Phuket Square Co.,Ltd the management of Jungceylon Shopping Center Patong Phuket realize the importance of protecting personal data of those who contact and / or make transactions with the Company such as customers, service providers (suppliers, vendors, outsources, contractors), business partners, job applicants, em-ployees, etc. and announce this Privacy Policy to provide the practice guidelines and measures on protecting your personal data that the Company handle such as collection, use, and disclosure of personal data in accordance with your rights un-der the Personal Data Protection Act 2019 in Thailand and other applicable laws.

This policy is intended to inform you as the Data Subject, the purpose and details of personal data collection, use and /or disclosure as well as your rights and protec-tions according to the law, the company may revise this policy from time to time in accordance with the Act and or the subordinate law, regulations, announcements of government agencies that have been amended. Any change to this policy, the company will publish it on the website of the company as soon as possible to keep up to date and comply with the new rules that have been announced and applied.

Personal Data means information about an identifiable natural person whether by either a direct or an indirect means (But not including personal data of the de-ceased).

2.1 General Personal Data including
(i) Identity data: such as name, surname, date of birth, age, gender, marital status, identification number, passport number, driving license number and photograph.
(ii) Contact data: such as phone number, email address, Line ID, residence, and workplace.
(iii) Financial and transactional data: such as monthly income, bank ac-count number and deposit amount, credit card number, debit card num-ber, statements, and payment information.
(iv) Profile Data: such as username, password, likes, purchase history and information from survey responses
(v) Technical and Usage Data: such as login information, IP address, web-site browsing information, device types, platforms setting, and other tech-nologies used to access our website
(vi) Marketing and Communication Data: Data Subject's preference in re-ceiving marketing materials from the company and from third party includ-ing contact information that Data Subjects have with the company such as audio / visual information tape record in the event that you come to the company's shopping center /office or when contact is made via video call or via call center or from other social media channels. (vii) Other information that is considered personal data under the Privacy Laws

2.2 Sensitive Personal Data:
Personal data that is truly personal including information about race, religion, be-liefs, health information, food and general allergies political opinion, criminal record, disability, credit information, and biometric data for identification purposes (biometric information) such as fingerprints, Iris scan data, sound identity information, etc.

2.3 Personal Data of third parties:
In some cases, you may be required to provide the company with personal data of others, such as close relatives, a reference person or other person who may receive the ordered products / services on your behalf. In such case, the company assumes that you have certified and confirmed with the company that you have obtained such person's consent for providing that person's personal data to the company so that the company able to carry out the relevant objectives.

3.1 From Data Subject:
Personal Data that you give to the company directly or have with the company from the use of products and / or services, contact, visit, search through call center, online, digital, website or any other channels.

3.2 From other sources:
Personal Data that the company receive or can access from other sources such as government agencies, business partners, data service providers, social media, ad-vertising service providers, etc.

Personal data processing of the company is for the following purposes and the company will supervise employees or the company's operators not to use and / or disclose the personal data of the Data Subject other than the purpose of personal data processing (collection, use and/or disclosure). Except for compliance with the law such as the Personal Data Protection Act, etc. or by court order.

(i) Compliance with relevant laws and regulations: such as distributing in-formation / documents to government agencies such as the Revenue De-partment, District Office, Police Station, and Court
(ii) Carrying out the relevant contracts /assignments with business partners* of the company: Business partners of the company a natural person or legal entity) in-cludes tenants, business alliances, and any legal entities whom the com-pany disclose, transfer, or receive personal, for example consultants and law firms, correspondent banks, recruitment agencies, and service pro-viders* (suppliers, vendors, outsources, contractors)
(iii) Managing, providing, improving, and developing products/ services such as delivery of service information, organizing activities, member services, responding to inquiries and handling of customer complaints
(iv) Providing the marketing & communication activities such as promotion, advertising & PR, opting out from marketing materials or cookies.
(v) For authentication of your identity when applying for services and/or do-ing transaction with the company. If you wish to use the services provide by the company such as borrowing a baby stroller / wheelchair, making a parking ticket, etc.
(vi) For direct communication and/or information updating to tenants/ busi-ness partners via SMS, telephone, e-mail, fax, social media and/or other contact channels.
(vii) Maintaining and developing the relationship between the company and tenants / business partners, communicating, and providing information or sending blessing messages on various occasions.
(viii) Carrying out relevant purchasing /procurement: such as the handling of bids / auctions, negotiations, responding to inquiries, contracts, financial transactions, and evaluation of service / product performance.
(ix) Protection planning or implementation of various measures to reduce the risk of fraud, cyber threat, and various offenses.
(x) Risk management oversight to monitor or investigate acts of fraud or ille-gal acts or transactions where there is any doubt
(xi) Fulfillment of the claim or exercising legal rights of the company such as debt collection, litigation, daily record, notification of grievances, etc.
(xii) Recording the transactions in touch with the company's office or service users in the company's shopping center on the CCTV and verifying the identity of a person for security within the shopping center area and the company's office building
(xiii) For management in organization such as payroll and compensation to employees, temporary workers and trainees, for the contract of labor, for management of personnel in the company and providing welfare to the company's employees
(xiv) Other transactions involving the company such as receiving payments and payments including issuing a withholding certificate and submitting a tax report to the Revenue Department, and preparation of accounting re-ports
(xv) Checking email traffic or the use of internet of employees with you to pre-vent the disclosure of the company's confidential information.
(xvi) Preventing or suppressing harm to life, body, or health of a person.
(xvii) To achieve the purpose relating to the preparation of the historical docu-ments or the archives for public interest or for the purpose relating to stud-ies, research, and statistics
(xviii) Providing any other benefits that you have given consent for

