Privacy Notice

Kafso’s name and reputation are built on trust. This Privacy Notice of Kafso (“Notice”) explains how we collect, use, and disclose (“process”) your personal data through our website and online services, including kafso.com. This Notice is intended to inform you of the personal data we collect about you, the reasons for processing that data, and the duration for which we retain your personal data. This Notice does not apply to websites and services displaying or linking to different privacy statements. Our websites and services may display or link to joint privacy statements that are supplementary to our Notice. However, without limiting the generality of the preceding statement:

The terms “you” or “your” in this Notice refer to the individuals whose personal data is processed by us or on our behalf, in connection with our activities or as a party to a transaction or legal proceeding involving us. Please see the section “Individuals Covered by this Notice and Whose Personal Data We Collect” at the end of this Notice for more information.

What types of data does Kafso collect?
Kafso may process personal data that can directly or indirectly identify you (“personal data”), depending on the type of product or service we offer or provide to you. Such personal data may include, but is not limited to, the following:

• Personal Information: This includes your name, surname, nickname, sample signature, date of birth, gender, and information in your identification card or passport, such as identification number or passport number, nationality, and your photograph.
• Contact Information: Personal or professional contact details such as job title, employer, address, email address, phone number, and social media accounts.
• Tax and Financial Information: Tax identification number, credit card number, bank account details, and other payment-related information.
• Transaction, Preferences, and Interests: Marketing and communication preferences and your purchase history of products and services.
• Communication Data: Your feedback, requests, or complaints about Kafso’s products or services, as well as phone call records and chat logs.
• Geolocation Data: We may collect information about the location of your device, such as precise location data (e.g., latitude and longitude in GPS coordinates) or approximate location data (e.g., derived from the internet browser or IP address of your device).
• Technical Information: IP address, technical specifications, and login data used to access our website.
• Criminal Offense Data: Information about your criminal convictions and offenses.
• Health Information: Your physical and mental health status (e.g., illnesses, disabilities, risk of diseases, medical history, physiological or biometric data).

In addition to your personal data, you may provide us with information about other individuals, such as their names, phone numbers, and email addresses, especially in cases where you participate in our marketing campaigns and request us to send rewards to other individuals. Please refer to the section “Individuals Covered by this Notice and Whose Personal Data We Collect” at the end of this Notice for more details.

We do not request sensitive personal data, such as information related to race or ethnicity, religious or philosophical beliefs, union memberships, political opinions, genetic data, biometric data, or information about your sexual life or sexual orientation, unless it is necessary for our operations (including providing services to you) and we have a legal basis to do so. Before processing sensitive data, we may redact, black out, or hide parts of the data that are deemed sensitive and not necessary for our operations. We have no intention to alter, falsify, or forge any document or information received from you.

We may combine the information we collect about you with other information we receive from third parties.

In some cases, Kafso may combine other information with personal data. If we combine other data with personal data or use other data to identify an individual, we will treat that data as personal data.

Who is covered by this Notice?
We collect information directly from you as our customer. We may also collect personal data indirectly about others from you, even if those individuals do not have a direct relationship with us but are associated with our customers.

If you provide us with personal data of third parties, please inform those individuals that we process their personal data and direct them to review our latest Notice.

We may also receive personal data from other sources, including:

• Third parties such as regulatory agencies or law enforcement for investigative purposes.
• Websites/social media of entities or professional clients, or from publicly available sources (e.g., your own website or social media).
• Public sources such as media outlets.

What if you do not disclose your data to us?
If we are required to process your personal data by law or to fulfill a contractual obligation with you (or take steps at your request before entering into a contract with you), but you do not provide the requested personal data, we may be unable to perform the contract we have or intend to enter into with you. In such cases, we may need to decline the related services, but we will notify you if this is the case.

How does Kafso process your data?
We may process your personal data only where we have a legal basis to do so. We collect, use, or disclose your personal data in the following circumstances:

(a) To fulfill our contract with you or take steps at your request before entering into a contract with you:

• Processing and managing your purchases or requests for our products or services.
• Registering and verifying user accounts.
• Awarding prizes to participants in marketing activities.
• Responding to your inquiries, handling your complaints or requests, or addressing your queries.
• Communicating with you about our website or services or fulfilling our contract with you or your contract with us.

(b) To comply with legal or regulatory obligations:

• Cooperating and communicating with competent authorities and complying with lawful orders from agencies as necessary.
• Meeting legal or regulatory obligations applicable to us.

(c) For our legitimate interests:

• Fulfilling contracts with corporate clients or service providers, or taking steps at the request of corporate clients or contractual partners before entering into a contract, including:
  • Handling customer complaints or requests.
  • Improving our products or services.
  • Researching, developing, and enhancing our services to improve existing products and services or develop new products and services to meet or exceed your needs and expectations.
  • Quality control of services.
  • Advertising, promoting news, promotions, products, or services similar to those offered to our members.
  • Conducting marketing analysis to improve products and services.
  • Issuing tax invoices as requested.
• In general, including the following:
  • Verifying raw data or information received from corporate clients or third parties for other purposes, as well as identifying individuals, authority for approval, or authority to act on behalf of your corporate entity, which is our corporate client or other party to a contract with us.
  • Complying with our internal policies, procedures, standards, or management.
  • Engaging with insurance companies to assess damages and remedies in case of customer complaints.
  • Seeking advice from external law firms or other external service providers.
  • Establishing legal claims, exercising legal rights, or defending against legal claims.

In any case for legitimate interests, we will process personal data to the extent necessary and uphold your fundamental interests or rights.

