Privacy Policy
ASTRA Enterprise Public Company Limited (“ASTRA”) is emphasized the compliance with the Personal Data Protection Act B.E. 2562 (A.D. 2019) (“PDPA”) to operate in a transparent and accountable way. The ASTRA therefore has to inform you about the ASTRA’s guidelines on personal data, including the purpose of the ASTRA for collection, use, disclosure and/or overseas transfer of personal data. The ASTRA hereby informs you about the ASTRA’s privacy policy whereby the ASTRA will proceed with PDPA when PDPA comes into full effect, including requesting for consent and granting the use of the right for the data subject. the ASTRA has provided the privacy policy to the customers as follows: Categories of the data subject under this privacy policy are as follows;
- Individual customers of the ASTRA include individuals who use or had used products or services, persons who contact for inquiry or receipt of information about products or services through various media and persons who have been offered or persuaded to use or receive products or services by the ASTRA.
- Individuals who are associated with the ASTRA’s corporate customers, such as representatives of legal entity, Investors and shareholders (individual), contact persons, authorized persons, employees, staffs, personnel and other persons related to the ASTRA’s corporate customers, including any other individuals that the ASTRA’s corporate customers have disclosed personal data to the ASTRA in order to conduct transactions with the ASTRA (“Persons related to corporate customers”).
- Investors and shareholders of the ASTRA, board of directors, executives or the ASTRA’s advisors (“Persons having relationship with the ASTRA”).
- Any other individuals that has relationships with the ASTRA or give personal data to the ASTRA in all other respects (“Persons contacting the ASTRA in other respects”) (collectively called “you” or “your”).
This Privacy Policy will apply to the collection, use, disclosure and/or overseas transfer of your personal data. The ASTRA may collect such personal data through various channels, such as websites, online social networks (such as LINE, Facebook and Twitter), telephone, fax, online communication channels ( such as email), Contact Center, one-to-one communication, letters through questionnaire, business cards, postcards, meetings and events or the ASTRA’s employees visit you or other sources , subsidiaries, business alliances, government agencies or third parties and other places and/or other communication channels whereby the ASTRA collects your personal data.
Please read this Privacy Policy together with the terms and conditions of the product and services using by you which might be some difference regarding the collection, use, disclosure and/or overseas transfer of your personal data.
1. The ASTRA’s procedures for the collection of personal data
1.1 Personal data collected by the ASTRA
(1) Personal data means any information related to you which can directly or indirectly identify you (excluding the deceased’s information) as specified in Clause 1.2
(2) Sensitive personal data means personal data which is classified as sensitive personal data in accordance with the law. The ASTRA may collect sensitive personal data, such as 1) Biological data (such as fingerprints, biometric face recognition) 2) Sensitive personal data as appeared on identification documents, contracts or supporting documents for the use of products and/or services (such as religion, race) 3) Information related to health and/or disability 4) Criminal records information In this respect, the ASTRA will collect, use, disclose and/or overseas transfer of your sensitive personal data only when the ASTRA receives an express consent or as legally permissible.
1.2 Categories of customers and personal data which are collected by the ASTRA
The ASTRA may collect your personal data, provided that personal data collected by the ASTRA, depending on relationship between the ASTRA and you, types of products or services that you want to receive from the ASTRA, types of your personal data, details are as follows:
(1) Individual customers, Persons having relationship with the ASTRA
1.1) Personal details such as name, surname, age, date of birth, occupation, ID card number Education background, Work history Social network ID Occupation Religion Passport Position Nationality Health information Picture
1.2) Contact details including phone number Fax number, address, postal address, workplace, e-mail, social network ID, copy of house registration
1.3) Details of financial transactions such as the front page of the bank book credit card number credit card page credit card back Copy of ID card Copy of company certificate
(2) Sensitive personal data that the ASTRA may collect such sensitive data shown on identity documents, including religion and biological data such as fingerprints, faces.
The Company will collect, use or disclose sensitive personal data only with the express consent of the personal data subject or as permitted by law.
(3) Personal data of third party If you provide the ASTRA with personal data of third parties such as first name, last name, detail of address and telephone number for emergency contact. Please inform this Privacy Policy to such third parties for acknowledgement and request for consent if necessary or as required by law for disclosure of personal data of third parties to the ASTRA.