The company will process your personal data (collection, use, and/or disclosure) on the different legal basis depending on the purpose of personal data processing and in the event that the company with so process sensitive data, your consent must be obtained before or during the collection of such sensitive data.

5.1 Consent:
The company process personal data on the consent basis and in the scope of the purpose for which the company has notified the Data Subject which includes but not limited to the followings:
(i) Use of the company's website service including various related services
(ii) Notification of benefits, special offers, marketing activities, promotion items or offering products/ services of the company and / or business partners to you.
(iii) Participation in promotional activities of the company and / or business partners
(iv) Direct marketing via telephone, text (SMS), email, fax, social media etc. if you participate as a member in various activities of the company
(v) Service performance tracking, responding to comments, suggestions, in-quiries, as well as complaints.
(vi) Advertising, public relations of the company’s business or products/ ser-vices and /or business partners
(vii) Communication or public relations within the company's organization and affiliates
(viii) Conducting research such as marketing, consumer behavior, etc. and opinion polls. Planning and statistical analysis and trends related to the company's products and / or services.
(ix) Invention, development or improvement of the company’s products or ser-vices at present and in the future
(x) Management of the company's business or if the company hire or assign other persons to act on their behalf.
(xi) Recruiting and hiring personnel or employees of the company and its af-filiates.

However, if you do not provide your personal data to the company, it may affect you not being able to provide the service, not convenient, which you may be lose an op-portunity

5.2 Contract:
The company process personal data under the contractual basis to fulfill the con-tract for which you are a part of or to use in fulfillment of your request prior to enter-ing the contract. Contract between you (as a customer, vendor, contractor, service provider or in any other position) and the company such as trading of goods, service providing and your use of services with the company that includes various services through a mobile phone system (mobile application)

5.3 Legal Obligation:
The company process personal data in accordance with legal compliance such as the prevention and detection of irregular transactions which may involve with illegal activities. For example, the company have legal obligation to report your personal data to the Revenue Department or other government affairs as required by law.

5.4 Legitimate Interest:
The company process personal data under the necessity for the legitimate interests of the company or of individuals or juristic persons are not overriding your interests or fundamental rights and freedoms as follows:
(i) Recording the transactions in touch with the company’s office or service users in the company’s shopping center on the CCTV and verifying the identity of a person for security within the shopping center area and the company’s office building
(ii) Protection planning or implementation of various measures to reduce the risk of fraud, cyber threat, and various offenses.
(iii) Risk management oversight to monitor or investigate acts of fraud or ille-gal acts or transactions where there is any doubt
(iv) Management within the organization which includes a sharing of per-sonal data with affiliates
(v) Fulfillment of the claim or exercising legal rights of the company such as debt collection, litigation, daily record, notification of grievances, etc.
(vi) Checking email traffic or the use of internet of employees with you to pre-vent the disclosure of the company's confidential information

5.5 Vital Interest:
The company process personal data under the necessity emergency to protect life or stop harm to life, body or health of the Data Subject or another natural person.

5.6 Public Task:
The company process personal data under the necessity to carry out the mission for the public or perform duties as the government agency assigned

5.7 Research Objective:
The company process personal data under the necessity to achieve the purpose re-lating to the preparation of the historical documents or the archives for public inter-est or for the purpose relating to studies, research, and statistics

The company may disclose your personal data to government agencies and busi-ness partners of the company for the purposes stated in clause 4 “Purpose of Per-sonal Data Processing”.

