This Privacy Policy describes and governs the collection, storage, processing, and use of your personal data by Thunderxpay Payments Inc. (hereinafter: “Thunderxpay Payments”, “we”, “us”, “our”) recognize the importance of protecting your Personal Data and therefore issue this Privacy Notice in order to help you understand our guidelines on protecting your Personal Data, as well as to describe our grounds for and means of collection, use, disclosure, and/or cross-border transfer of your Personal Data when you use our services or products through any channel. We recommend that you read and understand this Privacy Notice, of which details are as follows:
Thunderxpay Payments Inc., will collect, use, or disclose your Personal Data merely to the extent necessary to fulfill any of the following purposes as specified in the Privacy Notice or any other purposes as specified in any documents or electronic means regarding giving consent for the collection, use, or disclosure of your Personal Data.
This Privacy Notice applies to how we collect, use, disclose and/or international transfer your Personal Data in relation to the use of our services or products through channels, including our branches, websites, application, call center, activity and exhibition, online contact channel, other locations, other service channels or our partners’ service channels. This Privacy Notice does not apply to the use of other services or products that do not belong to us or are not under our control.
In accessing and using our services and/or products, you may be required to provide your Personal Data, which could be used to identify your identity, in order to enable your transactions in relation to our services and/or products. Such Personal Data includes information as specified in the service application form, documents for identity verification, which are supporting documents of the application for our services and/or products, and financial information. We may process your Personal Data and the source of your Personal Data that we collect, use, and/or disclose in any form, including documents, or photos. and/or electronic form.
This Privacy Notice applies to the Personal Data (as defined in Clause 1 below) of Personal Data subjects including: (1) our individual customers, including prospective customers (potential customers), current customers, former customers, and individual persons related to such individual customers; (2) our employees, personnel, staffs, representatives, shareholders, authorized persons, directors, contact persons, agent, and other individual persons related to our corporate customers, individual customers, including prospective customers (potential customers), current customers and former customers; (3) individual persons who are our former, existing. or future outsourcing service providers or vendors; and (4) other individual persons who visit our website, application, and/or other online channels as well as other individual persons who were, are, or will be our external service providers or partners; (4) holders of our securities in which we are involved including their attorney or proxies of such persons; and (5) any other persons who communicate with us through the channels or for whom we provide services, either directly or through our partners or agents.
However, we will retain ownership of the Personal Data that we have already processed.
Individual persons, individual customers, corporate customers, external service providers, vendors, or business partners will be collectively referred to as “you” or “your”.
1. What Personal Data we hold about you
“Personal Data” means any identified or identifiable information about you as listed below. We may collect your Personal Data directly from you (e.g. through our staff, call center, or other service channels) or indirectly from other sources, public sources, social media where you have set as public, external service providers, advisors, business partners, agencies, organizations, or any person having a contractual relationship with us such as third-party custodians, sub-custodians, brokers, domestic and international government agencies, your representatives or agents, any authorized person in accordance with the laws, or any person you have given permission or consent for disclosing your Personal Data to us, provided that those data providers have complied with the Personal Data protection laws). The types of Personal Data that we collect depend on the relationship between you and us as well as the services or products that you require from us. Furthermore, the types of Personal Data we collect depend on the relationship between the clients or juristic persons and us, as well as the services or products the clients require from us.
“Sensitive Data” means Personal Data classified by law as sensitive data.