(4) Personal data of minors, quasi-incompetent persons and incompetent persons The ASTRA collects personal data relating to a minor, a quasi-incompetent person and an incompetent person only when the ASTRA receives a consent from a guardian or a curator. The ASTRA has no intention of collecting personal data from a person aged under 20 years old without a consent of a guardian or a curator, a person taking care of the person as required by laws (as the case may be). In case the ASTRA was aware that the ASTRA had unintentionally collected personal data from any person aged under 20 years old without a consent of a guardian or a curator, a person taking care of the person as required by laws (as the case may be), the ASTRA will immediately delete such personal data or will collect, use and/or disclose only on other lawful basis other than a consent or to extent permitted by law.
2. The purpose of collection, use, disclosure and/or overseas transfer of your personal data.
The ASTRA may collect, use, disclose and/or overseas transfer the personal data and sensitive personal data for the following purposes:
2.1 The purpose of obtaining your consent
(1) Marketing and communication purpose: for carrying out marketing and communication activities, marketing advertisement, sales, special offers, news, public relations, promotions and presentations of the ASTRA’s products and services, the ASTRA’ s affiliated companies, business alliances and other legal entities only in case that the ASTRA requires your consent.
(2) Sensitive personal data: The ASTRA may collect your sensitive personal data for the following purposes: 1) Biological data (such as fingerprints, biometric data, biometric face recognition) for personal identity verification and providing you with the services. 2) Sensitive personal data as appeared on identification documents (such as religion, race) only for the purpose of your personal identity verification and proof.
2.2 Other purpose and any applicable law
The ASTRA will collect, use, disclose and/or overseas transfer of your personal data by lawful basis on legitimate interest, by lawful basis on entering into and performing the contract or other lawful basis on permissible personal data protection, as the case may be, depending on the relationship between you and the ASTRA and the ASTRA’s services being used by you, for the following purposes:
(1) For performing the tasks of the Company, such as holding a shareholders’ meeting Appointment of proxy to attend the shareholders’ meeting. Gather information to determine the benefits of shareholders. Collect information of directors according to the law. and check the properties. Consider appointing directors, selling media, co-investing, hiring artists/actresses, songwriters Ask for permission from the music label to play music in the event. attend a concert Receive production for customers bidding on media open a customer account media contract online business Collecting customer data to strengthen relationships.
(2) For Verification and confirmation of identity such as checking to know the facts. Verification of the identity of the bargaining power Identification and verification of the parties to the contract or authorized representative of the juristic person. Verification of the validity of the documents obtained for the purpose of the contract.
(3) For purposes of marketing, sales promotions and communication, such as for carrying out activities related to marketing and communication, marketing advertising, sales, special offers, news, public relations, promotion and presentation of the ASTRA’s products and services, the ASTRA’s affiliates, business alliances and other legal entities as specified by you or the services that you had used, including information of products and services that are directly and indirectly close to your interest and history, for enabling you to participate in the sales offering, offers and privileges, streaming live, travel activities, seminar, campaigns, events, seminars, contests, sweepstakes, lucky draws, including other relevant advertising services for facilitating you to participate in the ASTRA’s activities, in case the ASTRA does not require your consent.
(4) For the purpose of doing business such as for compliance with the requirements for keeping internal records; internal management, auditing, reporting or submitting information data processing or other related or similar activities, including finances, expenses and supplies.
(5) For compliance with laws, such as compliance with laws, legal procedures or order of government agencies, including government agencies outside Thailand and/ or in cooperation with courts, government authorities, law enforcement, when the ASTRA has a reason to believe that the laws enforce the ASTRA to do so. If it is necessary to disclose your personal data in compliance with laws, procedures or government orders, for conducting VAT collection and refund services, for tax invoices, or filing full tax returns, for recording and monitoring communication, and law enforcement agencies and crime investigation or crime prevention.
(6) For verification and prevention of the ASTRA business risks, such as for your personal verification, for monitoring the compliance with the law and other regulations (for compliance with the suppression and corruption prevention regulations, cyber treats, debt default, breach of contract.
