Privacy Policy
Privacy notices and personal data protection policy of Muze Innovation
Personal Data Protection Policy
Privacy Notice — Employees & Applicants
Muze Innovation Company Limited (the "Company") recognizes the importance and its obligations under the Personal Data Protection Act B.E. 2562 (2019); the Company greatly emphasizes respecting the privacy rights of job applicants and employees. The Company is firmly committed to protecting your personal data and ensuring its security. To assure that the personal data of applicants and employees is protected in accordance with the Personal Data Protection Act and other applicable laws, the Company has issued this Privacy Notice to inform you of the details regarding the collection, use, and disclosure (all of which are referred to as "processing") as well as the legal rights as a data subject, which are explained below.
1. Scope of the Privacy Notice
This Privacy Notice applies to the personal data of job applicants and personnel of the Company, including directors, advisors, executives, current and former employees, interns, and any individuals related to Company personnel, such as employees' family members and emergency contacts.
"Applicant" refers to any individual applying for a position as a full-time employee, contract employee, outsourced worker under an employee agency, or freelance worker engaged by the Company, regardless of whether the application is submitted directly by the applicant, through internal recruitment, referral by another individual, or via a recruitment service provider.
"Employee" refers to an applicant who has been selected to enter into an agreement to work with the Company in the capacity of a full-time employee, contract employee, an outsourced worker engaged through a recruitment service provider, or freelance worker employed by the Company, as the case may be.
2. Personal Data refer to
2.1"Personal Data" refers to any information relating to an individual that enables identifying such individual, whether directly or indirectly, excluding information about deceased persons. Examples of personal data include first and last name, nickname, address, phone number, national identification number, passport number, employee ID, driver's license number, taxpayer identification number, bank account number, credit card number, email address, IP address, cookie ID, and log files. However, the following types of information are not considered personal data: business contact information that does not identify a specific individual, such as a company name, company address, corporate registration number, office telephone number, work-related email address, e.g., info@company.co.th, anonymous data or pseudonymous data that cannot be used to identify an individual through technical means, and information relating to deceased persons.
2.2"Sensitive data" refers to personal data regarding an individual's race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disabilities, trade union membership, genetic data, biometric data, or any other information of a similar nature as prescribed by the Personal Data Protection Committee. The Company is required to treat such data with particular care. The Company will collect, use, and/or disclose sensitive personal data only with your explicit consent, where necessary and permitted by applicable law.
For the purposes of this Privacy Notice, unless specifically stated otherwise, the terms "Personal Data" and "Sensitive Personal Data" relating to the aforementioned data subjects shall be collectively referred to as "Personal Data".
3. Personal Data Collected by the Company
The Company has collected your personal data only to the extent necessary and in accordance with the purposes of use, which will be notified to you in the following sections. The types of personal data collected by the Company are classified as follows:
3.1 Personal Data Collected from Job Applicants
| Types of Data | Examples of Data Collected, Used, and/or Disclosed by the Company |
|---|---|
| Personal Data | Name-Surname, Nickname, ID Number, Date of Birth, photograph, nationality, marital status, military status, or any other similar information that can be used to identify an individual, as necessary for the purposes of job application or employment contract execution. |
| Contact Information | Residential address, telephone, email address, and social media account. |
| Education and Employment Information | Educational background, academic records, test results, training or internship history, and certification as specified in the job application. |
| Job application information | ● Information provided in documents submitted to the Company, such as details in a resume or curriculum vitae (CV) ● Expected salary and interview-related information ● Information disclosed to the Company during job interviews ● Information appearing in interview evaluation forms, such as assessment results, knowledge and experience, and personal attributes. ● Supporting documents such as certificates and reference letters used for consideration. |
| Third-Party Personal Data Provided by the Applicants | Alternative contact person's information and reference contact details provided in the job application. |
| Information used as supporting evidence for the job application or legal documentation. | A copy of the identification card, a copy of name change certificate, a copy of the household registration, a copy of the military service certificate, a consent letter for background check, and a certificate of employment. |
3.2 Personal Data collected from employees.
| Types of Data | Examples of Data Collected, Used, and/or Disclosed by the Company |
|---|---|
| Personal Information | Name - Surname, nickname, Identification Number, date of birth, photograph, nationality, marital status, military status, or any other similar information that can be used to identify an individual as necessary for employment or the execution of an employment contract. |
| Sensitive Data | Religious affiliation, criminal record. |
| Contact Information | Residential address, telephone number, and social media account information. |
| Educational and Employment Information | Educational background, academic records, test results, training or internship history, and relevant certificates or qualifications as specified in the job application. |
| Financial Information | Salary information, bank account number for salary payment, and contribution details to various funds, such as the Social Security Fund and the Provident Fund. |
| Third-Party Information | Alternative contact person's information and reference contact information are provided in the job application. |
In the event that the Company is required to obtain your consent for any activities involving the collection, use, or disclosure of your personal data, such consent will be requested on a case-by-case basis.
In case, the Company receives a copy of your identification card or extracts information from your ID card through electronic means for the purpose of identity verification in connection with legal relations and/or any transactions with the Company. In that case, such data may include information on religion, which is considered sensitive data. The company does not have a policy to collect y sensitive personal data unless your explicit consent has been obtained. In such cases, the Company will implement appropriate handling procedures in accordance with its practices and as permitted by law.
The Company may receive third-party personal data related to you that has provided you with information about your spouse, children, parents, family members, emergency contacts, beneficiaries, references, or former employers. This information is used by the Company to manage your welfare and benefits, for emergency contact purposes, or for reference in a manner that benefits you. Please inform such third parties about this Privacy Notice so they are aware of it and obtain their consent where required, unless there are other legal grounds under applicable laws that permit the Company to receive or disclose their personal data without consent.
The Company does not collect personal data from minors (individuals under the age of 20 or those who have not reached legal age through marriage or by other means as defined by law), quasi-incompetent persons, or incompetent persons, and does not permit such individuals to register for or purchase the Company's products or services unless valid consent has been obtained or there is another legal basis for processing. If the Company becomes aware that it has unintentionally collected personal data from any of these individuals without proper consent or without relying on another legal basis, the Company will promptly delete such data upon discovery. In such cases, the Company may also be required to discontinue services to those individuals unless there are other applicable legal grounds permitting the processing of their data.
4. Source of Personal Data
The Company collects your personal data and sensitive personal data through the following processes
4.1Data you provide directly to the Company during the recruitment and hiring process, including information submitted in job application forms, supporting documents for consideration and selection, questionnaires, interviews, as well as any updates or changes to your personal information made during your employment or engagement as the Company's employee or personnel.
4.2Personal data obtained from other sources. The Company may collect your personal data from other sources, such as recruitment agencies, job application websites, references or guarantors, results from background checks, navigation systems, or network systems, as necessary and as permitted by applicable laws on a case-by-case basis.
4.3Personal data of third parties: the Company may receive third-party personal data related to you, which you have provided to the Company, such as information about your spouse, children, parents, family members, emergency contacts, beneficiaries, references, or former employers. This information is used to manage your welfare and benefits, for emergency contact purposes, or for reference in ways that may benefit you. Please inform such third parties of this Privacy Notice so they are made aware of it and obtain their consent if required unless there are other legal grounds that allow the Company to collect or disclose their personal data without consent.
4.4Automatically collected information: the Company may automatically collect your information when you access its systems or visit its website through electronic devices such as mobile phones, computers, laptops, etc., using technologies such as "cookies" or other technologies that operate similarly.
5. Purposes for the Collection, Use, and Disclosure of Personal Data
The Company collects, uses, or discloses your personal data based on lawful grounds and for the following purposes:
5.1Contractual Basis Section 24(3). To fulfill a contract to which you are party, such as an employment contract or other agreements, or to take steps at your request to entering into such a contract, as applicable.
5.2Legal Obligation Section 24(6). To comply with legal obligations such as those under labor protection laws, social security laws, tax laws, and other applicable legislation.
5.3Legitimate Interest Section 24(5). To pursue the Company's legitimate interests within a scope that you can reasonably expect and which does not override your fundamental rights or freedoms.
5.4Consent Section 19 in conjunction with sections 24 and 26. The Company will request your consent in cases where it is legally required to do so or where n other legal basis listed above is applicable for the processing of your personal data.