Individual Customers
Your Personal Data that we collect, use, disclose, and/or transfer to other countries, includes but is not limited to the following:
(a) Identity Data such as name, surname, date of birth, age, nationality, identification number, passport number (for foreigners), tax identification number, marital status, education, occupational data (e.g. occupation, workplace, job title, salary), signature, photo, house registration certificate, suitability test, FATCA information, investment purpose, including Sensitive Data as specified by laws and this Privacy Notice
(b) Contact Details such as address specified in identification card, address specified in house registration certificate, current address, work address, telephone number, mobile phone number, FAX number, email address, and other identification number for communication via other electronic channels;
(c) Financial Data such as account number, type of account, Promptpay data, transaction data, financial history, information from the database of the Legal Execution Department, financial status (e.g. income, wealth, asset and debt, evidence of income and expense, credit information, record of borrowing, record of credit, and record of repayment), financial requirement and goal, asset, income and expense, payment information and application information for our services and products;
(d) Transaction Data such as account number for each product, account limit, balance, free margin, asset value, and total liabilities. Profit and loss, securities trading history, settlement history, delivery history, debt settlement history, cash deposit and withdrawal history, securities deposit and withdrawal history, and transactions in relation to your assets;
(e) Communication Data such as a copy of identification card, a copy of passport, photos and/or voice from CCTV, telephone calls or our online channels or any other electronic channels;
(f) Other Personal Data collected, used, and disclosed in connection with the relationship with us, such as information provided to us in the agreements, forms, surveys, and questionnaires; information collected from your participation in our business activities, marketing, seminars, social events, and information from analytics, research, and profiling that we obtain from observing your behavior and/or location through cookies, technology, or any other means for product development purposes; and
(g) Technical Data such as information about your preference in search for or use data via electronic channels, and your activities on social media which include financial information, member login information, IP address, web beacon, log, device ID, device model and type, network, connection information, access information, single sign-on (SSO), Login log, access time, time spent on the page, smart device information, verification information, browsing information, location, spending patterns or search history with relation to our services and/or products, information from cookies or connection with other websites that you use.
Corporate customers or external service providers or partners
Personal Data of authorized directors, authorized persons, shareholders, agents, and other individual persons related to you that we collect, use, disclose, and/or transfer to other countries, includes but is not limited to the following:
(a) Identity Data such as name, surname, date of birth, age, nationality, identification number, passport number (for foreigners), tax identification number, biography information, education, occupational data (e.g. occupation, workplace, job title, salary), signature, photo, house registration certificate, including Sensitive Data as specified by laws and this Privacy Notice;
(b) Contact Details such as address specified in identification card, address specified in house registration certificate, current address, work address, telephone number, mobile phone number, FAX number, email address, and other identification number for communication via other electronic channels;
(c) Contact Details such as address specified in identification card, address specified in house registration certificate, current address, work address, telephone number, mobile phone number, FAX number, email address, and other identification number for communication via other electronic channels;
(d) Other Personal Data collected, used, or disclosed in connection with the relationship with us such as information provided to us in the agreements, forms, surveys, questionnaires, information collected form your participation in our business activities, marketing, seminars, social events, and information from analytics, research, and profiling that we obtain from observing your behavior and/or location through cookies, technology, or any other means for product development purposes; and
(e) Communication Data such as a copy of identification card, a copy of passport, photos and/or voice form CCTV, telephone calls or our online channels or any other electronic channels;
Your Sensitive Data, that we collect, use, disclose, and/or transfer to other countries, includes but is not limited to the following:
(a) fingerprints, finger vein, facial recognition, iris recognition, voice recording, and any other similarly sensitive Personal Data for the purpose of proofing and authenticating your identity and your transactions through the identity proofing and authentication service;
(b) religion and/or blood type only as appeared on the copy of your identification card for the use as evidence solely for the establishment, compliance, exercise or defense of legal claims;
(c) criminal records for public interest in relation to protecting, dealing with, and minimizing risks that may occur as a result of any illegal activities such as money laundering, terrorism, or public fraud; and
(d) information regarding disability, health or dysfunction, which will be used to provide our services to you as required by laws. We will collect, use, disclose, and/or transfer to other countries your Sensitive Data merely to the extent necessary to fulfill any of the following purposes as specified in Clause 2, and we will procure appropriate measures in order to protect your fundamental rights and benefits.
We will collect, use, disclose and/or transfer to other countries your Sensitive Data merely to the extent necessary to fulfill any of the following purposes as specified in Clause 2, and we will procure appropriate measures in order to protect your fundamental rights and benefits.
