KASIKORN VISION Company Limited
To prioritize your privacy and safeguard your personal data, KASIKORN VISION Company Limited, along with its representative offices based in Vietnam and Indonesia, (“KVision”) has set out this personal data protection policy notice (this “Privacy Policy”), its policies, regulations and rules for KVision’s business, providing measures for protecting your personal data so that you can be assured your personal data entrusted to KVision will be processed to meet your needs and in accordance with data protection laws in Thailand, Vietnam and Indonesia (as applicable).
For the purpose of this Privacy Policy, “processing" means one or multiple activities that impact on personal data, including collection, recording, analysis, confirmation, storage, rectification, disclosure, combination, access, tracing, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction or other relevant activities.
1. What is the purpose of this Privacy Policy?
This Policy is to inform you, as a data subject, of the types to personal data to be collected and processed, the purposes and details of the collection and/or processing of your personal data, organization and/or individuals processing your personal data as well as your legal rights in connection with personal data.
2.To whom will this Privacy Policy apply, and what are channels for personal data collection?
2.1 To whom will this Privacy Policy apply?
This Privacy Policy shall apply to you if you are classified as one or several types of the following persons:
Individuals who are contact person of KVision’s investment project and for other business purposes;
Job applicants/candidates of KVision and its representatives; or
Employees of KVision.
2.2 Channel for collection of personal data
KVision may collect your personal data via the following channels:
Personal data that you give directly to or through KVision via digital channels, offices, websites, call, email, short message service (SMS), questionnaire, name card, meeting, training, seminar, event, recreation, marketing promotion activity, assigned persons or any other means/channels;
Personal data received or accessed by KVision from KASIKORNBANK Financial Conglomerate (“KGroup”), online employment marketplace, recruiters, information service providers, online platform of third party, public data sources, a person having legal authority or legal right, any other person or agency with which KVision has a legal relationship, etc. Before collecting and/or gaining access to your personal data from other sources, KVision will manage to ensure that your consent is given to such third-party sources for sharing your personal data with KVision in compliance with applicable laws and regulations, unless KVision is permitted by law to collect and process your personal data without consent.
3. What personal data does KVision collect and process?
Your Personal Data that KVision collects and processes may include basic personal data and sensitive personal data that can directly or indirectly identify you, including but not limited to:
Basic personal data:
Surname, middle name, given name, and other names (if any);
Date of birth; date of death or disappearance;
Gender;
Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current address, hometown, contact address;
Nationality;
Personal photos;
Telephone number, personal identification number, passport number, driver's license number, vehicle license plate number;
Marital status;
Information about family relationships (parents, children, spouse);
Information about the individual's digital account;
Other information associated with or helping to identify a specific person that is not covered by the applicable laws;
Sensitive personal data:
Data that reveals racial or ethnic origin;
Views on politics, religion, and beliefs;
Information about private life, personal secrets, and family secrets;
Health status;
Biometric data, genetic characteristics;
Data revealing an individual's sex life and sexual orientation;
Data on crimes and violations of the law collected and stored by law enforcement agencies;
An individual's location is determined through location services;
Username and password information for accessing the individual's electronic identity account; images of identity cards, citizen identification cards, and national identity cards;
Financial transactions history; and/or
Other personal data that is legally required to be kept confidential or requires strict security measures.
If you provide Personal Data of any other third party and/or who has involvement with you to KVision ("Related Third-Party Personal Data") such as shareholders, directors, authorized persons, family members, reference persons, trade partners, beneficiaries, emergency contact persons and/or any other person per document of your transaction, etc., you represents and warrants to KVision that you informed those persons of the details under this Privacy Policy and obtain their prior consent, if necessary, or apply other lawful bases to ensure that KVision can collect, use and/or disclose Personal Data of the aforementioned third party. You will indemnify KVision for any cost, charge, damage, expenses or loss incurred to KVision due to your failure to comply with this provision.
Your Personal Data, as mentioned in this Privacy Policy, includes the Related Third-Party Personal Data.