Purposes for job applicants
The Company collects, uses, or discloses your personal data for the following purposes:
| Purpose | Detail | Legal Basis for Data Processing |
|---|---|---|
| 1. Recruitment Process | To assess and select job applicants and to evaluate suitability for the positions available within the Company. This includes steps such as application submission, testing, interviews, assessments, selection, and offering employment. | Contractual Basis |
| 2. Pre-employment Background and Qualification checks | 1) To verify whether you have previously been employed or applied to the Company. 2) To assess your competencies or qualifications within the limits permitted by law, including inquiries with references you have provided. | Contractual Basis |
| 3. Internal Organizational Management Related to the Employment Process | 1) To support internal processes related to hiring, such as sharing applicant information or interview reports with decision-makers or relevant departments, preparing employment contracts, conducting onboarding training, and other procedures required for new employees. 2) To process your data in the EZY-HR system. 3) To help new employees understand the Company's background, clients, employee benefits, and internal regulations. 4) To process salary and wage payments. | Legitimate Interest of the Data Controller |
| 4. To Ensure Security Within the Company's Premises | To maintain safety and security within the Company's buildings or premises, including the process of exchanging ID cards prior to entering office areas or branches, and recording images within Company premises through closed-circuit television (CCTV) systems. | Legitimate Interest of the Data Controller |
| 5. Personnel and Work Development Processes | 1) This information can be used as supporting information for annual salary reviews and promotions. 2) To analyze reasons for employee resignations and improve areas of concern within the Company. 3) To record training and development activities. | Contractual Basis, Legitimate Interest of the Data Controller |
Purposes for Employees or Company Personnel
The Company collects, uses, or discloses your personal data for the following purposes:
1. Purposes Requiring Consent
| Purpose | Detail | Legal Basis for Data Processing |
|---|---|---|
| 1) For Activities Related to Religion | 1) To support religious-related matters, including special arrangements for attire or meal services. 2) To provide information to government authorities, as required by law, such as the Department of Employment. | Consent |
| 2) For Health-Related Activities | 1) To use the data for medical treatment and medication provided to employees during infirmary visits. 2) To submit information to group insurance providers for employee health insurance coverage. 3) To facilitate annual health check-ups for employees. | Consent |
| 3) For Submitting Information to Government Authorities | 1) To provide data to relevant government agencies as required by law, such as the Department of Employment. 2) To submit employee tax documents such as P.N.D.1 and P.N.D.1K. 3) To report educational loan repayments on behalf of employees. | Consent |
| 4) For Identity Verification for Access Control | Record fingerprint data for identity verification when entering or exiting buildings or restricted areas that require privacy protection and access control. | Consent |
2. Purposes Not Requiring Consent
| Purpose | Detail | Legal Basis for Data Processing |
|---|---|---|
| 1) To Carry Out Processes and Procedures Under the Employment Contract or Other Related Agreements Between You and the Company | 1) To manage various processes throughout the course of employment, such as maintaining employee records, establishing employee profiles and ID cards, conducting probation and annual performance evaluations, updating employee information, managing annual leave, other types of leave, maternity notifications, issuing employment certificates, processing resignation, and handling other personal requests submitted by you. 2) To manage human resources functions, including training, skill and competency development, job assignments, delegation of authority, appointments, transfers, position changes, organizational restructuring, performance appraisals, promotions, salary adjustments, bonus payments, career advancement planning, and succession planning. 3) To verify and authenticate your identity for time attendance and/or for access to company premises to perform duties, attend meetings, participate in training or seminars, or join company-related activities. | Contractual Basis |
| 2) To Manage Compensation, benefits, and employee entitlements | 1) To process salary payments and other forms of remuneration, including timekeeping, overtime or holiday work, tardiness, various types of leave, absenteeism or abandonment of duties, as well as payroll calculation and disbursement. 2) To administer employee welfare, provide or adjust benefits and entitlements, and manage changes to the Company's welfare structure, such as medical expense reimbursements and health insurance claims. 3) To issue employment certificates upon employee request for relevant purposes. | Contractual Basis |
| 3) To Comply with Applicable Laws | To fulfill legal obligations such as employee registration, tax deductions and payments, social security contributions, employee development programs, enforcement of legal judgements, and management of student loan repayments. | Legal Obligation of the Data Controller. |
| 4) To Support Internal Company Processes and Information Management. | 1) To conduct reporting, analysis, and statistical activities related to financial and business operations for purposes of management, budget planning accounting, business strategy, and human resource planning. 2) Support internal operational processes, which may require sharing your personal data with relevant departments or units, using only the necessary data for each specific purpose. 3) To assign access rights to various internal systems and personal data and to provide tools and equipment to facilitate your work. 4) To manage Company property provided to employees, such as access cards, keys, mobile phones, computers, or notebooks. | Legitimate Interest of the Data Controller |
| 5) To Support Employee Activities Both Within and Outside the Organization | 1) To organize or participate in various internal and external activities, including announcing results or publicizing events, which may involve the use of personal data such as your name, surname, photographs, or video recordings taken during participation in such activities for the purpose of event promotion. 2) To arrange training, seminars, site visits, or offsite activities, where the Company may disclose your personal data, as necessary, to third-party service providers for transportation, meals, accommodation, or venue arrangements. 3) To conduct knowledge assessments, questionnaires, or opinion surveys and to evaluate the results of such tests or surveys. | Legitimate Interest of the Data Controller |
| 6) For Audit, Supervision, and Risk Management | 1) To monitor work-related communications: The Company deems it necessary and reserves the right to inspect and review electronic communications transmitted through accounts, networks, or devices provided by the Company for work purposes in order to ensure that the Company's information resources are used properly, in compliance with applicable laws and Company policies. 2) To supervise and ensure that work performance is effective and in accordance with the Company's rules and regulations. | Legitimate Interest of the Data Controller |
| 7) To Ensure Security Within Company Premises | 1) To maintain safety and security within the Company's offices or premises, including the use of access card systems and the recording of images within Company areas through closed-circuit television (CCTV). | Legitimate Interest of the Data Controller |
| 8) To Manage Data of Former Employees | 1) To ensure business continuity by preserving records of decisions made in your former role and retaining institutional knowledge after your departure from the Company. 2) The Company may ask you to complete an exit survey to understand your reasons for resignation. This information is necessary for analysis, operational improvement, and employee retention. 3) The Company will retain your personal data for a period not exceeding 10 years from the date of your employment termination for the purpose of verification or dispute resolution within the statute of limitations as prescribed by law. | Legitimate Interest of the Data Controller, Legal Obligation of the Data Controller |
| 9) For Public Health Purposes in the Public Interest | To prevent the spread of communicable diseases or epidemics that may enter or spread within the Kingdom. | Compliance with Legal Obligation for the Purpose of Public Interest in Public Health |
| 10) To Enforce Disciplinary Measures Under Company Regulations | 1) To conduct inquiries and investigations into disciplinary matters or factual circumstances that may lead to disciplinary action, such as gathering information in cases involving employee misconduct or fraud. 2) To determine disciplinary actions or assess the consequences of misconduct, which may include documenting incidents, audio recordings, or CCTV footage. 3) To maintain records of incidents, outcomes, and disciplinary actions, such as warning letters and behavioral reports. | Legitimate Interest of the Data Controller |
The Company is required to collect your personal data as outlined above in order to comply with legal obligations, fulfill contractual obligations, or take necessary steps prior to entering into a contract with you. If you refuse to provide such personal data, the Company may be unable to comply with legal or contractual requirements or fulfill the purposes related to entering into such a contract with you.
6. Disclosure of Your Personal Data
To fulfill the purposes specified in this Privacy Notice, your personal data may be disclosed or transferred to various internal departments within the Company, as well as to external individuals or entities, as follows:
| Types of Data Recipients | Details |
|---|---|
| 6.1 Within the Company | Your personal data may be disclosed or transferred to specific departments within the Company, only to the extent necessary for fulfilling the stated purposes. Access will be granted solely to authorized personnel or teams based on relevance and necessity. ● Executives or your direct supervisors responsible for managing or making decisions concerning you, particularly in relation to HR processes. ● Various support departments, such as Business Development, Accounting and Finance, Information Technology, or other units which may be added or removed as the Company's organizational structure evolves. |
| 6.2 Government Authorities, regulatory Bodies, or Other Agencies as Required by Law | Your personal data may be disclosed or transferred to external authorities, such as: The Revenue Department, the Social Security Office, the Department of Labor Protection and Welfare, the Legal Execution Department, the Ministry of Commerce, the Ministry of Labor or any other agency authorized by law. |
| 6.3 External Organizations or Individuals | The Company may disclose your personal data to external organizations or individuals for purposes of verifying transactions, providing services, or supplying products that meet your needs. This includes business partners such as Health insurance providers for employee coverage, hospitals for annual health check-ups, PUUN Intelligent Co., Ltd., the accounting system provider for Muze Innovation Company Limited |
7. Consent and Possible Consequences of Consent Withdrawal
7.1In cases where the Company collects, uses, or discloses your personal data based on your consent, you have the right to withdraw your consent at any time. Such withdrawal will not affect the lawfulness of the collection, use, or disclosure of your personal data that was carried out based on your prior consent.
7.2If you are a minor under the Civil and Commercial Code, you must provide the Company with the details of your legal guardian before giving consent so that the Company may obtain consent from the guardian accordingly.
You may withdraw your consent, in whole or in part, regarding the collection, use, or disclosure of your personal data as outlined in this Privacy Notice by notifying the Company.
Please note that withdrawal of consent may affect job application consideration, employee benefits, or your ability to receive useful information from the Company. Therefore, you are encouraged to carefully consider and consult on any potential impacts before withdrawing your consent.
8. Cross-Border Transfer of Personal Data
8.1The Company may transfer or transmit your personal data to individuals or entities both domestically and internationally when necessary to perform a contract which you are a party or perform according to the contract between the Company and individual or legal entity for your benefit or to take steps at your request prior to entering into a contract. Such transfer may also prevent or suppress danger to your life, body, or health or that of another person, to comply with legal obligations, or to carry out essential tasks in the public interest.