In case you deny the necessary information to us for providing our services, we may not provide you our services in part or in full. In the event that you give us the Personal Data of another person, you are responsible for notifying that person to acknowledge our Privacy Notice or our services terms and conditions including obtaining their consent before disclosing that person’s Personal Data to us.
2. What are our purposes for the collection, use, and disclosure of your Personal Data
We collect, use, disclose, and/or cross-border transfer your Personal Data to the extent necessary to fulfill any of the purposes set out in the table below. We will assess your Personal Data based on a lawful basis, which shall vary depending on the services, products, or relationships that you had, will have, or have with us.
Purposes of the collection, use, and/or disclosure of your Personal Data | Lawful basis for data processing |
|---|---|
Offering service and/or products of Thunderxpay Payments Inc. or our business partners that are not similar or unrelated to the services and/or products you have with us, as well as conducting research, recording statistical data, and analyzing your data for the purpose of recommending such services and/or products. | ▪ It is in our legitimate interest (Legitimate Interest) |
Offering service and/or products of Thunderxpay Payments Inc. or our business partners that are not similar or unrelated to the services and/or products you have with us, as well as conducting research, recording statistical data, and analyzing your data for the purpose of recommending such services and/or products. | ▪ Where your consent is given to us (Consent) |
Disclosing your Personal Data e.g. name, surname, and contact information to any third party for marketing purposes. | ▪ Where your consent is given to us (Consent) |
Processing your request to participate in our activities or projects e.g. promotional activities, training, seminars, receiving news and updates | ▪ Where necessary to fulfill contractual obligations between you and us. (Contractual Basis |
Facilitating you and for the benefit of providing you with a service requesting the information you have with all our companies, including rendering services in connection with our services or products which you have or will have with us | ▪ Where necessary to carry out our agreement with you (Contractual Basis) ▪ Where the consent has been given to us (Consent) |
Communicating with you e.g. sending e-mail, letter, or any document to you as prescribed in the agreement or by-laws. | ▪ Where necessary to carry out our agreement with you (Contractual Basis) ▪ Where the laws require us (Legal Obligation) |
Conducting Know Your Customer and/or Customer Due Diligence for accurate, true, and up-to-date information. | ▪ Where the laws require us (Legal Obligation) |
Preventing and detecting suspicious transactions to mitigate and reduce risks that may occur or lead to illegal activities such as money laundering, terrorism, or public fraud, including the sharing of personal information to improve our work standards regarding security management and mitigate the risk. | ▪ Where necessary as required by applicable laws (Legal Obligation) ▪ It is our legitimate interests (Legitimate Interest) ▪ Where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in (Substantial Public Interest) |
Reporting your Personal Data to government agencies which are our regulators or when receiving a summon or suspension from a government agency or court. | ▪ Where necessary as required by applicable laws (Legal Obligation) |
Operating in compliance with our internal procedures e.g. For each account opening and each transaction, we have to verify and identify if you are a true owner of such account, as well as checking other facts to support your request. | ▪ Where necessary to fulfill contractual obligations between you and us. (Contractual Basis) ▪ It is in our legitimate interest (Legitimate Interest) ▪ Where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in (Substantial Public Interest) |
Analyzing risk based on your behavior, including the Credit Scoring Test or Suitability Test. | ▪ Where necessary to fulfill contractual obligations between you and us. (Contractual Basis) ▪ Where necessary as required by applicable laws (Legal Obligation) ▪ Where your consent is given to us for the collection of your Personal Data via various channels, including your electronic devices, for the aforementioned purpose. (Consent) |
Generating relationships with customers, external service providers, or business partners who have disclosed your Personal Data to us, such as entering into an agreement with individual or corporate customers, external service providers or business partners e.g. loan application documents verification/ request for our services and/or products, which information verification is required. We may need to verify such documents that might contain third parties and your Personal Data. In case of entering into an agreement with juristic person that might contain third parties’ and your Personal Data. Such juristic person shall fully comply with the Personal Data Protection law and this Privacy Notice. | ▪ Where necessary to carry out our agreement with you (Contractual Basis) ▪ It is in our legitimate interest (Legitimate Interest) |
