Heaven Drops Co., Ltd. (the “Company”) deeply values your privacy rights (“Data Subject”) and recognizes the trust you place in us when providing your personal data for business operations and service delivery. The Company is committed to collecting, using, and disclosing (“Processing”) your personal data with reasonable care, transparency, and strictly in accordance with the principles set forth in this Privacy Policy. Your personal data will be protected in full compliance with the Personal Data Protection Act B.E. 2562 (2019) and all relevant subordinate legislation.
1. Definition
Personal Data means any information related to a person, which enables the identification of such person, whether directly or indirectly. For example, name, address, e-mail address, identification number.
Sensitive Personal Data is special category of personal data that needs appropriate protection and carefully collect, use, or disclose. Sensitive Personal Data pertains racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, and biometric data.
Data Subject means the owner of the personal data whose data is collected, used or disclosed.
2. The Purpose of Personal Data Processing
(1) To verify and identify the Data Subject prior to accessing the Company’s system, and for the purpose of conducting various operations or communications with the Company, including but not limited to communicating, monitoring, responding to inquiries, questions, or any requests made by the Data Subject.
(2) To perform the Company’s obligations under a contract to which the Data Subject is a party, or to take steps at the request of the Data Subject prior to entering into such contract.
(3) For research and statistical analysis, including the development of new products and services, or the assessment and improvement of the Company’s existing products and services.
(4) For marketing purposes relating to the Company’s products and services, as well as those of the Company’s affiliates and business partners, such as notifying the Data Subject of recent activities, special offers, and promotions, and/or allowing the Company to market products and services that may be of particular relevance or interest to the Data Subject.
3. Personal Data for Personal Data Processing
3.1 Source of the Personal Data
- Directly collect from the Data Subject; for instance, a collecting of the personal data from filling in the Company’s form, registration processes, or entering into the Company’s website via cookies.
- Indirectly collect from other sources which is not directly from the Data Subject; for instance, asking for the data from a third party. The Company shall notify the Data Subject and request a consent from the Data Subject, without delay, within 30 days from the date which the Company collects the personal data from such source.
- Collecting the personal data from a minor, an incompetent person and a quasi-incompetent person, the Company shall take into account of a personal data protection at the highest level as required by laws.
3.2 Types of the Personal Data to be Processed
- Personal Data such as name, surname, date of birth;
- Contact Data such as address, telephone number, email; and
- Technical Information such as Internet Protocol (IP) address, browser type, time zone settings, location data, operating system, platform, and other technologies used to access the Company’s website.
4. Usage and Disclosure of the Personal Data
The Company may disclose the Personal Data if necessary, for the purpose of complying with the informing Company’s objectives to a third party and/or any other organizations or entities as follows:
4.1 Trading partners, business partners of the Company, subsidiary, affiliated and/or other service providers. Disclosing the personal data to such third party and/or any other organizations or entities, the Company shall manage those mentioned persons to keep the personal data in secret and not to use it for any other purposes rather than the scope set forth by the Company.
4.2 Government sector which has a legal authority according to the laws; for the purpose of complying with the laws, orders, petitions; in order to coordinate with any sectors in relation to the legal compliance.
5. Personal Data Collection Period
5.1 The Company shall collect the Personal Data of the Data Subject for a necessary period for the purpose of the Company’s objective in accordance with a type of the personal data; except, there is a permission by laws providing a period extension for collection. In the event that the personal data collection period cannot be precisely specified, the Company shall collect the personal data for a foreseeable period in accordance with a collection standard. Once such collection period is expired, the Company shall delete or destroy such personal data.
5.2 In the case that the Company uses the Personal Data of the Data Subject with his consent, the Company shall process such personal data until the Data Subject notifies to cancel such consent and the Company has completely cancelled such consent as requested. In this regard, the Company shall collect necessary part of the personal data for recording a cancellation of such consent by the Data Subject.