8.2The Company may store your personal data on computers, servers, or cloud services provided by third parties. Additionally, the Company may utilize third-party software or applications, including Software as a Service and Platform as a Service, to process your personal data. In doing so, the Company will not permit unauthorized parties to access your data and will require such service providers to implement appropriate security measures for the protection of your personal data.
8.3In the event that it becomes necessary to transfer or transmit your personal data to a foreign country. The Company will comply with applicable personal data protection laws and implement appropriate safeguards to ensure that your personal data is adequately protected. You will retain your rights concerning your personal data in accordance with the law. The Company will also require the recipient of your personal data to implement suitable protection measures and to process such data only as necessary. Furthermore, the Company will take steps to prevent unauthorized use or unlawful disclosure of your personal data.
9. Retention and Duration of Personal Data Storage
9.1The Company will retain your personal data for as long as necessary, taking into account the necessity and purposes for which the data is collected, used, and processed, including compliance with applicable legal requirements.
9.2The Company may continue to collect, use, or disclose your personal data even after the termination of your relationship with the Company, insofar as it is required by law, for legitimate interests, or in a format where the data can no longer identify you directly or indirectly such as through anonymous data or pseudonymized data processed with technical safeguards to prevent re-identification.
9.3The Company will conduct periodic reviews to delete, destroy, or permanently anonymize your personal data, or otherwise restrict access to such data when the retention period has expired or when the data is no longer relevant or exceeds the necessary scope for the purposes for which it was collected or upon your request for deletion of your personal data.
10. How the Company Protects Your Personal Data
The Company places the highest priority on the security of your personal data. This includes measures such as data encryption and access controls, ensuring that both Company personnel and third parties acting on behalf of the Company comply with appropriate data protection standards. These responsibilities include safeguarding against data breaches.
The Company implements appropriate security measures for data processing and maintains your personal data with both technical measures and organizational measures to ensure its security and to prevent personal data breaches. These include the establishment of internal policies, procedures, and guidelines to protect personal data in accordance with applicable standards. The Company also implements safeguards to prevent data recipients from using or disclosing personal data beyond the intended purposes or without proper authority. The Company reviews and updates its policies, procedures, and guidelines on a regular basis as necessary and appropriate. Executives, employees, contractors, agents, consultants, and all recipients of personal data from the Company are obligated to maintain the confidentiality of personal data in accordance with the Company's data protection policies.
The Company regularly reviews and updates its data security protocols to ensure that the level of protection is appropriate to the risks involved. These protocols provide the confidentiality, integrity, availability, and resilience of personal data processing and include measures to protect against unauthorized loss, collection, access, use, alteration, modification, or disclosure of personal data. These data protection measures apply to all forms of personal data processing, whether conducted electronically or in paper format.
11. Data Subject Rights
11.1You have the following rights:
(1)Right to Withdraw Consent. If you have given consent for the Company to collect, use, and/or disclose your personal data (whether before or after the enforcement date of applicable personal data protection laws), you have the right to withdraw your consent at any time while your data is still held by the Company unless such right is restricted by law or by a contract that benefits you. However, withdrawing your consent may affect your job application, entitlements, or your ability to receive useful information from the Company. Therefore, it is advisable to carefully review and inquire about the potential consequences before withdrawing consent.
(2)Right of Access to Personal Data. You have the right to access your personal data and request a copy of such data from the Company. You also have the right to request disclosure of how the Company obtained your personal data. However, the Company may deny your request if granting access or providing a copy of the personal data would adversely affect the rights and freedoms of others, or if the Company is required to comply with legal obligations or court orders that prohibit the disclosure of such data.
(3)Right to Data Portability. You have the right to request and receive your personal data in a structured, commonly used, and machine-readable format in cases where such data is processed automatically. You also have the right to request that the Company transmit or transfer such data to another data controller, where technically feasible, using an automated means. Furthermore, you have the right to request that the Company directly send or transfer such data to another data controller, unless it is not technically possible to do so. This right applies to personal data that you have provided to the Company and that is being processed based on your consent, or where the collection, use, and/or disclosure of such personal data is necessary for the Company to provide you with its products and/or services as a contractual party, or to take steps at your request prior to using such products and/or services. It may also apply to other types of personal data as permitted by applicable legal authority.
(4)Right to Object to the Processing of Personal Data. You have the right to object, at any time, to the collection, use, and/or disclosure of your personal data where such processing is carried out based on the Company's or a third party's legitimate interests, within the scope that you can reasonably expect, or for tasks carried out in the public interest. If you raise an objection, the Company will continue to collect, use, and/or disclose your personal data only if it can demonstrate compelling legal grounds that override your fundamental rights or are required for the establishment, exercise, or defense of legal claims. Additionally, you have the right to object to the collection, use, and/or disclosure of your personal data for direct marketing purposes or for scientific, historical, or statistical research purposes.
(5)Right to Erasure of Personal Data. You have the right to request that your personal data be erased, destroyed, or anonymized if you believe that the data has been collected, used, and/or disclosed unlawfully, or if the Company no longer needs to retain the data for the purposes specified in this Privacy Notice. This right also applies when you have withdrawn your consent or exercised your right to object, as noted above unless the Company is required by law to retain the data or needs to retain it for the establishment, exercise, or defense of legal claims.
(6)Right to suspend the Use of Personal Data. You have the right to request the temporary suspension of the use of your personal data while the Company is verifying the accuracy of the data upon your request for rectification or objection, or in any other case where the Company is no longer required to retain the data under applicable laws but you request restriction instead of deletion.
(7)Right to Rectification of Personal Data. You have the right to request the correction of your personal data to ensure it is accurate, up-to-date, complete, and not misleading.
(8)Right to file a Complaint. You have the right to file a complaint with the competent legal authority if you believe that the collection, use, and/or disclosure of your personal data violates or does not comply with applicable data protection laws. If you have any concerns or questions about how the Company handles your personal data, you may contact the Company using the contact details provided in Section 14 of this Privacy Notice. In the event that there are reasonable grounds to believe that the Company has violated the personal data protection law, you have the right to file a complaint with the Expert Committee appointed by the Personal Data Protection Committee, in accordance with the procedures and regulations prescribed by applicable data protection laws.
In case, a data subject submits a request to exercise their rights under the data protection law, the Company will process the request within the timeframe required by law. However, the Company reserves the right to deny or refrain from taking action on such requests if permitted or required by law.
11.2The Company reserves all rights and sole discretion in determining whether to accept or decline your request. Your rights under Section 11.1 may be limited by applicable law, and in certain circumstances, the Company may refuse or be unable to fulfill your request such as when compliance is required by law or court order, for public interest, or where fulfilling your request may infringe on the rights or freedoms of others. If the Company refuses your request, it will inform you of the reason for such refusal.
12. Links to Third-Party Websites
While using the Company's website, you may encounter links to social media networks, platforms, or other websites operated by third parties. The Company makes efforts to link only to websites that uphold appropriate standards for personal data protection. However, the Company is not responsible for the content or personal data protection standards of such third-party websites, unless otherwise stated. Any personal data you provide to those third-party websites will be collected and governed by their respective privacy notices or policies (if any). In such cases, you are advised to carefully review and comply with the privacy notices or policies presented on those websites, which are separate from this Privacy Notice of the Company.
13. Changes to the Employee Privacy Notice
The Company will regularly review this Employee Privacy Notice to ensure its consistency with applicable practices, laws, and regulations. If there are any material changes to this Privacy Notice, the Company will notify you of such changes along with the updated version of the Privacy Notice through appropriate communication channels.
You are encouraged to periodically review this Privacy Notice for updates or amendments.
14. Contact Information
If you have any questions or concerns regarding the collection, use, and/or disclosure of your personal data, or wish to exercise any of your rights under this Privacy Notice, please contact:
| Contact | Details |
|---|---|
| Data Protection Officer (DPO) | E-mail: dpo@muze.co.th Tel: +66 (0)2 248 4695 |
| Office Address | 89 AIA Capital Center, 25th Floor, Room 2501–2503 Din Daeng Subdistrict, Din Daeng District, Bangkok 10400, Thailand |
15. Governing Law
You acknowledge and agree that this Privacy Notice shall be governed by and interpreted in accordance with the laws of Thailand. The courts of Thailand shall have jurisdiction over any disputes that may arise.
Privacy Notice — Partners
Muze Innovation Company Limited (the "Company") recognizes the importance and its obligations under the Personal Data Protection Act B.E. 2562 (2019) and places great importance on respecting the privacy rights of its current partners, prospective partners, business partners, including suppliers (collectively referred to as "Partners"). The Company is strongly committed to protecting your personal data and ensuring that your personal data is protected in accordance with the Personal Data Protection Act and other applicable laws. Accordingly, the Company has issued this Privacy Notice to inform you of the details regarding the collection, use, and disclosure (collectively referred to as the "Processing") of personal data, as well as your legal rights as a data subject, as outlined below:
1. The person whom this privacy notice applies to
This Privacy Notice applies to the personal data of current partners, prospective partners, business partners, and suppliers, whether as natural persons or natural persons acting on behalf of juristic persons, who are considered data subjects. These may include, for example, directors, consultants, executives, employees, agents, and any individuals associated with the Company's personnel who have been approved to enter into purchase, service, or lease agreements with the Company, whether as current or prospective partners, business partners, or suppliers providing goods and services to the Company. (If there are additional persons to whom this Privacy Notice applies, please specify accordingly.)