(7) For risks management, such as management of risks, efficiency monitoring and risks evaluation in order to set risks index, making summary report for risks management in order to evaluate and predict potential risks, including solutions towards the products risk evaluation and giving suggestion in case there are changes and finding solutions for the risk management.
(8) For the benefits of operations regarding organizational transactions, such as in case sale of business, transfer, merger and acquisition, business reorganization or other similar cases, the ASTRA may transfer your personal data to third parties as a part of such operations.
(9) For prevention or stop of dangers to lives, bodies or health of persons
In this respect, if you do not provide personal data to the ASTRA, it may have impact on you, such as the ASTRA may not proceed with your requests; you may experience some inconvenience or do not obtain the performance of agreements and you may receive damage or lose opportunities. In addition, your refusal to provide personal data may affect the compliance with any law that the ASTRA or you must comply with and may have related penalties as a consequence.
3. Who does the ASTRA disclose or transfer your personal data to?
The ASTRA may disclose or transfer your personal data to the following third parties, whereby the collection, use or disclosure and/or overseas transfer of personal data for purposes under this Privacy Policy. These third parties may live in Thailand or abroad, you can check on the privacy policy of such third parties in order to understand the details regarding the methods of the collection, use and/or disclosure of your personal data, since you are a data subject as specified in the privacy policy of such third parties.
3.1 Affiliates
The ASTRA may outsource the ASTRA’s services on behalf of the ASTRA in order to assist operations and to provide you with products and services, including any procedure for providing you benefits. The ASTRA may share your personal data to the outsourcing parties, the representative’s service providers, service providers of supporting business entrepreneurship, subcontractors, any service providers or any service providers for supporting the ASTRA’s services, including but not limited to
(1) internet service providers, software developers, website developers, digital media developers, information technology service providers and service providers.
(2) logistics and transportation service providers,
(3) payment and payment system service providers,
(4) research service providers,
(5) auditors,
(6) marketing, advertising, design, creative and communication service providers,
(7) event, campaign, marketing and customer relationship management service providers,
(8) telecommunications service providers,
(9) cloud storage service providers,
(10) lawyers, legal counsels for the ASTRA’s benefits, including exercising legal claims and defending against legal claims, audits and/or other professionals in assisting the ASTRA’s business operations,
(11) document storage and/or disposal service providers
During the provision of such services, the service providers may have the right to access your personal data, however the ASTRA will only provide your personal data to the service providers as necessary for the services. The ASTRA will ensure that the service providers must protect a security of your personal data in compliance with the law.
3.2 The ASTRA’s business alliances
The ASTRA may transfer your personal data to the ASTRA’s business alliances for conducting business and provide services to the ASTRA’s customers and groups of customers who tend to use services from the ASTRA
3.3 Third parties as specified by laws in some cases
The ASTRA may have to disclose your personal data in compliance with the laws, including orders issued by laws which include law enforcement agencies, courts, Legal Execution Department, authorities, government agencies or other persons that the ASTRA believes it is necessary to comply with the laws or to protect the ASTRA’s rights, the rights of third parties or for the security of persons or for inspection, prevention or corruption problem solving, security, safety, including any other risk.
3.4 Assignees
In case of a business reorganization, merger and acquisition, entire business or part of business transfer, sale, purchase, joint venture, grant, transfer part or all of business, assets, shares, or other similar transactions, the ASTRA shall have to disclose your personal data to third parties who have been assigned or wish to be assignees of the ASTRA. In this respect, the ASTRA shall procure that such third parties shall comply at all times with this Privacy Policy when there is a collection, use or disclosure and/or overseas transfer of your personal data.
3.5 Third parties
The ASTRA may disclose your personal data under the legal basis according to the purposes specified in this Privacy Policy to other third parties, such as representative ASTRAs, partner ASTRAs, other ASTRAs, other customers, other persons who make a transaction with you or relating to your transactions, other persons as legally referred to, members of digital identity verification system and service providers of digital identity verification system, as the case may be.
