliance with the law, or the defence of legal claims, as the case may be.

6.6 Right to receive, or to request the sending or transfer of, personal data. You have the right to receive your personal data where the Company is able to make such data available in a format that is readable or commonly usable by automated tools or devices and that can be used or disclosed by automated means. You also have the right to request the Company to send or transfer your personal data to a third party, or to receive the personal data that the Company has sent or transferred to a third party, unless this is technically impossible for the Company or the Company has lawful grounds to refuse your request.

6.7 Right to withdraw consent. You have the right to withdraw the consent you have given to the Company at any time, in accordance with the procedures and methods prescribed by the Company, unless the nature of the consent does not permit its withdrawal. The withdrawal of your consent will not affect the collection, use or disclosure of your personal data to which you have lawfully consented prior to such withdrawal. The withdrawal of your consent may affect you in your use of products and/or services; for example, you will not receive benefits, promotions or new offers, will not receive better products or services that are consistent with your needs, or will not receive information that is useful to you. For your own benefit, you should therefore study and enquire about the consequences before withdrawing your consent.

6.8 Right to lodge a complaint. You have the right to lodge a complaint with the Personal Data Protection Committee or the Office of the Personal Data Protection Committee if the Company acts in a manner that does not comply with the Personal Data Protection Act.

6.9 The exercise of your rights described above may be restricted under the relevant laws, and there are certain cases where, for necessary reasons, the Company may refuse or be unable to act upon your request to exercise the above rights, for example, compliance with the law or a court order, the public interest, or where the exercise of the right may infringe the rights or freedoms of other persons. If the Company refuses the above request, the Company will also inform you of the reasons for the refusal.

You may request to exercise the above rights by submitting a request to the Company in writing or by electronic mail, using the form prescribed by the Company, through the “Company's contact channels” below. The Company will consider the data subject's request and notify the data subject of the result of its consideration, counting from the date on which the request and complete supporting documents are received. The Company may refuse the rights of the data subject in cases prescribed by law.

7. Disclosure of Personal Data

The Company will not disclose the personal data of data subjects to any person without consent and will disclose such data in accordance with the purposes that have been notified. However, for the benefit of the Company's operations and the provision of services to data subjects, the Company may disclose your personal data to the following persons or organisations, subject to the rules of the Personal Data Protection Act:

7.1 Affiliated companies or companies within the Company's business group, business partners and/or any other persons with whom the Company has a juristic relationship, including the directors, executives, employees, staff, contractors, agents and consultants of the Company and/or of such persons;

7.2 Government agencies, public sector agencies, state agencies and/or authorities having supervisory duties over the Company (such as the Bank of Thailand, the Office of the Securities and Exchange Commission, the Office of Insurance Commission, the Ministry of Digital Economy and Society, the Office of the Official Information Commission, the Office of Insurance Commission, the Department of Provincial Administration, the Revenue Department, the Department of Business Development and the Department of Intellectual Property);

7.3 Business partners, agents or other organisations (such as professional associations of which the Company is a member, independent auditors, securities depositories, document storage facilities and clearing houses), where the disclosure of your personal data will be for specific purposes, on a legal basis and with appropriate security measures;

7.4 Relevant persons in the event of a sale of claims and/or assets, an organisational restructuring, or a merger or acquisition of the Company, in which the Company may need to transfer rights to such undertaking, including persons with whom the Company needs to share data for the sale of claims and/or assets, organisational restructuring, transfer of business, financial arrangements, disposal of assets, or any other transaction relating to the business and/or assets used in the operation of the Company's business;

7.5 Authorities requesting disclosure of data by virtue of legal authority, such as requests for data for litigation or legal proceedings, or in connection with legal processes, for example the Anti-Money Laundering Office, the Office of the National Anti-Corruption Commission, the Royal Thai Police, the Department of Special Investigation, the Office of the Attorney General and the courts;

7.6 Third parties providing various services to the Company (such as marketing analysis and benchmarking, including but not limited to foreign correspondent agents (correspondent banking), agents or subcontractors acting on behalf of the Company;

7.7 Social media service providers (in a secure manner) or third-party advertising companies, in order to display messages to you and other persons regarding the Company's products and services. Third-party advertising companies may use your online activity history to deliver advertisements that may be of interest to you;