2. Definition of Personal Data
2.1"Personal Data" refers to any information relating to an individual that enables the identification of such individual, whether directly or indirectly. This data does not include the personal data of deceased persons. Examples include first name, last name, nickname, address, telephone number, national identification number, passport number, social security number, driver's license number, taxpayer identification number, bank account number, credit card number, email address, vehicle registration number, land title deed, IP address, Cookie ID, and Log File.
However, the following information is not considered personal data, such as business contact information that does not identify an individual e.g., company name, company address, corporate registration number, office telephone number, email address used for work purposes, and group email addresses such as info@company.co.th as well as anonymous data or pseudonymous data that has been irreversibly altered through technical means and can no longer be used to identify an individual, and data of deceased persons.
2.2"Sensitive Personal Data" refers to personal data relating to race, ethnicity, political opinions, religious or philosophical beliefs, sexual orientation, criminal records, health information, disabilities, trade union membership, genetic data, biometric data, or any other data of a similar nature as prescribed by the Personal Data Protection Committee. The Company is required to handle such data with special care and will collect, use, and/or disclose sensitive personal data only upon obtaining your explicit consent unless otherwise permitted by law.
Hereinafter in this Privacy Notice, unless otherwise explicitly stated, the terms "Personal Data" and "Sensitive Personal Data" relating to the aforementioned data subjects shall collectively refer to "Personal Data".
3. Personal Data Collected by the Company
The Company collects your personal data only to the extent necessary and in accordance with the purposes for which such data will be notified to you in the following sections. The types of personal data collected by the Company are categorized as follows:
| Types of Data | Examples of Data Collected, Used, and/or Disclosed by the Company |
|---|---|
| Personal Information | First name – Last name, Nickname, identification number, job position, signature |
| Contact / Address Information | Telephone number, Email address, Line ID, Address as shown on the national ID card, or any other reachable address |
| Other Information Related to the Relationship between the Company and Business Partners | Software developer, System administrator |
| Information of Other Persons Related to You | First name – Last name, Nickname, Job position, Signature of the liaison contact person or representative of a juristic person |
In case the Company obtains your identification card or retrieves your information from your identification card by an electronic system for the purpose of establishing a legal relationship and/or conducting any transaction with the Company, such information may include your religious belief, which is considered sensitive personal data. The Company does not have a policy to collect your sensitive personal data unless your consent has been obtained. In such cases, the Company will implement appropriate handling procedures in accordance with best practices and as permitted by applicable law.
The Company may also receive personal data of third parties related to you, which you have provided to the Company such as spouse, children, father, mother, family members, emergency contacts, beneficiaries, references, or former employers. The Company uses this data to manage your welfare and benefits, or to make contact in case of emergency, or as reference information for your benefit. Please inform such third parties of this Privacy Notice so that they are aware of its contents and obtain their consent if required unless there is a legal basis under applicable law that permits the disclosure of such personal data to the Company without consent.
The Company will not collect personal data of minors (i.e., those who have not yet reached legal age, meaning under 20 years old, or who have not attained legal capacity through marriage or other circumstances as prescribed by law), quasi-incompetent persons, or incompetent persons, and does not permit such individuals to register for using or purchase the Company's products, goods, or services, unless consent has been obtained or another legal basis applies. If the Company becomes aware that it has accidentally collected personal data from any of these individuals without obtaining consent and without relying on any other legal basis, the Company will delete such personal data immediately upon becoming aware of the case. The Company may also need to cease providing services to such individuals, unless there are other applicable legal grounds apart from consent.
4. Sources of Personal Data
The Company collects your personal data and sensitive personal data through the following processes:
4.1Data you provide directly to the Company, such as information submitted during the procurement process for engaging external service providers or leasing space; signing service agreements, lease agreements, purchase agreements, or any business-related contracts; completing various forms; responding to the Company's online questionnaires; or submitting information through the Company's website or mobile application; as well as communications via email, telephone, surveys, business cards, postal mail, during meetings or events, or when the Company visits you.
4.2Data the Company collects automatically when you access the Company's services or visit the Company's website through electronic devices such as mobile phones, computers, laptops, etc., using technologies known as "cookies" or other technologies that function similarly, or from internal system sources, shared drives, the Company's centralized database, logistics software systems, and/or electronic files.
4.3Data from external sources or reliable public sources, such as the Department of Provincial Administration, Department of Business Development, commercial data sources, websites, applications, social media platforms, data providers, government agencies or business partners for whom you work, act on behalf of, or represent, as well as from the Company's affiliates ("Company Affiliates") or third parties, such as other business partners of the Company.
5. Purposes for the Collection, Use, and Disclosure of Personal Data
The Company will collect, use, and/or disclose your personal data based on the nature of the relationship between you and the Company, relying on one or more of the following legal bases, as applicable: legitimate interest, performance of a contract, compliance with a legal obligation, your consent, or other lawful bases as prescribed under the Personal Data Protection Law. Such collection, use, and/or disclosure is carried out for the following purposes:
| Purpose | Detail | Legal basis for Data Processing |
|---|---|---|
| Business communication | For example, to communicate with business partners regarding the Company's or business partners' products, services, and projects, such as by sending documents, responding to inquiries, replying to requests, or providing progress updates on operations. | Contractual Basis |
| Selection of business partners | For example, to assess your and your business partner's qualifications and suitability; verify your identity and your business partner status; conduct due diligence or other background checks; or assess risks associated with you and your business partner (including checks against public data, law enforcement records, or the Company's internal debarment list) For issuing requests for quotations, conducting bidding processes, and entering into contracts with you or your business partners; or for evaluating your or your business partner's performance. | Contractual Basis |
| Management of business partner data | For example, to create a business partner account, record information in the system, maintain and update the business partner registry (including your personal data), and store and manage contracts and related documents that may contain your name. | Legitimate interest of the data controller |
| Relationship management | For example, to plan, implement, and manage contractual relationships and rights with business partners, such as considering the appointment, termination, or authorization of business partners for conducting transactions or ordering goods or services; processing payments; managing account-related activities; auditing; issuing invoices and collecting payments; arranging transportation and delivery; and providing services and support. | Contractual Basis |
| Business analysis and improvement | For example, to conduct research, data analysis, evaluations, surveys, and reporting related to the Company's products and services, as well as the performance of you or your business partner; and to develop and improve marketing strategies, products, and services. | Legitimate interest of the data controller |
| System monitoring and security | For example, to verify identity and control access as necessary; monitor systems, devices, and internet usage; ensure digital security; prevent and resolve criminal activities; manage risks; prevent fraud; and report incidents. | Legitimate interest of the data controller |
| Dispute Management | For example, to resolve disputes, enforce contracts, establish legal claims, assert or defend legal rights, including the granting of authority to act on behalf of the Company. | Compliance with legal obligations of the data controller |
| Compliance with internal policies and applicable laws | For example, to apply for business licenses as required by law; to coordinate with or contact government agencies, courts, or relevant authorities (e.g., the Revenue Department, the Royal Thai Police, the Office of the Auditor General); including investigations, handling complaints, and/or prevention of crime or fraud. | Legitimate interest of the data controller, Compliance with legal obligations of the data controller, Performance of tasks carried out in the public interest |
In case the Company requires to obtain your consent to activity involving the collection, use, or disclosure of your personal data, the Company will seek your consent on case-by-case basis.
However, if you choose not to provide your personal data to the Company, it may affect you. For example, the Company may be unable to proceed with your requests or fulfill contractual obligations. As a result, the Company may not be able to offer or provide certain products, goods, or services, either in whole or in part. You may also experience inconvenience or may not receive contractual performance, and in some cases, you may suffer loss or missed opportunities. Furthermore, the absence of such data may affect compliance with any legal obligations to which the Company or you are subject and may result in applicable penalties.