Maintaining relationships with customers, such as complaint management, satisfactory surveys, or offering of special benefits to customers without marketing purposes. | ▪ Where necessary to carry out our agreement with you (Contractual Basis) ▪ It is in our legitimate interest (Legitimate Interest) |
Analyzing, researching, and profiling in relation to you received from the observation of your behavior and/or your location by using Cookies and other technologies or electronic means. This is to develop and offer services and/or products of us and/or our business partners to suit your personal demand as well as enhancing your special benefit. (Behavioral Advertising) | ▪ Where necessary to carry out our agreement with you (Contractual Basis) ▪ It is in our legitimate interest (Legitimate Interest) ▪ Where your consent is given to us (Consent) |
Recording videos and/or voices through telephone or any other electronic means to verify your requests orders, or complaints, or for analyzing, improving, and developing our products and/or services, including training our employees for such proposes | ▪ It is in our legitimate interest (Legitimate Interest) |
Using your fingerprint, finger vein, facial recognition,iris recognition, voice recording, including other Sensitive Data correspondingly for verification and authentication of your identity and transactions using the digital identity verification and authentication services. | ▪ Where your consent is given to us (Consent) ▪ Where necessary as required by applicable laws (Legal Obligation) |
Collecting and using your Sensitive Data such as religion, blood type only as shown on the copy of Identification Card. | ▪ Where necessary for the establishment of legal claims, the compliance to the applicable laws or the defense of legal claims |
Collecting debt and enforcing obligations arising from our agreement, liabilities, legal rights, investigation, seizure, and take over assets or property, including bringing into auction or any other activities in a similar way, | ▪ Where necessary to carry out our agreement with you (Contractual Basis) ▪ It is in our legitimate interest (Legitimate Interest) |
The disclosure of your Personal Data in accordance with rules and regulations prescribed by organizations or regulations in a foreign country, or in accordance with such foreign country’s laws or international conventions. | ▪ Where necessary to fulfil contractual obligations between you and us (Contractual Basis) ▪ Where necessary as required by applicable laws (Legal Obligation) |
However, we may process your Personal Data in accordance with the aforementioned purposes through our existing technologies or as we may occupy in the near future, including but not limited to the use of Artificial Intelligence (AI), Cloud Computing, Block Chain, and Biometric Comparison. In the event we do not obtain your consent, it may affect your ability to use our services and/or products, your convenience, and the performance of contractual obligations.
3. How Thunderxpay Payments Inc. will share your Personal Data with
Upon your explicit consent, or as necessary for the performance of contractual obligations, or as required by laws, substantive public interest, execution of duties in the exercise of state authority, or for our legitimate interest, we may send, transfer and/or disclose your Personal Data to the following third parties, situated both in Thailand and foreign countries. We will operate to the extent permitted by laws and will procure sufficient Personal Data protection standards.
(a) Our business partners to which we may transfer your Personal Data to a person acting on your behalf or otherwise involved in the provision of any type of products and/or services offered by us, such as beneficiaries, account nominees, custodians, correspondents, agents, vendors, co-brand partners, market counterparties, issuers of products, or global trade repositories to whom we have the right to disclose your Personal Data in the course of providing products and services to you and/or to whom you authorize us to disclose your Personal Data; provided that these recipients agree to treat your Personal Data in compliance with the Personal Data Protection laws and in accordance with this Privacy Notice.
(b) Our external service providers, such as IT service providers, advertising agencies, research agencies, cloud service providers, debt collectors, consulting firms, auditors, and law firms.
(c) Financial institutions and payment service providers such as banks that provide payment services for your transactions.
(d) Social Media such as Facebook, Line, and Linkedin, for communicating marketing messages to you and for the collection of your data to analyze for services and/or product development.