6. Transferring the Personal Data to a Foreign Country
6.1 The Company may deliver or transfer the personal data of the Data Subject to an affiliated company or any other persons in a foreign country in a necessary case to complete the Company’s objectives which have been informed to the Data Subject.
6.2 In the event of delivering the personal data of the Data Subject to a foreign country, the Company shall comply with the Personal Data Protection Law and use a suitable measure to ensure that the Personal Data of the Data Subject is protected. The Company shall provide that a person who receives the data shall have a suitable protection measure to protect the Personal Data of the Data Subject and processes such personal data merely in a necessary manner.
7. The Rights of the Data Subject under the Laws
The Data Subject has the rights as follows:
7.1 Right to Withdraw a Consent
The Data Subject has the right to withdraw a consent of Processing the personal data which has been given to the Company at all time. In this regard, the withdrawal shall not affect a part of the personal data which has been Processing with lawfully consent given by the Data Subject.
7.2 Right to Access and Request Receive a Copy of the Personal Data
The Data Subject can inform the Company to provide a copy of the personal data and has the right to inform the Company to disclose an acquisition of the personal data where such personal data has been given without the Data Subject’s consent.
7.3 Right to Request Receive to Send or Transfer the Personal Data
The Data Subject can request the Company to send the data to other persons and request to receive the personal data which the Company has sent or transferred to other persons.
7.4 Right to Object Collection, Usage or Disclosure of the Personal Data
The Data Subject can object collection, usage or disclosure of the personal data upon there is no necessity to collect, use and disclose the personal data; or upon a collection, usage or disclosure for a purpose of direct marketing.
7.5 Right to Request for Deleting or Destroying the Personal Data
The Data Subject can request the Company to delete or destroy the personal data upon there is no further necessity of collection; or upon there is an unlawful Processing of the personal data.
7.6 Right to Request for a Usage Suspension of the Personal Data
The Data Subject can inform the Company to suspend the personal data usage during a personal data correctness inspection as requested by the Data Subject for a correctness amending of such data; or as requested to suspend instead of deleting the data.
7.7 Right to Request for an Alteration/Addition of the Personal Data
The Data Subject can request the Company to amend an incorrect, not-up-to-date, misleading personal data and/or to add the incomplete data.
7.8 Right to Complain
The Data Subject has the right to complain in the event that the Company violates or does not comply with the Personal Data Protection Act or with a declaration issued in accordance with the Personal Data Protection Act.
The Data Subject can exercise the rights which provided by law by contacting the Company in accordance with Section 9 of this Policy. The Company shall proceed with and consider the complaint in accordance with the rights of the Data Subject within the timeframe prescribed by laws. In this regard, the Company shall reserve the rights to refuse to proceed the Data Subject’s right under the conditions of the laws or under any agreements with the Company.
8. Security Measure
The Company has adopted the technical security standard and appropriate management in order to protect the personal data from an unauthorized accessing usage or disclosure; misuse; loss; destruction, by using the technology standard for security such as using a password and access restriction, in order to ensure that only an authorized person can access to the personal data of the Data Subject. The Company has provided an appropriate security measure to prevent loss; access; usage; alteration; amendment; disclosure of the personal data from an unauthorized person or a person who is not related to the personal data.
9. The Information of the Data Controller
Address: 2/3 Bangna Tower A, 16th Floor Unit A, Moo 14 Bangna-Trad Rd., K.M. 6.5, Bangkaew, Bangplee, Samutprakarn, Thailand 10540
Contact: [email protected]
10. Personal Data Protection Policies of Other Websites
This Privacy Policy applies solely to the services provided by the Company and the use of the Company’s website. In the event that the Data Subject click on a link that directs the Data Subject to another website (including links appearing on the Company’s website), the Data Subject are advised to review and comply with the privacy policy of such website separately from that of the Company.
11. The Company reserves the right to make all additions, alterations, improvements to the personal data protection measure to be appropriated in accordance with the Personal Data Protection Act. In the event of any amendments, the Company shall notify you of the updated measures via email.