6. Disclosure of Your Personal Data
To fulfill the purposes stated in this Privacy Notice, your personal data may be disclosed or transferred to various internal departments of the Company, as well as to external individuals or entities, as follows:
| Type of Data Recipient | Detail |
|---|---|
| 6.1 within Company | Your personal data may be disclosed or transferred to relevant departments within the Company on a need-to-know basis, only to the extent necessary and for the purposes specified. Individuals or teams within the Company who are authorized to access your personal data will do so only as necessary and appropriate. ● Executives or your direct supervisors who are responsible for managing or making decisions concerning you, or when involved in human resources processes; ● Supporting departments or teams, including Business Development, Marketing, Technical Support and Operations, System Stability and Continuity Management, Product Development, User Experience Design, Accounting and Finance, Procurement, Business Support, Information Technology, or any other departments that may be added or adjusted in accordance with future changes to the Company's organizational structure. |
| 6.2 Government Agencies, Regulatory Authorities, or Other Entities as Required by Law | Your personal data may be disclosed or transferred to external organizations, such as the Revenue Department, Social Security Office, Department of Labor Protection and Welfare, Legal Execution Department, Ministry of Commerce, Ministry of Labor, or any other agencies empowered under applicable laws. |
| 6.3 External Organizations or Individuals | The Company may disclose your personal data to external organizations or individuals who make inquiries for the purpose of verifying your transactions and to enable the provision of services or the delivery of products aligned with your needs. This may include business partners such as P.U.N. Intelligent Co., Ltd., the provider of accounting systems for Muze Innovation Co., Ltd. |
7. Consent and Potential Consequences of Withdrawal
7.1In cases where the Company collects, uses, or discloses your personal data based on your consent, you have the right to withdraw your consent at any time. Such withdrawal shall not affect the collection, use, or disclosure of personal data to which you have previously consented.
7.2If you are a minor under the Civil and Commercial Code, please inform the Company of the details of your legal guardian prior to giving consent, so that the Company may seek consent from the guardian accordingly.
You may withdraw your consent, whether in whole or in part, to the collection, use, or disclosure of your personal data as specified in this Privacy Notice by notifying the Company. If you withdraw your consent for the Company to collect, use, or disclose your personal data, this may result in you being unable to receive services from the Company at the same level as if consent had been given.
8. Transfer or Transmission of Personal Data to Foreign Countries
8.1The Company may transfer or transmit your personal data to other individuals or entities, whether domestically or internationally, where necessary to fulfill a contract which you are a party, or to perform a contract between the Company and another individual or legal entity for your benefit, or to carry out pre-contractual measures at your request. Such transfer also be made to prevent or suppress danger to your life, body, or health, or that of another person, or to comply with legal obligations or carry out tasks in the public interest.
8.2The company may be stored your personal data on computers, servers, or cloud systems provided by third parties. The Company may also utilize third-party software or applications in the form of Software as a Service or Platform as a Service for personal data processing. In such cases, the Company will not permit unauthorized individuals to access your personal data and the Company will require such third parties to implement appropriate personal data security measures.
8.3In cases where it is necessary to transfer or transmit your personal data to a foreign country, the Company will comply with applicable personal data protection laws and implement appropriate measures to ensure that your personal data is protected and that you are able to exercise your rights in accordance with the law. The Company will also require the recipients of your personal data to implement appropriate safeguards, process such data only to the extent necessary, and take measures to prevent any unauthorized use or unlawful disclosure of your personal data.
9. Retention and Duration of Retention of Your Personal Data
9.1The Company will retain your personal data for as long as necessary, taking into account the necessity and the purposes for which the Company collects, uses, and processes such data, including compliance with applicable legal requirement and the criteria of determination the retention period such as the duration of the Company's relationship with you in your capacity as a registered partner, affiliate, director, representative, authorized person, or personnel acting on behalf of a natural or legal entity registered as a partner or affiliate of the Company. Personal data may also be retained for an additional period as necessary to comply with legal obligations, within applicable statutory limitation periods, or for the establishment, exercise, or defense of legal claims, or for other reasons in accordance with the Company's internal policies and regulations.
9.2The Company may continue to collect, use, and disclose your personal data even after the termination of your relationship with the Company, as necessary for compliance with legal obligations, for the purposes of legitimate interests, or in a format that no longer identifies you directly or indirectly such as through anonymous data or pseudonymized data that has been technically processed to prevent re-identification.
9.3The Company may retain your personal data for as long as necessary to fulfill the purposes stated in this Privacy Notice. In general, the Company will retain your personal data for no longer than 10 years from the date your relationship or last communication with the Company ends, unless a longer retention period is permitted or required by law.
9.4To comply with relevant statutory periods and prescription periods, the Company will retain your personal data in an appropriate format according to the type of personal data. However, the Company may be required to continue retaining your personal data even after the expiration of the legal prescription period, additionally as it is necessary for the legitimate interests of the data controller, except where such interests are overridden by your fundamental rights in relation to your personal data.
9.5The Company will conduct periodic reviews to delete or destroy personal data, permanently anonymize the data so that it can no longer be used to identify the data subject, or otherwise restrict the processing of such data, once the retention period has expired, or when the data is no longer relevant or exceeds the necessity in relation to the purposes for which it was collected, or upon your request for the deletion of your personal data.
10. Rights of the Data Subject
10.1You have the right to exercise:
(1)Right to Withdraw Consent. If you have given consent to the Company to collect, use, and/or disclose your personal data (whether such consent was given before or after the Personal Data Protection Act became effective), you have the right to withdraw your consent at any time while your personal data is retained by the Company, unless there are legal restrictions or a contractual obligation that provides a benefit to you.
In addition, that withdrawal of consent may affect your use of the Company's products and/or services. For example, you may no longer receive certain benefits, promotions, or new offers, and unable to access developed products or services that comply your need or no longer receive useful news and updates. Therefore, to maintain your benefit you are advised to carefully review and inquire about any potential consequences before proceeding with the withdrawal of consent.
(2)Right of Access to Personal Data. You have the right to access your personal data and request a copy of such personal data from the Company, including the right to request disclosure of the source from which the Company obtained your personal data. However, the Company may deny your request if granting access and providing a copy of the personal data would adversely affect the rights and freedoms of other individuals, or if the Company is required to comply with a legal obligation or a court order that restricts such disclosure.
(3)Right to data portability. You have the right to obtain your personal data in the event that the Company has arranged the data in a format that is readable or usable by automated tools or devices, and capable of being used or disclosed through automated tools. You also have the right to request that the Company transmit or transfer such data to another data controller, where technically feasible, and to request that the Company transmit or transfer such data directly to another data controller, unless there are technical limitations that prevent such transmission.
However, this right applies only to personal data that you have given consent for the Company to collect, use, and/or disclose, or personal data that is necessary for the Company to collect, use, and/or disclose in order for you to use the Company's products and/or services under a contractual relationship, or in order to take steps at your request prior to entering into such a contract, or to other types of personal data as specified by applicable law.
(4)Right to Object to the Processing of Personal Data. You have the right to object to the collection, use, and/or disclosure of your personal data at any time if the collection, use, and/or disclosure of your personal data is conducted on the basis of the Company's legitimate interests or those of another person or legal entity, provided that such processing does not exceed the scope that you can reasonably expect, or if it is carried out for the performance of a task carried out in the public interest. If you request to object, the Company will continue to collect, use, and/or disclose your personal data only where it can demonstrate legal grounds that are more compelling than your fundamental rights and freedoms, or where such processing is necessary for the establishment, exercise, or defense of legal claims, depending on the circumstances.
In addition, you have the right to object to the collection, use, and/or disclosure of your personal data for purposes related to direct marketing, or for purposes of scientific, historical, or statistical research.
(5)Right to Erasure of Personal Data. You have the right to request the deletion or destruction of your personal data, or to request that the data be anonymized so that it can no longer identify you, if you believe that your personal data has been collected, used, and/or disclosed unlawfully under applicable laws, or if you consider that the Company no longer has a necessity to retain such data for the purposes stated in this Privacy Notice, or if you have exercised your right to withdraw consent or your right to object as mentioned above. However, the Company may retain the data if it is required to comply with legal obligations or to establish, exercise, or defend legal claims under applicable laws.
(6)Right to Restriction of Processing. You have the right to request the temporary suspension of the use of your personal data while the Company is verifying a request for rectification or objection made by you, or in any other case where the Company no longer needs to retain your personal data but you request the restriction of its use instead of deletion, in accordance with applicable laws.
(7)Right to Rectification of Personal Data. You have the right to request that the Company correct your personal data to ensure that it is accurate, up-to-date, complete, and does not cause any misunderstanding.
(8)Right to file a Complaint. You have the right to file a complaint with the competent authority under the applicable law if you believe that the collection, use, and/or disclosure of your personal data is in violation of or non-compliant with the applicable personal data protection laws.
If you have any concerns or questions regarding the Company's practices in relation to your personal data, please contact the Company using the contact details provided in Clause 15 of this Privacy Notice for Partners. If there are reasonable grounds to believe that the Company has violated the Personal Data Protection Act, you have the right to file a complaint with the expert committee appointed by the Personal Data Protection Committee in accordance with the procedures and conditions set forth by law.
In case, as the data subject, submit a request to exercise your rights under the Personal Data Protection Act, the Company will take action within the period prescribed by law. However, the Company reserves the right to deny or refrain from acting on such requests in cases were permitted or required by law.
10.2The Company reserves all rights and sole discretion in determining whether to accept or reject any request submitted under Clause 10.1. Your exercise of rights may be subject to limitations under applicable law, and in certain circumstances, the Company may be required to deny or be unable to act upon your request for example, in cases where compliance with the law or a court order is required, where the request affects public interest, or where the exercise of rights may infringe upon the rights or freedoms of others. If the Company rejects your request, the Company will inform you of the reason for such rejection.