(e) Third parties such as assignees or transferees which may assign, transfer, or novate, to whom we novate our rights, to the extent permitted under the terms and conditions of the agreement between you and us. We may disclose or transfer your Personal Data to assignees or transferees, including prospective assignees or transferees; provided that these recipients agree to treat your Personal Data in compliance with the Personal Data protection laws and in accordance with this Privacy Notice.
(f) Other third parties in relation to the business transfer which we may disclose or transfer your Personal Data to our business partners, investors, significant shareholders, assignees, prospective assignees, transferees, prospective transferees in the event of any reorganization, restructuring, merger, acquisition, sale, purchase, joint venture, assignment, dissolution or any similar event involving the transfer or other disposal of all or any portion of our business, assets of shares. In case of the occurrence of any event specified above, the recipients shall comply with this Privacy Notice.
(g) Government agencies regulating Thunderxpay Payments Inc. or registration authorities such as Bank of Thailand, Securities and Exchange Commission, securities depository, court, National Police Office, Department of Business Development, or any other government agencies that have the authority to summon subpoena or percept your Personal Data or assets such as Legal Execution Department and Revenue Department.
4. What are your rights in relation to your Personal Data
You may exercise the following rights:
4.1 Right of access
You may have the right to access and request a copy of your Personal Data which is under our responsibilities or request us to disclose the sources of your Personal Data for which you have not given consent
4.2 Right to rectification
You may have the right to request us to rectify your Personal Data in order for data to be accurate, up-to-date, and not misleading.
4.3 Right to erasure
You may have the right to request us to delete or destroy or anonymize your Personal Data in case of the following events:
1. Such Personal Data is no longer necessary in relation to the purposes for which collected, used, or disclosed;
2. You have withdrawn consent and where we have no legal ground for such collection;
3. You have objected to some data processing activities, which we could not reject such request;
4. You have objected to the data processing activities for direct marketing purposes; and
5. It is an unlawful collection, use, or disclosure of Personal Data
4.4 Right to Restriction of Processing
You may have the right to restrict our data processing of your Personal Data in case of the following events:
1. The processing of Personal Data is no longer necessary, but the collection of Personal Data still remains necessary for exercising legal claims;
2. It is an unlawful processing of Personal Data; however, you prefer the restriction of data processing rather than the deletion or destruction of your Personal Data;
3. During the verification of the accuracy of Personal Data upon your request; and
4. During the proving process for the rejection of right to objection
4.5 Right to Data Portability
You may have the right to obtain Personal Data we hold about you, in a structured, electronic format and able to be used or disclosed by automatic means, including (a) request us to send or transfer your Personal Data in such format to other data controllers in case the electronic means is allowed, (b) request to directly obtain your Personal Data in a structured, electronics format unless it is impossible as the electronic means is not allowed.
4.6 Right to object
You may have the right to object to the collection, use, or disclosure of your Personal Data in the following cases:
1. The collection, use, and/or disclosure of Personal Data for the purpose of direct marketing
2. The collection, use, and/or disclose of Personal Data for the purpose of scientific, historical, and statistical research, unless it is necessary for our operation with regards to public interest;
3. The collection of data that is necessary for our operation with regards to public interest or for our legitimate interest unless we are able to demonstrate a more important lawful basis or it is to establish legal claims, to comply with the laws, to exercise the right to claim, or to the defense of legal claims.
4.7 Right to Withdraw Consent
You may have the right to withdraw your consent given to us for the collection, use, or disclosure of your Personal Data at any time unless such consent withdrawal is subject to the restriction by-laws or the contractual obligation with us that benefits you. For example, you are still using our services and/or products or you still have debt obligation to us.
4.8 Right to lodge a complaint
You may have the right to lodge a complaint to the competent authority where you believe our collection, use or disclosure of your Personal Data is unlawful or noncompliant with the applicable Personal Data protection law.
Your above-mentioned rights are subject to the relevant factors and we may not be able to proceed according to your request if we hold the legitimate interest to collect such Personal Data, for example, loan account or use our other services, or if we need to retain your Personal Data for the period as specified by the applicable laws even after the termination of relationship between you and us.