4. What are KVision’s purposes for collecting and/or processing your Personal Data?
KVision will collect and/or process your Personal Data only as necessary under KVision’s legitimate purposes which include the collection and/or processing of Personal Data for your benefits in using KVision’s products and/or services that meet your own purposes. Unless KVision is permitted by law to collect and process your Personal Data without consent, KVision will manage to ensure that your consent is given before collecting and/or processing your Personal Data in compliance with applicable laws and regulations, purposes for collection and processing or transfer of Personal Data under this Privacy Policy are as follows:
for employment and recruitment;
for compliance with relevant laws and regulations and for serving the activities of state agency as prescribed by specialized laws;
for business operations and risk management of KVision and KGroup or
for any purposes provided in consent form or this Privacy Policy.
Some of the following purposes may or may not apply to you. Please consider the objectives in accordance with your relationship with KVision on a case-by-case basis.
4.1 For Employment and Recruitment
To carry out necessary process for the recruitment and employment, including:
to carry out KVision’s recruitment process, job applicant selection, interview and other transactions relevant to the recruitment process;
to assess your qualifications to determine suitability for the position and salary;
to process in relation to employment and placement, including but not limited to social security registration, medical check-up, criminal record checking;
to carry out human resource management;
to record working time, payment of salary, bonus, remuneration or any other benefits; and/or
to assess work or duty of the employees, including but not limited to transfer and secondment.
4.2 Compliance with relevant laws and regulations and serving the activities of state agency
To comply with applicable laws and/or the orders of competent authorities, for instance:
to comply with an order from a competent authority, government agencies, banking supervisory agencies, court;
to comply with applicable laws and regulations related to financial institutions, securities and exchange, life insurance, non-life insurance, taxes, anti-money laundering, accounting, counter-terrorism and proliferation of weapons of mass destruction financing, electronic transactions, network information security, cybersecurity, bankruptcy, and other laws and regulations which KVision is subject to, either in Thailand, Vietnam, Indonesia and in other countries, including regulations and rules issued pursuant to such laws, which are now being enforced, to be amended or to be enforced in the future;
to collect and/or process the Personal Data of a person under a court’s receivership; and/or
to prevent, manage, respond, and minimize potential risks arising from non-compliance issues.
If KVision needs to collect and/or use your Personal Data in order to comply with KVision’s legal obligations, and you do not provide the necessary information when requested, KVision may not be able to process your requests, enter into, or continue the contract with you. This may also affect KVision’s ability to carry out our duties or impact your relationship with KVision.
4.3 Business operations of KVision and KGroup
To take necessary steps for KVision and KGroup’s operations, for instance:
to establish, maintain, and manage relationships with investment project partners and targets, including communication and coordination regarding project development, operations, and governance;
to execute KVision’s necessary and day-to-day business operations, including but not limited to the management of KVision’s vendors and business partners;
to record personal data, voice conversations, or images as reference, for the execution of investments, or during meetings, training, seminars, and other onsite activities;
to evaluate, monitor, and manage investments and related risks, and to safeguard the Company’s legitimate interests in connection with investment oversight and portfolio management;
to prevent, detect, manage, and respond to potential risks arising from fraud, corruption, cyber threats, debt default, contractual breaches, law violations (including money laundering, terrorism financing, proliferation of weapons of mass destruction, and offences related to property, life, body, liberty, or reputation), and financial sanctions;
to share personal data with affiliated companies or other companies in the same business sector to enhance work standards and to prevent, respond to, and minimize the risks described in (4);
to contact, record voices or images during meetings, training, seminars or other onsite activities; and/or
to anonymize your Personal Data (“Anonymous Data”).
KVision needs to collect and/or use your Personal Data in order to fulfill a contract with you, and you do not provide the necessary information when requested, KVision may not be able to process your requests, enter into, or continue the contract with you. This may also affect KVision’s ability to carry out its legal duties or impact your relationship with KVision..