11. Personal Data Security Measures
The Company places the highest priority on the security of your personal data. Measures such as data encryption and access control are in place to ensure that both Company personnel and external parties acting on behalf of the Company comply with appropriate personal data protection standards. These measures include responsibilities to prevent data leakage and apply appropriate security measures throughout the data processing lifecycle.
The Company regularly reviews and updates its procedures and security measures to ensure that the level of protection is appropriate to the risks associated with personal data processing. These efforts are intended to ensure the confidentiality, integrity, availability, and resilience of personal data processing operations. The Company also implements safeguards to prevent loss, unauthorized access, use, alteration, modification, or disclosure of personal data.
Such security measures are applied to all types of personal data processing, whether conducted electronically or in paper-based formats.
12. Links to Third-Party Websites
While using the Company's application or website, you may encounter links to social networks, platforms, or other websites operated by third parties. The Company endeavors to link only to websites that adhere to personal data protection standards. However, the Company is not responsible for the content or data protection standards of such third-party websites unless expressly stated otherwise. Any personal data you provide to such third-party websites will be collected by the relevant third party and governed by their own privacy notice/policy (if any). In such cases, the Company recommends that you carefully review and comply with the applicable privacy notice/policy of the respective third-party website, as it is separate from this Privacy Notice.
13. Amendments to the Privacy Notice for Partners
The Company will regularly review this Privacy Notice for Partners to ensure compliance with its practices, as well as applicable laws, rules, and regulations. If there are any material changes to this Privacy Notice, the Company will notify you of such changes together with the updated version through appropriate channels.
You are encouraged to periodically review this Privacy Notice to stay informed of any updates or modifications.
14. Contact Information
If you have any questions or would like to inquire about the collection, use, and/or disclosure of your personal data, or wish to exercise your rights under this Privacy Notice, you may contact us using the following details:
| Contact | Details |
|---|---|
| Data Protection Officer | E-mail address: dpo@muze.co.th Tel: +66 (0)2 248 4695 |
| Address | 89 AIA Capital Center Building, 25th Floor, Rooms 2501–2503, Din Daeng Subdistrict, Din Daeng District, Bangkok 10400, Thailand |
15. Governing Law
You acknowledge and agree that this Privacy Notice shall be governed by and interpreted in accordance with the laws of Thailand. The Thai courts shall have jurisdiction over any disputes that may arise.
Privacy Notice — Customers
Muze Innovation Company Limited (the "Company") recognizes the importance and responsibilities under Personal Data Protection Act, B.E. 2562 (2019), the Company places values and respects the privacy rights of customer privacy including the natural person acting on behalf of legal entities who are considered data subjects (hereafter referred to as the "Customer"). The Company is fully committed to protecting your personal data with the utmost security and ensure that personal data of customers is protected in accordance with Personal Data Protection Act and other applicable laws. The Company has prepared this privacy notice. The purpose of this notice is to inform you of the details regarding the collection, use, and disclosure (collectively referred to as "processing") of your personal data, as well as your legal rights as a data subject, as outlined below.
1. The person whom this privacy notice applies to
This Privacy Notice applies to the "Customer," which refers to: (1) Individuals who are the target audience for the Company's product or service offerings. This includes participants in the Company's campaigns or marketing activities, individuals expressing interest in the Company's products or services through various channels, and/or users of the Company's services via online or electronic media, as the case may be. It also includes legal representatives of customers, such as legal guardians of minors, curators of incompetent persons, and custodians of quasi-incompetent persons. This definition covers former, current, and prospective customers. (2) Employees, personnel, officers, agents, shareholders, authorized persons, directors, contacts, representatives, and other individuals associated with the Company's corporate customers (collectively referred to as "Corporate Customers"). (3) Any other individuals whose personal data the Company receives, such as emergency contacts, spouses, parents, children, relatives, employers, agents, beneficiaries, or referees.
Collectively, the individuals referred to in (1) to (3) are referred to as "you," while those in (1) and (2) are collectively referred to as "Customer(s)."
2. Definition of Personal Data
2.1"Personal Data" refers to any information relating to an individual that enables the identification of such individual, whether directly or indirectly, excluding information of deceased persons. Examples include: first and last name, nickname, address, phone number, national identification number, passport number, social security number, driver's license number, taxpayer identification number, bank account number, credit card number, email address, vehicle registration, IP address, Cookie ID, and log files.
However, certain information is not considered personal data, such as business contact information that does not identify an individual, e.g., company name, company address, corporate registration number, office phone number, and work email addresses (e.g., info@company.co.th), anonymous data, pseudonymized data that cannot be traced back to an individual by technical means, and data of deceased persons.
2.2"Sensitive Personal Data" refers to personal data concerning race, ethnicity, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health information, disability, labor union membership, genetic data, biometric data, or other data as specified by the Personal Data Protection Committee that may similarly affect the data subject. The Company will process such sensitive data only with your explicit consent or in situations permitted by law.
However, hereinafter this Privacy Notice, unless otherwise specified, the terms "Personal Data" and "Sensitive Personal Data" relating to the above mentioned data subjects shall be collectively referred to as "Personal Data"
3. Personal Data Collected by the Company
The Company collects only the personal data necessary to fulfill the purposes stated herein. The categories of personal data collected, used, and/or disclosed include:
| Category of Data | Examples of Data Collected |
|---|---|
| 1) Personal Information | Full name, nickname, I number, job position, signature, consumption behavior, product opinions, and other identifying data necessary for contract performance. |
| 2) Contact Information | Telephone number, email address, Line ID |
| 3) Demographic Information | Address as per national ID or any contactable address |
In the event that the Company receives a copy of your national ID card or electronically extracts your data from it for identity verification purposes in legal or transactional contexts, such data may include religious beliefs, which are considered sensitive data. The Company does not intentionally collect such data unless your explicit consent has been obtained and as permitted by law.
Additionally, the Company may receive third-party personal data related to you, such as from your spouse, children, parents, family members, emergency contacts, beneficiaries, referees, or former employers. This information is used for welfare administration, emergency contact, or referencing purposes. You are advised to inform these individuals of this Privacy Notice and obtain their consent, unless otherwise permitted by law.
The Company does not collect personal data from minors (the individuals who have not reached age of 20 or have not attained legal age through marriage or other circumstances as prescribed by law), quasi-incompetent persons, or incompetent persons. The Company does not allow the said persons to register or purchase the Company's products and services unless valid consent has been obtained or another applicable legal basis applies. If the Company becomes aware that it has inadvertently collected data from such individuals without proper consent or legal basis, it will delete such data immediately and may cease providing services to the individual, unless a lawful exception applies.
4. Sources of Personal Data
The Company may collect personal data and sensitive personal data through the following means:
4.1Data Provided Directly by you. This includes personal data you provide to the Company, such as information submitted during service registration, supporting documents, requests to update personal or other information, service requests, or inquiries related to the Company's products or services. It also includes complaint submissions related to products and/or services, data used to register an account or create a profile with the Company whether through offline or online channels as well as any correspondence or communications with the Company, whether in written or verbal form, including any images or audio recordings. Additionally, this covers information you provide through surveys, feedback, or comments via various channels, as well as data collected when you engage with the Company at its head office, branch offices, customer service centers, or at exhibitions and promotional booths.
4.2Automatically Collected Data. When you access the Company's systems or website via electronic devices such as mobile phones, computers, laptops through technology that be called as "cookies" or similar technologies, please identify (if any)
4.3External Sources or Public Databases. Such as the Department of Provincial Administration, Department of Business Development, commercial data providers, websites, apps, social media platforms, data provider, business associations, or federations related to the Company's products or services. Please identify (if any)
4.4Company Interactions. Via communications with Company employees, agents, partners, or service providers through websites, apps, social media, phone, email, meetings, interviews, SMS, fax, postal mail, VDO call services, or other channels. The data may include text, images, or audio-visual content, please identify (if any)
4.5Information you provide when participating in Company Activities. Including marketing events, contest, lucky draws, promotional events, or other activities organized by or on behalf of the Company or its partners, affiliates, or other parties authorized or assigned by the company to conduct such activities (if any)
5. Purposes for Collecting, Using, or Disclosing Personal Data
The Company collects, uses, or discloses your personal data for the following purposes based on lawful processing grounds:
5.1With Your Explicit Consent – The Company may process your personal data for specific purposes only after obtaining your express consent.