5. How Thunderxpay Payments Inc. protects your Personal Data
We maintain technical, physical, and administrative security measures designed to provide optimal protection of your Personal Data from loss, misuse, unauthorized access, disclosure, or modification, such security measures include firewalls, data encryption, physical access control when accessing data centers, and data access control. While we maintain our security standard for systems and services, you are responsible for maintaining the security and privacy of your password and information related to your account, as well as verifying that your Personal Data is accurate and up-to-date.
We established policies, manuals, and minimum standards for handling our customers’ Personal Data, such as IT security standards, and we will review and improve such policies, manuals, and minimum standards from time to time as specified by laws.
In addition, our personnel, employees, or external service providers are obliged to keep our customers; Personal Data confidential in accordance with the non-disclosure agreement signed with Thunderxpay Payments Inc.
6. Cookies
We use cookies technology to secure our websites, to enhance the efficacy of using our websites and online services for you, and to develop our services and/or products to suit your needs or to expand your benefits. Cookies are small pieces of information issued to the hard drive of your computer when you visit a website to collect and record your Personal Data that you filled, or to collect what you filled by not addressing any specific person. You can check your Cookies status or reject the use of Cookies in your browser. For more information, please see Cookies Policy
7. International transfer of your Personal Data
For the purposes as mentioned above, we may disclose or transfer your Personal Data to third parties or servers located overseas, of which the data protection standard may not be the same as Thailand. In addition, we have taken steps and measures to ensure that your Personal Data is securely transferred, and that the recipients have an appropriate data protection standard in place, and that such transfer is lawful as permitted by the exceptions under the laws.
8. Personal Data of minors, quasi-incompetent or incompetent persons
Our activities are not generally aimed at minors, quasi-competent or incompetent persons, and we do not knowingly collect Personal Data from minors without their parental consent, or from quasi-competent persons, or incompetent persons without their legal guardian’s consent. If you are minors, quasi-competent or incompetent persons and wish to engage in a contractual relationship with us, you must obtain consent from your parent or legal guardian prior to contacting us or providing us with your Personal Data.
9. Personal Data of Third Person
If you provide any Personal Data of third person (such as guarantor, top level management, authorized person, assignee. Director, shareholder, personnel, employee, founder of a trust, trustee, agent, person in line of control, owner, co-owner, other persons who is not our customers, or other persons related to you according to your relationship with us), including name, surname, address, telephone contact for emergency, debt collection, and family members’ income, please inform such third person of this Privacy Notice and obtain his/her consent if necessary or as permitted under the applicable laws.
10. How and how long Thunderxpay Payments Inc. retain your Personal Data
We will retain your Personal Data for the period as reasonably necessary to fulfill the purposes for which we have obtained your Personal Data as set out in this Privacy Notice, and to act in compliance with the applicable rules and laws. However, we may retain your Personal Data if it is necessary for your to exercise any legal defenses, claims, or rights. After such period and your is no longer necessary for the purposes as specified above, we will delete, destroy, or anonymize your Personal Data according to the standards issued by the Personal Data Protection Committee or any laws or international standard.
11. Changes to this Privacy Notice
We may need to amend or revise this Privacy Notice from time to time. In case of any changes made to our Personal Data protection procedures according to any reasons, such as a change in technology and change in laws. We recommend that you read this Privacy Notice and/or the amended one thoroughly and carefully and look for possible changes at www.thunderxpay.com However, in case of a significant change that might affect your right as a data owner, we will notify you or ask for your consent appropriately before such change becomes effective.
12. Contact information
If you wish to contact or would like to have more information or an explanation for the collection, use, and disclosure of your personal data, and exercise the rights of the data subject as specified in this Privacy Notice, you can contact us via email: thunderxpay@thunderxpay.com
Latest updated
November 2024
EffortUnionGroup Limited The Offices at Central World,
999/9 Rama I Rd., Patumwan, Bangkok, 10330 Thailand
DNB Exchange Company limited The Offices at Central World, 999/9 Rama I Rd., Patumwan, Bangkok 10330 Thailand
