Privacy Notice
Addenda Company Limited (“Addenda”) hereby inform you details of the processing, whether collection, usage, and disclosure (“Processing”), of personal data which enables the identification of such person, whether directly or indirectly (“Personal Data”) through various channels, both online and offline. This includes, for example, information of contractors, information collected through websites, information collected through points of sale and events, information collected from social networks such as Facebook and search engines such as Google. Your Personal Data will be processed in accordance with applicable legislations e.g., Thailand’s Personal Data Protection Act B.E. 2562, the EU General Data Protection Regulation and other applicable laws and regulations.
This Privacy Notice provides important information in the following areas:
1. Objectives for Personal Data Collection
The Processing of your Personal Data is for management and administrative purposes in order to ensure that Addenda is able to run the business with you appropriately, effectively and lawfully in order to fulfil any and all obligations under contracts, to perform transactions, to provide suitable products and services, to respond to orders and requests, to improve the quality of products and services, and/or to pursue any other legitimate interest of Addenda.
If you have provided Personal Data of any third party to us, please ensure that such third party has acknowledged this Privacy Policy or granted consent for Processing their Personal Data where applicable.
You are free to decide whether you will allow Addenda to collect your Personal Data. However, please kindly note that if you decide not to provide your Personal Data, you may not be able to earn some certain benefits i.e., Addenda may have insufficient information to enter into a contract with you or perform our obligations or commitments in some circumstances.
The objectives for Addenda’s Processing of your Personal Data are as follows:
2. Collected Data
For objectives as specified above, Addenda may collect, use and disclose your Personal Data. The types of your Personal Data collected will depend on the interaction between you and Addenda, including but not limited to the following information:
-
personal details such as name, surname, photo, gender, birthday, weight, height, ID number, passport number and resident country;
-
sensitive Personal Data such as health data, food allergy data and biometric data;
-
contact information such as address, contact number, fax, email, Line ID;
-
financial information such as bank account number, credit/debit card data;
-
purchase and service history,
-
satisfaction information as provided by you;
-
technical information such as IP address, cookies, accessed devices, location while using the website;
-
voice recording of conversations, and photo and video recording by means of CCTV;
-
any information that you sent to us for the website connecting such as comment and your location;
-
public social media information;
-
securities holding information of directors, executives and persons related to directors and executives; and
-
any other information you are willing to provide.
Addenda’s websites may link to third party websites to provide relevant references. Addenda is not responsible for such external content managed by third party websites, which may contain separate privacy policies and data processing disclosures. The link to the website is not an authorization or representation of our affiliation with that third party. Addenda is not in a position to endorse or control privacy policy, security policy, cookies policy and data collection policy of the third parties.
3. Retention
Your Personal Data will be collected for as long as necessary to satisfy the objectives for which your Personal Data has been collected. For example, if you ordered our products through our online channel, Addenda will collect data related to your transaction and will keep such information as long as necessary to achieve the objective of that particular transaction, or if you subscribed to Addenda’s newsletter, your information will be collected and used until you unsubscribe or notify us that you no longer want to receive the newsletter.
4. Consent
Addenda may acquire your consent to collect, use and disclose your Personal Data for the following purposes, which include but are not limited to:
-
collection and use your sensitive Personal Data as necessary;
-
analysis of your preferences and consumption behavior in order to forecast your preferences based on your profile analysis in order to offer you with targeted content and advertisements;
-
if you are a minor, incompetent or quasi-incompetent person whose consent must be given by their parent, guardian or curator (as the case may be); and/or
-
sending or transfer of your Personal Data to another country, which may have inadequate personal data protection standards.
If it is necessary for compliance with the applicable laws, Addenda may process your Personal Data without your consent. In this regard, Addenda will strictly comply with the relevant laws regarding your Personal Data.
5. Disclosure of personal data
Addenda may be required to disclose your Personal Data internally(refer to the appendix for the subsidiaries list) and may need to disclose Personal Data to a third party, both within Thailand and in other countries, who have appropriate personal data protection standards. In this regard, Addenda will provide appropriate contract to protect your Personal Data:
Types of third parties that may receive your information e.g.;
-
contractual parties who provide Addenda’s services such as:
-
Data analysis service providers
-
Marketing agencies
-
Other agencies who operate or have an agreement with Addenda
-
trade partners
-
certified authorities which Addenda has requested to be certified for its own benefit including other auditing agencies
-
any third party who has legitimate rights to access your Personal Data.