| Purpose | Detail | Legal Basis for Data Processing |
|---|---|---|
| 1) For Marketing. | Marketing and communications, for marketing, communication, sales, offer special offers, promotion, discount, privileges, notifications. Announcements relating to the Company's products, goods, and services, as well as those of its affiliates and/or business partners, in cases where no other legal basis can be relied upon by the Company. (Please specify any additional purposes, if applicable.) | Consent |
| 2) Sensitive personal data contained in official documents. | Such as religious affiliation on a national identification card or ethnicity on a passport, may be used for the purposes of identity verification during the membership registration process, the preparation of products or services, and for record-keeping as proof of identity verification, in cases where the Company cannot rely on any other legal basis. (Please specify any additional purposes, if applicable.) | Consent |
| 3) Filming of client testimonial videos for promoting the Company's products. | The recording of still or moving images and interviews to gather feedback regarding the Company's products and services, based on the legal basis of consent. | Consent |
| 4) Offering products or services tailored to your consumption behavior. | Conducting surveys to analyze your consumption patterns (for corporate clients), as well as presenting new products that may be relevant to your previous interests or purchases of the Company's products or services. | Consent |
5.2Purposes for which the Company collects, uses, or discloses your personal data based on other legal basis the Company may rely on or refer to the following legal bases, as applicable:
(1) Contractual Basis – for initiating, entering into, or performing a contract with you;
(2) Legal obligation – for fulfilling the Company's legal duties;
(3) Legitimate interests – for the legitimate interests of the Company or third parties;
(4) Vital interests – for preventing or mitigating harm to life, body, or health of any individual; and/or
(5) Public interest – for carrying out a task in the public interest or in the exercise of official authority or any other legal basis permitted under applicable personal data protection laws, as the case may be, in order to collect, use, and/or disclose your personal data for the following purposes.
| Purpose | Detail | Legal Basis for Data Processing |
|---|---|---|
| 1) To provide you with the Company's products and services. | Such as fulfilling your requests prior to entering into a contract, entering into and managing the contractual relationship between you and the Company, issuing quotations as requested, delivering services related to maintenance, prevention, inspection, and improvement, facilitating your use of the services, supporting and carrying out other activities related to the Company's products and services, managing your account, and processing financial transactions including payments, refunds, issuance of receipts, payment vouchers, and invoices. This also includes handling and tracking the delivery, return, and exchange of the Company's products and services, verifying and confirming or cancelling transactions, as well as processing your orders. | Contractual Basis |
| 2) New customer registration | For example, to complete the new customer registration form and apply for the Company's credit line, supporting documents are required for the registration process, such as the company affidavit, VAT registration certificate, and other relevant documents (if any). | Contractual Basis |
| 3) To serve as supporting documents for contract signing or issuance of a quotation | This includes the collection of official documents used to identify individuals, such as a copy of a national identification card, a copy of a passport, a company affidavit, or other similar official documents used in contractual processes in accordance with the regulations of the Department of Business Development. *** The Company does not intend to collect, use, or disclose any sensitive personal data that may appear in such official documents. However, it is not possible to redact or remove such data, as doing so would result in document falsification or destruction, or the use of forged official documents. *** | Contractual Basis |
| 4) To communicate with you or present products and services that may be of interest to you | For example, to facilitate communication, coordination, service provision, and marketing, including presenting sales information, special offers, promotions, notifications, news, and product and service updates from the Company. This also includes processing and updating your personal data as a member of the Company, as well as managing various aspects of customer service such as inquiries, requests, feedback, complaints, claims, disputes, or compensation. It further covers the provision of assistance, resolution of technical issues. Notification of any corrective actions taken. The Company may also conduct surveys regarding your opinions and satisfaction with its services or activities, update your personal data (e.g., customer name list), and maintain related documentation that may reference you. | Contractual Basis |
| 5) For the Company's marketing, communications, and customer base expansion | For example, to carry out marketing activities, communication, sales, promotional campaigns or special offers, discounts, and privileges, including sending notifications or updates about the Company's products, goods, and services based on your expressed interests or previous service usage. This also includes presenting products, goods, and services that are similar or related to your interests and history of interactions with the Company, whether direct or indirect. Such purposes aim to enable your participation in offers, special privileges, campaigns, events, seminars, competitions, lucky draws, raffles, booths, and other Company-organized events, as well as related promotional programs and advertising services. The Company may also process and facilitate your participation in these activities and events, and handle the registration of your user account. | Legitimate interest of the data controller |
| 6) Analysis of Customer Interests or Behaviors and Data Analytics | For example, to gain further information about the products and services you have used or may be interested in, the Company may process your personal data such as by identifying the types of products or services you have used, or your preferred channels for being contacted by the Company. This may also include conducting satisfaction surveys, collecting data from your use of the Company's products and services, analyzing statistical data, studying customer behavior, segmenting customer groups based on product interest, evaluating timing and geographic locations, and identifying market trends. Such processing is carried out for purposes including marketing promotion, campaign planning, and the development of new products. It also enables the Company to better understand you, resolve issues related to existing products and services, and enhance its overall business operations. | Legitimate interest of the data controller |
| 7) Operation of the Website, Mobile Application, and Platform | For example, to maintain, operate, monitor, observe, and manage the website and platform in order to facilitate your access and ensure that the website and platform function smoothly, efficiently, and securely. This also includes enhancing your user experience and improving the structure, features, and content of the website and platform. | Legitimate interest of the data controller |
Additionally, if you choose not to provide your personal data to the Company, it may affect you as follows: The Company may be unable to proceed with your requests or fulfill contractual obligations. As a result, the Company may be unable to offer or provide certain products, goods, or services either in part or in full and you may experience inconvenience or a failure to receive contractual performance. In some cases, you may suffer damage / miss certain opportunities. Additionally, failure to provide such information may impact compliance with legal obligations that either the Company or you are required to fulfill, and may result in applicable penalties.
6. Disclosure of Your Personal Data
To achieve the purposes set out in this Privacy Notice, your personal data may be disclosed or transferred to various internal departments within the Company and to external individuals or entities, as follows:
| Type of Data Recipient | Detail |
|---|---|
| 6.1 Within Company | Your personal data may be disclosed or transferred to various departments within the Company for the purpose of complying with applicable laws and relevant contractual obligations, and only to the extent necessary to fulfill the stated purposes. Individuals or teams within the Company will be granted access to your personal data only as necessary and appropriate. These may include: ● Executives or your direct supervisors who are responsible for managing or making decisions related to you, or who are involved in HR-related processes. ● Various supporting departments and teams, such as: Business Development, Marketing, Technical Support and Operations, System Stability and Business Continuity Management, Product Development, User Experience Design, Accounting and Finance, Procurement, Business Support, Information Technology, or any other departments that may be added or adjusted in accordance with future organizational structure changes. |
| 6.2 Government Authorities, Regulatory Bodies, or Other Agencies as Required by Law | Your personal data may be disclosed or transferred to external organizations such as government agencies, regulatory authorities, or other entities as required by law. For example, this may include the Revenue Department, Legal Execution Department, Ministry of Commerce, or any other agency acting under legal authority. |
| 6.3 External Organizations or Individuals | The Company may also disclose your personal data to external organizations or individuals who contact or make inquiries for the purpose of verifying your transactions or to provide products and services that match your needs or the needs of the Company's business partners. For instance, this may include PUUN. Intelligent Co., Ltd., the provider of accounting systems for Muze Innovation Co., Ltd. |
7. Cookies and use of Cookies
When you visit the Company's website, certain information may be automatically collected from you through the use of cookies.
Cookies are data files specific to your computer that are created during website visits. They are used to store or track information related to website usage, including trend analysis, website management, user activity tracking, and remembering user settings. Some cookies are necessary cookies. Without these, the website may not function properly. Other cookies help improve the user experience by customizing content to individual preferences and making website navigation more efficient. Cookies may store login credentials (in a secure manner) and language preferences. Most internet browsers allow users to choose whether to accept cookies. If you choose not to allow cookies or delete them may affect website functionality. Without cookies some features or sections of the website may become limited.
In addition, third parties may also use cookies on the Company's website to deliver advertisements based on your interests and browsing history. These third parties may collect information such as browsing activity and or other data to understand how you accessed and which web pages you visited after leaving the Company's website. Automatically collected information may be linked to personal data previously provided on the Company's website. Please be aware that you may also be subject to the privacy or cookie policies of such third parties. The Company recommends that you review privacy or cookie policies for further details on how personal data is collected, used, or disclosed.
8. Consent and Possible Consequences of Withdrawing Consent
8.1In cases where the Company collects, uses, or discloses personal data based on your consent, you have the right to withdraw your consent at any time. Such withdrawal will not affect the collection, use, or disclosure of personal data that you have already consented to prior to the withdrawal.
8.2If you are a minor under the Civil and Commercial Code, please inform the Company of the details of your legal guardian before giving consent so that the Company can obtain consent from the guardian accordingly.
You may withdraw your consent, in whole or in part, for the collection, use, or disclosure of your personal data as described in this Privacy Notice by notifying the Company.
If you withdraw your consent for the collection, use, or disclosure of your personal data for reasons or purposes unrelated to marketing activities, the Company may be unable to proceed with certain processes, services, and/or management related to products, goods, services, or your existing relationship and/or account with the Company. This may result in you not receiving the full benefits of the Company's services to the same extent as when consent was granted for collection, uses, or discloses personal data to the company.
9. Cross-Border Transfer of Personal Data
9.1The Company may transfer or transmit your personal data to other individuals or entities, both within domestically and internationally, when necessary to fulfill a contract to which you are a party or to fulfill a contract between the Company and another individual or legal entity for your benefit, or to take steps at your request prior to entering into a contract. Transfers may also be made to prevent or suppress danger to your life, body, or your health or another person, to comply with applicable laws, or when necessary for the performance of a task carried out in the public interest.