(d) To respect your rights when we request your consent for processing certain types of data:

• Processing criminal record and health information for safety and health control purposes, to comply with our safety procedures.
• Offering a variety of products or services, which may differ from those we have provided to you but are likely to align with your interests, by tailoring promotions and communications related to our brands, products, services, or activities resulting from personalized marketing.

For processing certain types of personal data, we will provide you with specific information and offer you the option to consent to such processing.

Does Kafso disclose personal data to third parties?
Kafso discloses your personal data to a limited extent. 

We may share your personal data within the Kafso organization for purposes consistent with the reasons for collecting your personal data outlined above.

We may disclose your personal data to companies providing support services to us (e.g., credit card processing services, other payment service providers, website hosting services, email and mail delivery services, outsourced customer service providers, insurance companies, external law firms, customs service providers for imported goods, postal or hosting services, and data management providers) and companies assisting in marketing our products and services (e.g., email service providers or marketing agencies). These companies may use your personal data to perform their duties on behalf of Kafso.

We may disclose certain data (1) upon receipt of lawful requests to proceed with legal processes and to comply with laws or lawful orders from government authorities, (2) to enforce our contracts, organizational policies, and terms of use, or (3) to protect our rights, property, or safety.

We may disclose your personal data to other individuals or entities with confidentiality obligations to us.

We may disclose your data in a manner that does not directly identify you (e.g., data that does not identify the owner or aggregate data) for statistical analysis and other business purposes.

How long does Kafso retain your personal data?
We will retain your personal data processed under this Notice for as long as necessary during the period you use our services. This period is the time required to achieve the purposes outlined in this Notice, including transition periods (e.g., complying with data retention obligations as required by applicable law) or for handling legal claims or regulatory requests (if any).

In principle, we will retain your personal data for as long as applicable law permits or requires. For example, most of our customer and/or contractual partner data will be retained during the term of the contract and for an additional ten years after the contract ends, per the general statutory limitation period under Thai law.

When there is no longer a need to use personal data, or when we no longer have a legal basis to retain it, we will remove your personal data from our systems and records and/or take appropriate steps to anonymize it.

What rights do you have under the law, and what options does Kafso provide regarding your personal data?
We believe in giving you control over your personal data. You have the following rights, subject to applicable legal and regulatory conditions and the terms and conditions of such laws and regulations:

• Right of Access: You have the right to access your personal data under our responsibility or request information on how we obtained your personal data that you did not consent to. You have the right to request copies of your personal data processing. For additional copies requested, we may charge a reasonable administrative fee in accordance with the Personal Data Protection Act B.E. 2562 (2019).
• Right to Rectification: You have the right to request the rectification of your inaccurate or incomplete personal data to be accurate, current, and not misleading.
• Right to Erasure: You have the right to request us to erase, destroy, or anonymize your personal data within the scope permitted by law. Please note that the complete right to request the erasure of all your personal data will be carefully considered in accordance with applicable legal requirements for processing your personal data.
• Right to Data Portability: You have the right to receive your personal data provided to us unless it is not technically feasible. If technically feasible, you have the right to request us to transfer your personal data in different formats directly to another data controller through automated means.
• Right to Object: You have the right to object to the collection, use, or disclosure of your personal data for certain reasons related to your circumstances as prescribed by law. If you object, we will continue to collect, use, or disclose your personal data only if we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms or in cases where it is for establishing legal claims, exercising legal rights, defending legal claims, or conducting scientific, historical, or statistical research, as applicable.
• Right to Withdraw Consent: If you have provided us with your consent to collect, use, or disclose your personal data, you can withdraw your consent at any time.
• Right to Lodge a Complaint: You have the right to file a complaint with the data protection authority if you believe that we or our employees or service providers have violated or failed to comply with the Personal Data Protection Act B.E. 2562 (2019) or any regulations issued under the Act.

Kafso offers several options for you to update or change your personal data and how we communicate with you. Please follow the instructions in promotional emails to unsubscribe from marketing communications.

If you unsubscribe from receiving promotional communications from us, we may still communicate with you on non-promotional matters, such as emails related to your account and our business relationship.

We may need to request specific information from you to verify your identity and ensure your right to access your data (or to exercise other rights). This is a security measure to ensure that your data is not disclosed to anyone without the right to receive such information. Please provide scanned copies/copies of identification documents for identity verification purposes if requested.

You will not be charged for accessing your data (or for exercising other rights). However, we may charge a reasonable fee if your request is unreasonable, repetitive, or excessive, or we may refuse to comply with your request in such cases.

We strive to respond to legitimate requests within 30 days. However, we may require more than 30 days if your request is complex or you submit multiple requests. In such cases, we will notify you and keep you informed of progress.

If You Are a Minor
We welcome everyone to become a valued customer and be part of us. However, if you are under 20 years of age, you must obtain consent from your legal guardian before using our services or interacting with us in any way.

How Is Personal Data Protected?
Kafso takes reasonable steps to implement appropriate physical, technical, and managerial security measures to help prevent loss, misuse, unauthorized access, disclosure, or alteration of personal data.

However, while we strive to protect your personal data, no information system or data transmission over the Internet or any public network can be guaranteed to be 100% secure. You are responsible for protecting your password and ensuring the security of your communication devices.

Updates to this Notice
This Notice is effective as of the date stated at the top of this page. We may update this Notice from time to time.

We will notify you of significant changes through our site or other usual communication channels that may affect the collection, use, or disclosure of your personal data. Please check for updates and changes to this Notice by reviewing the date of this Notice when you visit our site.

Last Updated: June 4, 2024