6. Accessing Website
Addenda is obliged under Thai law to retain your computer traffic data, for at least 90 days from the date you entered Addenda’s website. However, Addenda will not use such data to analyze consumption behavior or conduct market research without your explicit consent.
7. Your rights
As a Data Subject, you have the following rights:
-
to withdraw consent for the collection, use or disclose Personal Data;
-
to request access to and obtain a copy of your Personal Data or to request the disclosure of the acquisition of your Personal Data obtained without consent;
-
to request to obtain Personal Data and request the transfer of Personal Data to a third party if it can be done automatically;
-
to object to the collection, use or disclosure of the Personal Data;
-
to request to erase or destroy Personal Data, or anonymize the Personal Data to become anonymous;
-
to request to restrict the use of Personal Data; and
-
to request to update, complete and not misleading of Personal Data collected.
You can exercise your rights by sending Addenda an email or sending a written notice to Addenda, attaching a copy of your ID or equivalent details as requested. Addenda will process such information received in accordance with, and to the extent permitted, by applicable laws.
Please note that Addenda shall retain our rights under the laws to reject your request in certain circumstances. If Addenda decides to reject your request, you will be notified of the reason for such rejection. Addenda will try our best, also with considering technical capabilities, to answer your request on how we process your Personal Data. However, if you have unresolved concerns, you can complain to Addenda or proceed further to the Data Protection Authorities.
8. Actions in the Event of a Personal Data Breach
The company places great importance on the security of personal data and has a clear policy for managing personal data breach incidents in accordance with the Personal Data Protection Act B.E. 2562 (2019).
-
Detection and Assessment of the Incident
The company will immediately investigate the incident upon receiving a report or when there is an indication of a personal data breach. This includes assessing the impact of the incident, the type and volume of data involved, potentially affected individuals, and the severity of the consequences.
-
Notification to the Regulatory Authority
If the data breach is found to pose a risk to the rights and freedoms of data subjects, the company will notify the Office of the Personal Data Protection Committee (PDPC) within 72 hours of becoming aware of the incident.
-
Notification to Data Subjects
If the breach is likely to result in a high risk to the rights and freedoms of data subjects, the company will inform the affected individuals as soon as possible. The notification will include an explanation of the incident, its impact, and the measures taken to mitigate the damage.
-
Mitigation and Prevention Measures
The company will implement technical or operational measures to reduce the damage from the incident, such as restricting access to affected systems, changing passwords, or temporarily suspending system usage. The company will also review and improve its information security measures and provide staff training to prevent future incidents.
-
Record-Keeping and Internal Investigation
The company will keep a detailed record of the incident, including its cause, impact, and corrective actions taken. An internal investigation will be conducted to determine the root cause and identify any weaknesses, along with recommending preventive measures to avoid recurrence.
9. Protection of Personal Data
Addenda is committed to protecting your Personal Data under our security standards and will provide appropriate safeguards to protect your Personal Data in order to ensure that Personal Data will be legally and appropriately collected, used or disclosed.
10. Changes to Privacy Notice
Addenda is committed to protecting your Personal Data under our security standards and Addenda reserves the right to make changes to this Privacy Notice to be appropriate and in accordance with any laws. Please frequently check to see any updates or changes to Addenda’s Privacy Notice.
11. Contact
If you have any enquiries or would like to exercise your rights or need any help regarding your Personal Data, please send an email to the below address and provide us with your personal information together with evidence to verify your identity such as ID card. However, Addenda may ask for additional relevant documents or may reject your request if Addenda has received insufficient information.
Addenda Company Limited
51 Naradhiwas Rajanagarindra Rd, Silom, Bang Rak, Bangkok 10500
Tel +6626367011
Data Protection Officer: DPO
51 Naradhiwas Rajanagarindra Rd, Silom, Bang Rak, Bangkok 10500
Email: bluebik-dpo@bluebik.com