9.2The Company may store your data on computers, servers, or cloud systems provided by third parties, and may use third-party software or applications, including software as a service or platform as a service model, to process your personal data. The Company will not allow unauthorized persons to access your personal data and will require such third parties to implement appropriate personal data protection and security measures.
9.3In cases where it is necessary to transfer or transmit your personal data to a foreign country, the Company will comply with personal data protection act and implement appropriate measures to ensure that your personal data is adequately protected. You will also retain your rights concerning your personal data as provided by law. The Company will further require any recipient of your personal data to implement suitable data protection measures and to process such data only as necessary. Measures will also be taken to prevent unauthorized access to or disclosure of your personal data by any third party without lawful authority.
10. Retention and Retention Period of Your Personal Data
10.1The Company will retain your personal data for as long as necessary, taking into account the necessity and the purposes for which the data must be collected, used, and processed. This includes compliance with applicable legal requirements.
10.2The Company may continue to collect, use, and disclose your personal data even after your relationship with the Company has ended, to the extent necessary for legal compliance, for legitimate interests, or in a form that no longer identifies you directly or indirectly such as through the use of anonymous data or pseudonymous data that can no longer be linked to you by technical means.
10.3The Company may retain your personal data for as long as necessary to fulfill the purposes of processing as specified in this Privacy Notice. The Company will retain your personal data for no longer than 10 years from the date your relationship or last contact with the Company ends, unless a longer retention period is permitted by law.
10.4To comply with relevant retention periods and legal statutes of limitations, the Company will store your personal data in an appropriate format based on the type of data. However, in some cases, the Company may need to retain your personal data beyond the legal statute of limitations for the legitimate interests of the personal data controller unless such interests are outweighed by your fundamental rights and freedoms in relation to your personal data.
10.5The Company will carry out periodic reviews and take steps to delete, destroy, anonymize, or otherwise restrict access to personal data that has passed its retention period, is no longer relevant, or exceeds the necessary scope for the original purposes of collection. The same applies when the Company is required to comply with your request for the deletion of your personal data.
11. Data Subject Rights
11.1You are entitled to exercise the following rights:
(1)Right to Withdraw Consent. If you have given consent for the Company to collect, use, and/or disclose your personal data (whether such consent was given before or after the effective date of the personal data protection law), you have the right to withdraw your consent at any time while the Company still holds your personal data, unless otherwise restricted by law or by a contract that benefits you.
Please note that withdrawing your consent may affect your ability to use certain products and/or services. For example, you may no longer receive privilege, promotional or new offers, improved products or services tailored to your needs, or relevant updates and information. Therefore, it is recommended that you review and understand the potential consequences before proceeding with the withdrawal of your consent.
(2)Right of Access. You have the right to access your personal data and request a copy of such data held by the Company. You may also request information regarding the source of your personal data obtained by the Company. However, the Company may refuse your request if such access and disclosure would adversely affect the rights and freedoms of others, or if the Company is required to withhold the data due to legal obligations or court orders.
(3)Right to data portability. You have the right to receive your personal data in a structured, commonly used, and machine-readable format where the Company has arranged for such data to be processed by automated means. You may also request that the Company transmit or transfer such data to another data controller, where technically feasible, or request to receive the data that the Company has transferred directly to another data controller unless it cannot be done due to technical reasons.
The above personal data must be data for which you have given consent to the Company to collect, use, and/or disclose, or data that the Company is required to collect, use, and/or disclose in order to provide you to use products and/or services as requested whether under a contract to which you are a party, or to carry out at your request prior to using the Company's products and/or services, or as other personal data as specified by applicable legal authorities.
(4)Right to Object to the Processing of Personal Data. You have the right to object at any time to the collection, use, and/or disclosure of your personal data if such processing is conducted based on the Company's legitimate interests or those of another individual or legal entity, provided that it does not exceed what you could reasonably expect or when the processing is carried out for the performance of a task for the public interest. If you submit an objection, the Company will continue to collect, use, and/or disclose your personal data only if it can demonstrate compelling legitimate grounds for such processing that override your fundamental rights or if the processing is required for the establishment, exercise, or defense of legal claims, as the case may be.
You also have the right to object to the collection, use, and/or disclosure of your personal data for direct marketing purposes or for scientific, historical, or statistical research purposes.
(5)Right to Request Erasure of Personal Data. You have the right to request the deletion, destruction, or anonymization of your personal data if you believe that your data has been collected, used, and/or disclosed unlawfully, or if you believe the Company no longer has a necessity to retain your data for the purposes stated in this Privacy Notice. This right may also be exercised when you have withdrawn your consent or exercised your right to object as outlined above unless the Company is required to retain the data in order to comply with legal obligations or to establish, exercise, or defend legal claims.
(6)Right to Request Suspension of Use of Personal Data. You have the right to request a temporary suspension of the use of your personal data in cases where the Company is in the process of verifying your request to correct or object to the processing of your data, or in any other situation where the Company no longer requires the data and need to delete or destroy your personal data in accordance with applicable data protection laws but you prefer that its use be suspended instead of deleted or destroyed.
(7)Right to Rectification of Personal Data. You have the right to request that the Company correct any of your personal data to ensure that it is accurate, up to date, complete, and does not cause misunderstanding.
(8)Right to file a Complaint. You have the right to file a complaint with the competent authority if you believe that the collection, use, and/or disclosure of your personal data is in breach of or inconsistent with applicable laws.
If you have any concerns or questions regarding the Company's handling of your personal data, please contact the Company using the contact details provided in Section 15 of this Customer Privacy Notice. In cases where there are reasonable grounds to believe that the Company has violated the Personal Data Protection Law, you may also file a complaint with the Expert Committee appointed by the Personal Data Protection Committee in accordance with the procedures set forth by law.
In the event that a data subject submits a request to exercise their rights under personal data protection laws, the Company will proceed in accordance with the timeframe prescribed by law upon receiving such request. The Company reserves the right to refuse or decline to act on the request if permitted or required by law.
11.2The Company reserves all rights and sole discretion to accept or deny your request.
Your exercise of the rights outlined in Section 11.1 may be subject to limitations under applicable laws. In certain circumstances, the Company may be required to deny or be unable to fulfill your request, such as when legal obligations or court orders must be followed, or when fulfilling the request would infringe upon the rights or freedoms of others. If the Company denies your request, the Company will inform you of the reason for the denial.
12. Personal Data Security Measures
The Company places the highest importance on the security of your personal data. This includes measures such as data encryption and access restriction are implemented to ensure that both Company personnel and third parties acting on behalf of the Company comply with appropriate personal data protection standards. These standards include duties to prevent data breaches and ensure that appropriate security measures are applied during data processing.
The Company will protect your personal data by using appropriate technical measures and organizational measures to ensure appropriate protection process of personal data and to prevent personal data breaches. The Company has established the policies, procedures, and internal regulations on personal data protection, including measures to prevent recipients of data from using or disclosing the data outside the stated purposes, without authority, or unlawfully. The Company regularly reviews and updates its policies, procedures, and guidelines as necessary and appropriate. In addition, executives, employees, contractors, agents, consultants, and any recipients of personal data from the Company are obligated to maintain the confidentiality of personal data in accordance with the Company's established confidentiality measures.
The Company also regularly reviews and improves its personal data security procedures to ensure that data security remain current and appropriate to the level of risk involved. These protections aim to ensure the confidentiality, integrity, availability, and resilience of personal data processing as well as to provide ongoing protection against the loss, unauthorized collection, access, use, alteration, modification, or disclosure of personal data. The Company applies these security measures to all types of personal data processing, whether conducted electronically or in paper-based format.
13. Links to Third-Party Websites
When using the Company's applications or website, there may be links that direct you to social media platforms, other online platforms, or websites operated by third parties. While the Company endeavors to link only to websites that uphold acceptable personal data protection standards. However, the Company is not responsible for the content or data protection standards of such third-party websites, unless otherwise stated. Any personal data you provide to those third-party websites will be collected and managed by those parties and will be subject to their respective privacy notices or personal data protection policies (if any). Additionally, you are advised to carefully review and exercise align with the privacy notices or policies of Personal Data Protection that published on the websites since differ from the Company's policies.
14. Amendments to the Privacy Notice for Customers
The Company periodically reviews its customers' Privacy Notice in order to ensure alignment with best practices, legal requirements, and relevant regulations. If any significant changes are made to the Privacy Notice, the Company will inform you of such updates and provide the revised Privacy Notice through appropriate communication channels. You are encouraged to review this Privacy Notice periodically to stay informed of any changes.
15. Contact Information
If you have any questions or would like to inquire about the collection, use, and/or disclosure of your personal data, or wish to exercise your rights under this Privacy Notice, you may contact us using the following details:
| Contact | Details |
|---|---|
| Data Protection Officer | E-mail address: dpo@muze.co.th Tel: +66 (0)2 248 4695 |
| Address | 89 AIA Capital Center Building, 25th Floor, Rooms 2501–2503, Din Daeng Subdistrict, Din Daeng District, Bangkok 10400, Thailand |
16. Governing Law
You acknowledge and agree that this Privacy Notice shall be governed by and interpreted in accordance with the laws of Thailand. The Thai courts shall have jurisdiction over any disputes that may arise.