7.8 Third-party providers of security (collateral or guarantees);

7.9 Any other persons providing benefits or services relating to your products or services; and/or

7.10 Your attorneys, sub-attorneys, agents or legal representatives having lawful authority under the law.

8. Personal Data Retention Period

The Company will retain your personal data while you are a customer of the Company. When your relationship with the Company ends, or from the time of your transaction with the Company, or where the Company refuses your application for services, or where you request cancellation of the Company's services, the Company will retain your personal data for the appropriate and necessary period for each type of personal data and purpose as prescribed by the Personal Data Protection Act, and will retain your personal data in accordance with the prescription period or the period prescribed by the relevant laws (such as the securities and exchange law, the anti-money laundering law, the law on the prevention and suppression of the financing of terrorism and the proliferation of weapons of mass destruction, the accounting law, the tax law, the labour law, and other laws with which the Company is required to comply, both in Thailand and abroad). In addition, the Company may need to retain recordings from closed-circuit television cameras at its head office and branches for the purposes of fraud prevention and security, as well as for examining suspicious transactions that you or related persons may report to the Company. After such period, the Company may destroy such personal data from its storage or systems without prior notice to you.

9. Use of Cookies

The Company may collect and use cookies and similar technologies when you use the Company's products and/or services, including the use of the website, financial transactions via the internet, and the Company's website.

The collection of cookies and similar technologies helps the Company to recognise you, learn your preferences, and improve the way in which the Company offers products and/or services to you. The Company may use cookies for various purposes (such as enabling basic functions to work, helping the Company understand how you use the Company's website or e-mail, enabling the Company to provide a better online experience or communication with you, and ensuring that online advertisements displayed to you are more relevant and of greater interest to you).

10. Use of Personal Data for Original Purposes

The Company has the right to continue to collect and use your personal data that the Company collected before the date on which the provisions of the Personal Data Protection Act relating to the collection, use and disclosure of personal data came into force, in accordance with the original purposes. If you do not wish the Company to continue to collect and use such personal data, you may notify the Company to withdraw your consent at any time.

11. Security of Personal Data

11.1. The Company will put in place appropriate personal data security measures in accordance with the laws, policies, regulations, requirements and guidelines on personal data protection for the Company's employees and other relevant persons.

11.2. The Company supports and encourages its employees to have knowledge and awareness of their duties and responsibilities in the collection, storage, use and disclosure of the personal data of data subjects, so that the Company can comply with the policy and the personal data protection law correctly and efficiently.

12. Links to Websites

Third-party products and services: the Company's services may contain links to third-party websites, applications, products and services, and such third parties may collect certain information about your use of the services. This privacy notice applies only to the processing of personal data for the purposes determined by the Company. The Company cannot be responsible for the security or privacy of any of your information collected by such third-party websites, applications, products or services, even if you click on a link appearing on the Company's services. You should exercise caution and review the privacy notices/personal data protection policies of those third-party websites, applications, products and services as well.

13. Review and Amendment of the Personal Data Protection Policy

The Company may update or amend this Policy from time to time in order to comply with legal requirements, changes in the Company's operations, and suggestions and opinions from various organisations. The Company will clearly announce any such changes.

14. Contact Channels of the Company

If you have any questions or would like further details regarding the Company's privacy policy notice, or wish to exercise your rights, you may contact the Company through the following channels:

14.1 By telephone: +66(0)95-346-0492

14.2 Or by e-mail to safety@asguardd.com, addressed to the Data Protection Officer

14.3 Or by post to the Company's head office at 86/1 Chaloem Phrakiat Rama 9 Road, Soi 30, Yaek 14, Dok Mai, Prawet, Bangkok 10250

14.4 Or by contacting the Compliance Department, Personal Data Protection Division, at 86/1 Chaloem Phrakiat Rama 9 Road, Soi 30, Yaek 14, Dok Mai, Prawet, Bangkok 10250

15. Changes to the Privacy Policy Notice

The Company reserves the right to change or amend this privacy policy notice from time to time in order to comply with legal requirements, changes in the Company's operations, and suggestions and opinions from various organisations.