4. Overseas transfer of your personal data
The ASTRA may overseas transfer your personal data to other countries which may have a higher or lower standard of personal data protection than Thailand, such as submission of personal information of customers exhibitor or the lucky person in traveling abroad, submission of personal information for shipping with seller and buyer information for delivery companies to bring products to customers who are abroad as the case may be. When it is necessary for the ASTRA to transfer your personal data to other countries which having a lower standard of personal data protection than Thailand, the ASTRA shall procure to ensure that there is an appropriate protection measure or personal data protection laws allow the transfer of personal data, e.g., the ASTRA may have to obtain a confirmation according to the contract from third parties who have access to such personal data that your personal data shall be protected under the same personal data protection standard of Thailand.
5. Duration of personal data storage period
The ASTRA shall retain your personal data for a necessary period for compliance with the purposes stated in this Privacy Policy. In this respect, for compliance with the law, the ASTRA may have to retain your personal data as long as it required by laws.
6. Data subject rights
the Data Subject Rights stated in this section mean legal rights relating to your personal data whereby you may use these rights with persons required by laws, in this regard, under the conditions stipulated by law and the process of the rights management of the ASTRA, such rights include the following rights:
(1) Right of access to personal data, you may have the right to access personal data or request for a copy of personal data that the ASTRA collected, used, disclosed and/or overseas transferred of your personal data, for your privacy and security, the ASTRA may request you to verify personal identity before providing you with personal data as requested.
(2) Right to rectification of personal data, you may have the right to rectify your personal data that the ASTRA collected, used, disclosed and/or overseas transferred of your personal data if such personal data is incomplete, incorrect, misleading or not up-to-date.
(3) Right to data portability of personal data, you may request the ASTRA to provide your personal data in electronic format with an explicit structure and to transfer such personal data to other data controllers, whereby this data is
(a) your personal data provided to the ASTRA,
(b) the ASTRA collected, used, disclosed and/or overseas transferred of personal data with your consent or for compliance with the contract between the ASTRA and you.
(4) Right to object of personal data, you may have the right to object some types of the collection, use, disclosure and/or overseas transfer of personal data, such as objection to direct marketing purpose.
(5) Right to restriction on the use of personal data, you may have the right to restrict the use of your personal data in some cases.
(6) Right to withdraw consent, you may have the right to withdraw your consent at any time for purposes that you gave your consent to the ASTRA to collect, use, disclose and/or overseas transfer your personal data.
(7) Right to erasure of personal data, you may have the right to request the ASTRA to erase your personal data or anonymize your personal data, however there is an exemption for the ASTRA not to take such actions if the ASTRA must retain such personal data in order to comply with the laws or to lawfully establish legal claims or to lawfully exercise legal claims or to lawfully defend against legal claims.
(8) Right to complaint, you may have the right to complain to the relevant authorities if you believe that the collection, use, disclosure and/or overseas transfer of your personal data was unlawful or violated the law on personal data protection.
If you want to use any right specified in this section, you can do so by contacting through the following channels: Right of Data Subject Channel: https://astratreasury.com/pdpa-term/ Request for using any right above may be restricted by the relevant laws, in some cases, the ASTRA can appropriately and rightfully reject your request, such as when the ASTRA must comply with the laws or court orders. If you believe that the collection, use, disclosure and/or overseas transfer of your personal data by the ASTRA violated personal data protection laws, you have the right to make a complaint to the relevant authorities with respect to personal data protection. However, you may initially inform the ASTRA of your concern in order for the ASTRA to consider solving your concern, please contact the ASTRA through the following channels: https://astratreasury.com/pdpa-term/
7. Changes to Privacy Policy
The ASTRA may make any change to this Privacy Policy from time to time if there is any change in the ASTRA’s practice guidelines on personal data protection due to various possible reasons, e.g., technological or legal change. Changes to this Privacy Policy shall be effective when the ASTRA publishes on https://astratreasury.com. However, if such change significantly affects your personal data, the ASTRA will notify you in advance regarding such change prior to the effectiveness.
8. Contact
If you have any inquiry regarding this Privacy Policy, please contact the ASTRA or the ASTRA’s personal data protection officer as detailed below:
Data Protection Officer (DPO)
- 1126/2, 27th Floor, Unit 2703, Vanit Building II, New Phetchaburi Road, Makkasan, Ratchathewi, Bangkok 10400
- E-mail: privacy@astratreasury.com