(i) Government agencies such as the Revenue Department, Municipality / District officer, courts, any other agency, or organization having the power to enforce the law
(ii) Business partners of the company (a natural person or legal entity) which includes tenants, business alliances, and any legal entities whom the company disclose, transfer, or receive personal, for example consult-ants and law firms, correspondent banks, recruitment agencies, and ser-vice providers* (suppliers, vendors, outsources, contractors)
* Service Providers both in Thailand and abroad, to carry out activities re-lated to the company's business such as product delivery, maintenance services, construction, postal services, logistic services, recruitment ser-vice, marketing activities, telemarketing services, customer satisfaction survey, Cloud storage service, electronic procurement system service, E-commerce services etc.

The company recognize your privacy rights that are protected under the Personal Data Protection Act as follows:

7.1 Right to Withdraw Consent:
Data Subject has the right to withdraw consent on which the collection, use or dis-closure of your personal data at any time. Except for compliance with the law or un-der the contract or court order

7.2 Right to Access:
Data Subject has the right to request access and obtain a copy of your personal da-ta in accordance with the criteria and method set by the company or request the dis-closure of acquisition of your personal data that the company obtained. The com-pany may reject the request of the Data Subject as required by law or court order.

7.3 Right to Data Portability:
Data Subject has the right to request the company to send or transmit your personal data to another Data Controller by the transmission that can be done with automatic means. You also have the right to directly receive your personal data in the format that the company send or transfer to another Data Controllers, except where it is not technically feasible.

7.4 Right to Object:
Data Subject has the right to object the processing of Personal Data (collection, use or disclosure of your personal data) in the following cases:
(i) Personal data is collected for necessity to carry out public tasks or for oth-er legitimate ground. Except the company can demonstrate higher legiti-mate grounds, or the processing activity is to establish legal claims or for legal compliance
(ii) Personal data is being processed (collected, used, or disclosed) for direct marketing purposes.
(iii) In the case of personal data is being processed for the research purposes either in the field of science, history, or statistics. Except it is necessary for the performance of public interest

7.5 Right to Erasure:
Data Subject has the right to request us to erase or destroy personal data. Except the company is required to comply with the applicable laws in keeping such per-sonal data:

7.6 Right to Restrict Processing:
Data Subject has the right to restrict the processing of personal data for the follow-ing cases:
(i) when personal data is under review for accuracy and completeness upon your request
(ii) when processing of personal data is unlawful (collection, use, disclosure) but Data Subject request to refrain from using it instead of deletion
(iii) when the personal data is no longer necessary for the purpose of pro-cessing (collection, use or disclosure) but the company can demonstrate a compelling legitimate ground.
(iv) When processing of personal data is conducted for the establishment, compliance, or exercise /defense of legal claims

7.7 Right to Rectification:
Data Subject has the right to request correction and rectification to ensure that your personal data is accurate, complete, and up to date.

7.8 Right to Lodge a Complaint:
Data Subject has the right to file a complaint to the relevant government agencies in the event that the Company, the Company’s employees, contractors and vendors including the personal data processor violates or fails to comply with the personal data requirements

The company will keep your personal data for a period according to the purpose for which it was collected and /or applicable laws

The company realize the importance of personal data and establish appropriate measures to maintain the security of personal data and comply with the confidenti-ality of personal data in order to prevent the loss, accessibility, destruction, use, al-teration or disclosure of personal data without rights or unlawful as well as prevent-ing the use of personal data without permission

The Company appoint a Data Protection Officer (Company DPO) to supervise the compliance with the Personal Data Protection Act and the company's policy on the protection of personal data, as well as to coordinate with you in handling of com-plaints and assist you in notifying the exercise of your legal rights.

If you have suggestions or have questions or would like to inquire about details of the collection, use and disclosure of your personal data including your rights under the Personal Data Protection Act or wish to withdraw consent or stop receiving mar-keting news or information. Please contact the company through the following channels

DATA PROTECTION OFFICER
Phuket Square Company Limited
Address: 175, 177, 181,193, 195, 197 and 201 Rat Utit 200th Year Road, Patong Sub-District, Katu District, Phuket Province
Email: [email protected]
Phone: 076 600 111 Ext. 600
Business hours: Monday - Friday at 9.00 AM – 6.00 PM.