5. To whom may KVision disclose your Personal Data?
5.1 KVision may disclose your Personal Data to other persons to the extent permissible under your consent or law. The persons or entities receiving such Personal Data (“Data Receivers”) will collect and/or process the Personal Data to the extent permissible under your consent or within the scope related to this Privacy Policy. In certain cases, you may be under the personal data protection policy of Data Receivers of your Personal Data.
KVision may disclose your Personal Data for various purposes based on your relationship and transaction.
KVision may disclose the data to Data Receivers, for example, companies within KGroup, Personal Data Processors; business partners, potential partners, co-branding alliances, cloud computing service providers; external service providers; KVision’s agents, sub-contractors, financial institutions, auditors, external auditors, legal advisors, tax advisors or other advisors or experts (as the case may be), competent authorities, prospective right/obligation assignees and/or right/obligation assignees in any transaction or business merger of KVision, online social media providers, any corporations or individuals under a relationship or contract with KVision (including executives, staff, employees, contractors, and agents, KVision’s advisors and advisors of Data Receivers, supervisory agencies, courts, any other person as necessary to perform duties under laws or regulations or for protection of KVision’s rights, third party’s rights, which may include any related legal procedures, and/or other individuals or organizations having legal authority or legal rights or at the request of the competent authorities for the same purposes above.
6. Will KVision send or transfer your Personal Data inbound or to other countries?
KVision is established in Thailand and may collect Personal Data from data subjects who are located in Vietnam, Indonesia and/or other countries. In this context, your Personal Data may be transferred to Thailand and/or accessed by KVision personnel or service providers across borders in the ordinary course of KVision’s business operations (for example, where data is shared within KGroup, accessed remotely, or stored on cloud platforms/servers located in Thailand or other countries).
KVision will ensure that any cross-border transfer or cross-border access of Personal Data will be carried out in accordance with applicable law and with appropriate protection measures. Such measures may include, as applicable, appropriate contractual safeguards (e.g., data processing agreements), internal policies and access controls, and due diligence/monitoring of service providers and recipients.
Where required by applicable law, KVision will prepare, maintain, and/or submit relevant records, notifications, or assessments in connection with cross-border transfer of Personal Data (for example, dossiers/impact assessments for cross-border transfer under Vietnamese regulations, where applicable).
6.1 Cross-border transfer mechanisms (country-specific). Where required by applicable law, KVision will implement one or more appropriate mechanisms before transferring Personal Data across borders. For avoidance of doubt, even where KVision is established in Thailand, collecting Personal Data from data subjects located in Vietnam and/or Indonesia may involve a cross-border transfer from those jurisdictions to Thailand, and the transfer requirements of the originating jurisdiction may apply. Appropriate mechanisms may include (as applicable): (i) transfer to destinations that have been recognized as providing an adequate level of protection; (ii) appropriate safeguards such as intra-group binding rules/policies or contractual safeguards with the recipient; and/or (iii) obtaining explicit consent from the data subject after being informed of the transfer, where other mechanisms are not available.
In particular, and without limitation: (a) Thailand: KVision will comply with the PDPC requirements for overseas transfer of Personal Data (including adequacy criteria and appropriate safeguards mechanisms where applicable); (b) Vietnam: KVision may prepare and maintain records/assessments and other dossiers required for cross-border transfer under applicable Vietnamese data protection rules; and (c) Indonesia: KVision will follow the sequence of conditions for overseas transfer under Indonesian law (e.g., adequacy/equivalent protection, appropriate safeguards, or explicit consent, as applicable).
6.2 Contact points and representative offices KVision may process Personal Data through its representative offices in Vietnam and Indonesia to support KVision’s operations. Data subjects may contact KVision using the contact details in Section 11 for any questions, complaints, or to exercise their rights.
7. How long does KVision retain your Personal Data?
KVision will retain your Personal Data for as long as necessary during the period you have a relationship with KVision, or for as long as necessary in connection with the purposes set out in this Privacy Policy which must be no longer than 10 years after the termination of the relationship with you, unless the following grounds occurred:
KVision may irrecoverably erase, destroy or anonymize the Personal Data when it is no longer necessary or when the period lapses and request Data Receivers to irrecoverably delete all the Personal Data stored by them, unless otherwise prescribed by laws.
8. How does KVision protect your Personal Data?
For retention of your Personal Data, KVision implements technical measures and organizational measures to ensure appropriate security in the Personal Data processing and preventing a Personal Data breach. KVision has set out policy on Personal Data protection which is amended as frequently as necessary and appropriately.
Moreover, KVision’s executives, staff, employees, contractors, agents, advisers and Data Receivers are obligated to maintain the confidentiality of Personal Data pursuant to confidentiality measures provided by KVision.
KVision strive to use commercially acceptable technical, administrative and physical measures to protect your Personal Data.
You may notify KVision immediately when becoming aware of any security incident and take necessary actions, where possible, to minimize the impact and likely consequences of the security incident. KVision reserves the right to be excluded from any responsibility for any losses and damages resulting from your negligence and incompliance with this Privacy Policy.
8.1 Personal data breach management and notification If a personal data breach occurs (e.g., unauthorized access, disclosure, loss, alteration, or destruction of Personal Data), KVision will investigate, take mitigation measures, and keep appropriate records. Where required by applicable law, KVision will notify competent authorities and/or affected data subjects within the timeframe and in the manner prescribed by law, taking into account the nature of the breach and the risks to data subjects.
8.2 Automated decision-making KVision may use automated means to support certain activities (e.g., security monitoring, fraud prevention, or administrative efficiency). Where applicable law grants specific rights regarding automated processing (including the right to object to certain automated processing results that have legal or significant effects), you may contact KVision to request further information or to exercise such rights.
8.3 Children’s / minors’ Personal Data KVision does not intentionally collect Personal Data from children/minors unless it is necessary for a legitimate purpose and permitted by applicable law. Where applicable law requires consent from a parent or legal guardian for the processing of a minor’s Personal Data, KVision will seek such consent or rely on other lawful grounds permitted by law.
9. What are your rights related to your Personal Data?
Your rights described here are legal rights of which you should be informed. You may exercise any of these rights within the legal requirements and this Privacy Policy at present or to be amended in the future as well as regulations set out by KVision.
Right to be informed: Unless otherwise provided by law, you have the right to be informed of your personal data processing, notably the processing purposes, methods, types of personal data to be processed, entities involved in the processing, potential unexpected consequences and/or damages, period of personal data processing, and complaint mechanism etc.
Right to give consent: You have the right to agree or disagree with KVision in requesting your consent to process your personal data as provided in the terms and conditions and/or agreements between you and KVision.
Right to access Personal Data: You have the right to access your Personal Data under KVision’s responsibility to view, obtain access, or obtain a copy of personal data in accordance with the provisions of laws and regulations.
Right to update and make correction: You have the right to complete, update and/or correct errors and/or inaccuracies of Personal Data to be updated, complete and not misleading, unless otherwise provided by applicable laws.
Right to withdraw consent: If you have given consent to KVision to collect and/or processing your Personal Data, you have the right to withdraw such consent at any time throughout the period your Personal Data is available to KVision. The collection and/or processing of your Personal Data which was undertaken before the withdrawal of your consent shall not be affected.
However, the withdrawal of your consent may prevent KVision from complying with the contract. For your benefits, you are advised to determine and inquire about the potential impacts before deciding to withdraw your consent. KVision is not responsible for any losses arising from the exercise of your right to withdraw consent to the processing of Personal Data.
Right to delete Personal Data: You have the right to request KVision to erase, destroy or anonymize your Personal Data if you believe that the collection and/or processing of your Personal Data is against relevant laws, retention of the data by KVision is no longer necessary in connection with related purposes under this Privacy Policy, or when you request to withdraw your consent or to object to the processing as earlier described.
Right to suspend, limit or restrict processing of Personal Data: You have the right to suspend, limit or restrict the processing of your personal data. The suspension, limitation or restriction on the processing of personal data will be implemented with regards to all personal data that you request.
Right to object to processing Personal Data: You have the right to object to the collection and/or processing of your Personal Data at any time to prevent or limit the disclosure of your personal data or the use of your personal data for advertising and marketing purposes, unless otherwise provided by the laws. If you object, KVision will continue collecting and/or processing your Personal Data only when KVision can establish other legal basis for doing so, or to comply with the laws, and KVision will do so on a case-by-case basis. In case KVision has the necessity to retain your Personal Data due to the aforementioned reasons, KVision will notify you of such reasons and apply necessary measures to ensure that your Personal Data is protected and will be further processed on a necessity basis as notified to you.
Right to complain, denounce and initiate lawsuits: You have the right to complain, denounce to competent authorities or initiate a lawsuit pursuant to relevant laws if you believe that the collection and/or processing of your Personal Data is violating or not complying with relevant laws.
Apart from the aforementioned rights, you may be entitled to other rights according to your applicable data protection laws in your residing territory.
Thailand:
Right to data portability: You are entitled to request your Personal Data which has been processed by KVision to be in a format that can be read or used in general with an automated device or equipment and can be used or disclosed via automated methods. You are also entitled to request KVision to send or transfer your Personal Data of said format to other data controllers if it can be processed via automated method, and to request Personal Data of said format which is directly sent or transferred by KVision to other data controllers, unless it cannot be processed due to technical difficulties.
Your aforementioned Personal Data must be Personal Data that you have granted consent to KVision to collect, use and/or disclose or must be Personal Data that KVision needs to collect, use and/or disclose for KVision to perform its part in accordance with your intention wherein you are a contract party with KVision or must be other Personal Data as determined by competent authorities.
Vietnam:
Right to self-protection: You have the right to self-protection according to the applicable laws, including but not limited to the Civil Code, or request competent agencies and organizations to implement civil right protection methods, such as compulsory termination of the violating act, public apology or correction, compensation for loss or damage etc.
Right to provide Personal data: You have the right to request KVision to provide you or your authorized persons with your personal data, unless otherwise provided by law, and to provide the measures and solutions to protect your personal data in accordance with the proper procedures, the competent authority or the agency, organization, or individual involved in processing personal data.
Right to claim damage compensation: You have the right to claim damages arising from violations against laws and regulations on data protection related to your Personal Data, unless otherwise agreed by the parties or otherwise provided by law.
Indonesia:
Right to obtain, use and/or transmit personal data to other parties: You reserve the right to obtain, utilize or deliver your Personal Data kept by KVision to any third parties, as long as the communication system used by KVision and the third parties are safe.
Right to file objection to automatic processing result: You reserve the right to file an objection to automatic processing result of your Personal Data which gives rise to any legal cause or significantly affect you.
The exercise of rights above may be restricted under relevant laws, and, in certain cases, it may be necessary for KVision to deny your requests or may prevent KVision from complying with your request, such as to comply with laws or court orders, public tasks, exercising the aforementioned rights may potentially violate other persons’ rights or freedoms, etc. If KVision denies the request, KVision will inform you of such reason(s) for such denial and apply necessary measures to ensure that your Personal Data is protected and will be further processed on a necessity basis as notified to you.
You may request to exercise your rights to KVision via contact@kasikornvision.com.
10. Will KVision rectify or revise this Privacy Policy?
KVision may consider rectifying, revising or changing this Privacy Policy from time to time, as deemed appropriate and permitted by the laws and regulations. In case of rectification or revision of, or change in this Privacy Policy, KVision will announce the current Privacy Policy on KVision’s website.
11. How can you contact KVision?
If you have any suggestions or inquiries regarding the collection and/or processing of your Personal Data as well as a request to exercise your rights under this Privacy Policy, you may contact KVision via contact@kasikornvision.com.